Hacker News new | ask | show | jobs
GitHub shouldn't be a dependency for publishing Rust on crates.io (infosec.exchange)
44 points by speckx 1 hour ago
5 comments

An RFC was recently merged to unblock this: https://github.com/rust-lang/rfcs/pull/3963

The implementation on this has started.

Something to keep in mind is https://blog.m-ou.se/rust-is-not-a-company/. Rust is mostly driven by volunteers working on what they find interesting. Boring/uninteresting tasks depend on funding, a warm body to accept the funding, and a reviewer.

See the official project issue on this: https://github.com/rust-lang/crates.io/issues/326

TL;DR: They want to fix this, it's a lot of work that no one's being paid to do, there's a roadmap with specific tasks that need doing, volunteer contributions are welcome.

Just going to say it out loud :) Its been known for 10 years.

https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

10 years ago, GitHub had a far better reputation and the Rust ecosystem was much smaller and less load-bearing, so "what if someone doesn't have a GitHub account" was a theoretical concern for most people. So the issue was a low-priority backlog item that everyone agreed would be nice-to-have but there weren't enough people willing to volunteer their time to it over more important and more impactful work.

Obviously, the situation has changed in recent years, so it's now considered a much higher priority by many people and some of them are actively working on it. But it's a lot of work to be done by volunteers, so it takes time.

That's the reality of open-source projects: things get done when they are important enough to motivate someone to either fund it or work on in their free time, not according to idyllic roadmaps and schedules.

Pro tip: Using "load-bearing" is heavily associated with LLM usage :)
You could say it’s the real smoking gun. With significant blast radius.
Wow, have you forgotten? https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

10 (edit: 8) years ago MS took over Github. The writing was on the wall then...

No need to explain OSS to me, I maintain and contribute.

> it's a lot of work that no one's being paid to do,

aren't they like some kind of non-profit (in the legal sense) that is still able to take a lot of money (from players like Google and Co, to justify fixing this), as opposed to ... say the Zig foundation, ... that is is also "non-profit" but can't get money the same way?

Sadly, that's probably correct. No outside single point of failure that can cancel users at will can be allowed to gatekeep open source projects.
Especially not now, what if they're down? ;)
Aka one of the many Rust reasons why I chose to learn C.