Hacker News Reader

Comment by steveklabnik | Hacker News Reader

So, one area in which Rust is okay with "breaking" source compatibility is if some inference gets confused, and you need to add a type annotation.

This issue was discovered before the release, and a new version of time was released to fix it.

  cargo update -p time

and you're done.

This doesn't happen very often. It bit one of my projects too, and it took me longer to realize that it was a new version release that caused the problem than it did to fix the problem. It's been so long since something like this happened to me I cannot remember when it happened last.

Here's the upstream issue, if you're curious https://github.com/time-rs/time/issues/693

View on HN

I work in a large code base with 1800+ crate dependencies (don't ask) with half of them being unstable crates not really published to crates.io. And yeah, we run into this issue a lot. The recent one was caused[0] by human error.

It's usually human error but there's also a lot of cases due to Cargo's choice to go to pick the highest version that satisfies the constraints. It's a reasonable choice on Cargo's part but yes, our team has learned to be very conservative to diffs on `Cargo.lock` and most of our dependencies are pinned.

[0]: https://github.com/denoland/deno_core/issues/797

I was wondering why and it looks like a new trait implementation in std made a type placeholder ambiguous in older versions of time?

  time was caught in a crater run when a new trait implementation was added to the standard library. While it is a breaking change, it is considered acceptable breakage because the alternative is never adding any trait implementations or methods.

https://github.com/time-rs/time/issues/681#issuecomment-2143...

I wish rustc had a way to 'pin' the output of type inference, in the same way that Cargo.lock pins the versions of dependencies. That way, old code would continue to compile based on what the types were originally inferred as, even if the code retroactively became ambiguous.

This wouldn't be a perfect solution. Due to conditional compilation, any given variable in the source code might not exist on certain platforms, or it might even have a different type depending on the platform or configuration. So the question of "what type does this variable have" doesn't always have a single answer to record in a lockfile. And macros make things even harder.

But even as an imperfect solution, I think it still has the potential to avert most real-world cases of breakage caused by Rust upgrades (and even dependency upgrades). As a bonus, the same mechanism could potentially also be used to detect breaking API changes.

I wish rustc had a way to 'pin' the output of type inference

Would that not be "take the outcome of said type inference, write it into the LHS as a type declaration or into the RHS as a generic parameter", aka make the inferred type permanently declared? We're not totally powerless for addressing the practical implication here, and I don't know how we could have stable yet still implicit type inference across compiler versions unless that type inference logic never changed ever again.

I think the closest to what you're asking for is to build with a contemporary rustc version (have a rust-toolchain.toml in your repo). This isn't a satisfactory answer, but it is an available option nonetheless.

sounds like they should have added a warning

This is still a pretty astounding breakage possibility let alone that it actually broke.

Such inference seems inherently brittle and inevitably will break.

This sort of thing certainly does Rust no favours with regards to adoption.

Typically this is solved by recording a "minimum" version supported by the dependency (e.g. in the dependency) and then accommodating by behaving differently. For example, by gating the change as an opt-in to a newer version. Instead everyone is forced to trip over this. What a disaster.

> Such inference seems inherently brittle and inevitably will break.

This is just one data point, but again, in 80 releases, I can't remember the last one that did this to me. Obviously that's not a universal experience, as one of your siblings seems to run into it more than me.

> Typically this is solved by recording a "minimum" version supported by the dependency

The issue is the opposite. The dependency needs to be updated to fix the issue, not held back.

> What a disaster.

From "wait why did my CI pass yesterday but fail today" to pushing a commit with the fix, it was like ten minutes. Five of that was realizing that the breakage was because of a new Rust release. This happens so rarely to me that I didn't even think of it at first.

Alternatively, don't update to the latest Rust. If the Rust version was pinned, this bug wouldn't manifest either.

The fact that you can just `cargo update` is besides the point. The standard library should never make a breaking change that breaks running code. Why is this the exception? If the problem is that it wouldn't be possible to add new traits, then solve that by gating access to new traits on a minimum version.

It seems like the change should have been made as part of a new edition. This PR seems relevant: https://github.com/rust-lang/std-dev-guide/pull/66

edit: I can't help but feel like we're moving the goal posts here. "Just don't update Rust" was the sort of response you'd encounter with nightly when nightly was basically required to do anything serious, but this is stable. There is even an accommodation for such changes! Why wasn't it used?

This all just reeks of laziness and disregard for users.

> The standard library should never make a breaking change that breaks running code. Why is this the exception?

It is an exception because it is a very minor breakage that is trivial to fix. Sometimes this is worth it. Sometimes it is not. I guess they made the call that it was worth it. As a user who was affected, I don't mind that this happened.

> If the problem is that it wouldn't be possible to add new traits, then solve that by gating access to new traits on a minimum version.

The issue here is rustc being updated. If the new trait was only available on the new version, the same thing would have happened. I'm not sure this suggestion would fix things.

> This all just reeks of laziness and disregard for users.

I have many criticisms of the Rust project these days, but I truly believe you are blowing this far out of proportion.

I hate to drag Go into this but I can't help but compare what happened here to the attitude here: https://github.com/golang/go/discussions/55092

My initial impression was that this is boiling the ocean but there's substantial foresight.

If I'm blowing this out of proportion then the bar is already too close to the ground for my liking. This is solvable.

I don't remember the last time a tool chain update broke my build. It's one thing if it's a bug fix. But for practically everyone to have to update?

If 100,000 developers have to trip over this, say, then with your 10 minute estimate that equates to a million minutes, nearly 8 years at 40-hour weeks.

This appears to be a problem totally worth solving.

> It is an exception because it is a very minor breakage that is trivial to fix.

Or so it seems. But who cares about quality ? /s

> This PR seems relevant...

It's not. The change doesn't have anything to do with the prelude.

It was a new conversion was added, where existing code made an assumption that there was only one possible conversion that satisfied an inferred type. (In fact when that code was written it was superfluous as the conversion was actually converting from one type to the same type). That code was removed in https://github.com/time-rs/time/pull/671

The only code that is strongly broken by this is code that doesn't update its dependencies more regularly than its compiler... locking your deps but refusing to do so with your toolchain is just plain weird IMHO.

Whenever I see this message in a repo:

> An owner of this repository has limited the ability to comment to users that have contributed to this repository in the past.

I immediately know it should never be used. time-rs is such a repo. They don't want you or need you there, and they don't care about your bug reports or even your questions.

This shows a stark lack of empathy for maintainers. Per a maintainer’s Mastodon profile, the comment lock is temporary and specifically in response to driveby commenters dogpiling a bug report where the issue in question has a working fix that was already released months ago. Said abusive comment traffic probably often originated from blog posts and comment threads similar to this one.

That hardly justifies the block. Users deserve empathy too, considering they have to bear the consequences if things go wrong. One now doesn't even know and cannot even estimate the number of other issues that must have gone unreported. It's not safe or wise to use a package that is so shrouded in mystery. It is in fact foolhardy.

If maintainers don't want to address issues, they only have to ignore them. At least other users can then still discuss the issues in-between themselves. A lack of empathy for maintainers does not come into the picture.

No one should have to go to Mastodon or wherever to find out about the author's stance. The readme of the repo is where the stance belongs. The readme is currently grossly misleading, asking users to use Discussions, but this is not possible.

Overall it seems like a hazardous project to use.

No maintainer is obligated to maintain access to a discussion space for their users.

> One now doesn't even know and cannot even estimate the number of other issues that must have gone unreported. It's not safe or wise to use a package that is so shrouded in mystery. It is in fact foolhardy.

Issues don't get reported for any number of reasons. All open source is use at your own risk.

Do not try to equalize the risk of using an open software where issues are allowed versus one where issues are not allowed. The risks are not the same. In blocking users from commenting, it is obvious that the authors of this software are trying to cover up for gross negligence and bugs.

Do you simultaneously believe "it is a maintainer's prerogative to ignore any public feedback they receive":

If maintainers don't want to address issues, they only have to ignore them.

and that disallowing comments on a temporary basis, starting in the last few days, is gross negligence?

And do you also believe that the offensive part of this scenario is that their users, who may or may not be compensating them but statistically are not, temporarily don't have a public venue in which to chastise them for a problem that was already responsibly solved in a previously released update?

Do not try to equalize a maintainer guarding their time and energy from having to deal with an issue that has already been fixed and users that refuse to search or read with trying to cover up for gross negligence and bugs.

There are better ways of dealing with it. For example, a particular issue can both be locked and pinned. The readme too can be updated to reflect the concerns. There is never a need to disable all user interaction. It is foul-play and it stinks of other major bugs that the authors don't want users to become aware of.

This is an open source tool meaning that maintainers can communicate however they like. If you don’t like it, you can fork it and do things your own way. But there is absolutely nothing wrong with temporarily disabling comments. If anything, that’s a sign of self care and this wisdom.

A little more empathy wouldn’t hurt you.

I have plenty of empathy; it is just not biased the way you want it to be. As it stands, the software has a misleading and lying readme, asking to use Discussions when this is not even possible. A little broader perspective won't hurt you.

When it comes to open source maintainers, my perspective is really simple.

They are volunteers who spend their free time so that I can build cool things for zero dollars. My demands are proportional to the terms ‘volunteers’, ‘free time’ and ‘zero dollars’.

But if you’re this passionate about communications in open source projects, I know you could find hundreds of projects that need help with documentation and overall communications. Use the passion and good things will come.

So you think they can push whatever nonsense and liabilities they want upon users? No, they cannot. By offering a software, as advertised in its readme, they're in effect making a particular promise. They do not get an automatic right to violate this promise. If they cannot maintain the software, especially when it comes to major bugs, the repo should be set to Archived. In the case of this repo, since user interaction is disabled, it is even impossible to know which other major bugs may exist as would've otherwise been reported by users. Being a volunteer is no excuse to be horrible.

Reply on news.ycombinator.com