What would be the basis for confidence that those commercial libraries are written correctly since you can't audit the source code?
Re:A Sad Day for Rust
by notyourday on Friday January 17, 2020 @12:39PM
(#22076992)
They do. It is right there, in the LICENSE file.
It is a simple cost/benefit analysis. Your risk of presuming that Linux today is sufficiently good for what you need to do is lower than it was 10 years ago, which is why Linux today is more popular than 10 years ago and a lot more popular than it was 20 years ago.
Re:A Sad Day for Rust
by PhaseLockk on Friday January 17, 2020 @01:55PM
(#22077866)
Following this logic, if a popular rust crate doesn't prioritize security, it can potentially change people's risk assessment of the rust ecosystem as a whole. So this maintainer's actions could have negative effects on other rust projects with no relation to his. He may not have an obligation to do anything about it, but it's kind of "not cool".
Imagine if the linux maintainers took this attitude.
This attitude severely undermines the credibility of opensource.
If users of opensource libraries can't have confidence that those libraries are written correctly, we might as well all go back to commercial software.