• 2 Posts
  • 12 Comments
Joined 1 year ago
Cake day: July 20th, 2023
  • kornel@lemmyrs.orgtoRust@programming.dev•Should I Rust or should I Go?English
    14·
    1 year ago

    I maintain a long-term Rust + Node.js project, and the Node side is the painful one.

    Node makes backwards-incompatible changes, and doesn’t have anything like the editions to keep old packages working. I can end up with some dependencies working only up to Node vX, and some other deps needing at least Node v(X+1).

  • kornel@lemmyrs.orgtoRust@programming.dev•Rust Foundation Security Initiative ReportEnglish
    3·
    1 year ago

    To generate the LLVM code correctly you need to run build.rs if there is any, and run proc macros which are natively compiled compiler plugins, currently running without any sandbox.

    The final code isn’t run, but the build process of Cargo crates can involve running of arbitrary code.

    The compilation process can be sandboxed as a whole, but if it runs arbitrary code, a malicious crate could take over the build process and falsify the LLVM output.

  • kornel@lemmyrs.orgOPtoGameDev@lemmy.blahaj.zone•If you share gameplay as a GIF, use gif.skiEnglish
    6·
    1 year ago

    Because it works everywhere, because it’s so old.

    The next best option, a decade old WebP, is a mixed bag. In its best-compressing mode it will lower color resolution and add fringing like a JPEG. In its lossless mode it may be bigger than GIF.

    If you have an option to use a proper video format, go for it. But often sites just allow upload of GIFs. If you send a newsletter you never know how primitive (Outlook) the client will be.

  • kornel@lemmyrs.orgtoRust Lang@lemmyrs.org•Libs.rs is now closed sourceEnglish
    1·
    1 year ago

    Why do you say like crap? I took time to understand his position and reasons (which was helpful, because they were different reasons than requests before that). We’ve agreed on a way forward, and I have fulfilled his wish. It has been a bit frustrating for both of us, because it was in essence a conflict, but I think it’s been resolved in a civil way.

  • kornel@lemmyrs.orgtoRust@programming.dev•epage (clap.rs and many more) has requested the removal of all his packages from lib.rs over misinformationEnglish
    5·
    1 year ago

    lib.rs author here.

    The visible deprecation label was unintentional. I agree that labelling an actively maintained crate as unmaintained is wrong, regardless of what the crate is for. If I wanted to mess with the bitcoin page, there are plenty of true negative things that I could have said about bitcoin, and you know I wouldn’t be shy about it.

    I do think that use of bitcoin during a climate crisis and an energy crisis is immoral. Bitcoin is like a button that gives you $1000 now, but kills someone else in the future. This is not something that deserves polite acceptance. Seriously, I beg you at least switch to proof-of-stake schemes if you must.

    However, in this particular case I did not mean to label it as unmaintained, since that’s plainly incorrect. You’re right to be upset, and right to be suspicious about the incorrect label given my reputation as cryptocurrency hater. However, I’m still disappointed that the community reaction was immediate pitchforks and burn-the-site-down pile-on, followed by even more scrutiny and viewing my smallest actions in the worst possible light. Couldn’t you first ask if it was meant like this and wait for my response?

    I’ve meant to downrank all crates using the bitcoin crate. Downranking of them is IMHO a fair game, since bitcoin-dependent crates are not relevant to my intended target audience.

    Apart from that, I’ve also got some feedback that it’s not acceptable to change or augment any crate metadata at all. The site does change crate data en masse, but when it works right this is a feature. For example, it guesses categories when they’re missing or are likely invalid (everyone gets the “parsing” category wrong). The site has a ranking algorithm, which IMHO makes its search really helpful, noticeably better than crates.io’s. But by necessity it includes many ranking signals, which are imperfect, and the choice of the signals is inherently subjective (e.g. just sorting by downloads would be more transparent, but it’s still just a different subjective choice, and has its own downsides).

    I’m open to feedback how to make it clearer that the site is unofficial, opinionated, and a mashup of data sources and heuristics. I don’t think there’s a point of running lib.rs without the data cleanups or ranking. This would reduce it to only mere redundant duplicate of crates.io. I want to make something clearly better, beyond what pure crates.io can do.

    But there are 120K crates and growing, so this is a hard task. If I’m going to get a load crap for every buggy boolean, I don’t want to run the site. It exists for the community, and if the community thinks I’m a villain, then why should I bother.