News for hackers. Stuff that matters.
Re:Actix project postmortem by zzzcpan on Friday January 17, 2020 @08:22AM (#22074352)
> it's refusing to investigate use-after-free vulnerabilities

Please investigate yourself, don't ask others to do the work you consider important for you for free.

Re:Actix project postmortem by jeltz on Friday January 17, 2020 @08:28AM (#22074405)
People did investigate for him and write a patch for him and he dismissed the patch with it being "boring".
Re:Actix project postmortem by zzzcpan on Friday January 17, 2020 @08:34AM (#22074456)
Well, maybe people didn't provide detailed enough explanation for the author to understand and merge the patch, so he didn't bother.
Re:Actix project postmortem by jeltz on Friday January 17, 2020 @08:51AM (#22074574)
Re:Actix project postmortem by ryandrake on Friday January 17, 2020 @09:57AM (#22075073)
It seems like the better solution here would have been for the folks who wanted a fixed version of the software to create and maintain a "actix-done-right" fork themselves. This is what we all do in the professional world when a maintainer doesn't want to upstream critical patches for whatever reason.

They're under no obligation to upstream your patch, but it's open source so you're not powerless either! Why so much drama over a rejected PR?

Re:Actix project postmortem by XelNika on Friday January 17, 2020 @10:48AM (#22075629)
Creating a fork is generally not the optimal solution. Both current and future users benefit from a patch, only those that hear about it benefit from a fork.

Now, in a case like this where the maintainer won't accept patches, yes, fork and move on would have been better.

Re:Actix project postmortem by Sharlin on Friday January 17, 2020 @08:28AM (#22074396)
The reporter included a patch.