Hacker News Reader

Comment by tayo42 | Hacker News Reader

Isn't that author kind of prolific within the rust library world? He didn't do that to any other libraries. Is there something with more info?

View on HN

He does this all the time to libraries. These things are correlated; the more tools you make, the less time you have to maintain any single one of them. You learn to ignore it because they're also extremely well made libraries where the unmaintained status doesn't mean anything.

I found an explanation. Reading between the lines I think he found something less abysmal than YAML.

https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34

> As of this release, I am not planning to publish further versions of serde_yaml as none of my projects have been using YAML for a long time, so I have archived the GitHub repo and marked the crate deprecated in the version number.

Hm... might still have been better to first ask around if anyone is willing to maintain it instead of marking it as deprecated?

From what I can tell this is a second order effect. No advisory was made against serde-yaml, it was made against rust-yaml. The maintainer of serde-yaml I believe just took the opportunity to mark it as deprecated to ensure people don't migrate there.

I'd think of it as a smart move considering how entitled, aggressive and demanding open source software users have become over maintainers.

Yeah, I'm really disappointed reading the comments here. This is his project, he can do whatever he wants with it, including delete and forget about it. The author doesn't owe you anything. Just use a fork or another implementation. This isn't the end of the world.

> The author doesn't owe you anything.

I don't think anyone is claiming he is legally required to do it. Just that it would be nice. But in this case I think he did try to look for someone anyway.

Not the author, but I assume he is not against you taking over. Code is still there if you are willing. (It is not too late)

I'm not a particularly big fan of YAML either I'm afraid, so I would probably choose some other way-to-learn-rust...

He'd been looking for a serde-yaml maintainer for a while, and none ever popped up.

Yes.

The release notes for the last release explain: https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34

That is incredibly obnoxious and irresponsible and he should turn over the repo to someone else to manage.

I’m not sure how much open source work you’ve done or what packages you’ve maintained, but in my experience, the “someone else” rarely ever comes. Heck I have even been the someone else and then done a bad job of it!

This is an unrealistic and frankly a bit entitled of a criticism.

This is before we even get to stuff like “it’s not like yaml is a fast moving target, what continued maintenance is really even needed” parts of the equation, or the comment above that said he’s tried already.

The “someone else” also needs to be vetted to ensure that their first update won’t include crypto mining malware.

We should remember that an unmaintained dependency isn’t the worst thing that can happen to a supply chain. There are far worse nightmare scenarios that involve exfiltrated keys, ransomewared files and such.

I’ll bet that if someone with a track record of contributing to the Rust community steps up, he’ll happily transfer control of the crate. But he’s not just going to assign it to some random internet user and put the whole ecosystem at risk.

What's so irresponsible about it? He clearly communicated the state of affairs.

I think he was generous enough with his time for creating the library in the first place and posting this update. It's not like he's owing anything to anybody. I don't understand how you can demand him to do further UNPAID work to recruit maintainers who would also do further unpaid work.

> he should turn over the repo to someone else to manage

Why can't this "someone else" just fork the repo themselves?

Anyone else is free to take it! You see that the repository is hosted under his own user. Anyone else can create an organization or host it under their own name.

Are we collectively having Subversion phantom pains or something? Just take it.

The obnoxious and irresponsible part is the hubris of thinking you can have a package repository system that's going to not have problems like this and left-pad.

You can't. Ever. This is unironically why languages too old for package repositories like C and C++ lend themselves to stabler, higher-quality software.

On top of that is also the entitlement to feel like people providing you software for free MUST ALSO be responsible for polishing it forever. But, hey, I guess that attitude comes naturally with the package repository mindset. ;D People need to do all my work for me!

> C and C++

> stabler, higher-quality software.

Lol I’ll have some too buddy

With the greatest respect, I think it is your attitude that needs adjustment, not their behaviour.

I believe he offered for someone to take over and no one ever stepped up to the plate. This happens a lot.

No, it's incredibly irresponsible to hand over the repo to someone else to manage, even someone who is an active contributor. See https://boehs.org/node/everything-i-know-about-the-xz-backdo... for example.

AFAIK he'd been looking for a maintainer for this for a while, didn't find one, and so just marked it unmaintained. He's not doing it, nobody else wanted to, so it'd be irresponsible to leave it listed as maintained.

Reply on news.ycombinator.com