RE: https://mastodon.social/@andrewnez/116845067016479290
Yep, this sounds like a good prediction of the effects of the CRA on open source: "A haulage firm told it is answerable for the state of every bridge on its route will plan routes with fewer bridges on them before it considers starting a bridge-repair division."
Oh GitHub is getting orders of magnitude more code published to it?
🪿 WHO MADE IT EASIER FOR ROBOTS TO WRITE AND PUBLISH CODE?? WHO???
RE: https://mastodon.social/@bagder/116420048815872070
time to @andrewnez reference: 19 minutes
An active phishing campaign against crates.io users started emailing people from crates.ws about an hour ago. Don't click the links; tell your friends. #RustLang
- actually separating spec/tests from code completely could be neat? write a test for the problem you're having and run the test against all forks to see if any have the fix for it?
- then would you want a family of tests too? perhaps!
- maybe form clusters of forks in a family that have the same goals?
- no version numbers, only commits (yes i know also Hard™️), but trying to get away from "official" "releases" and focus more on "this code at this point solves my goals"
RE: https://mastodon.social/@andrewnez/116063094466804721
off-the-cuff pipe dream ideas for a different world:
- people don't start projects, they start families
- there is no upstream or main repository
- a project family page shows forks by recent activity
- diffing between forks is easy (maaaaaybe some sort of automated summary here)
- cherry-picking different commits from different forks into what you want to use is easy (yes i know this is Hard™️. machine-assisted merging? fork-independent test suite?)
you wouldn't shut off TIME
official blog post: https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/
There's an active phishing campaign happening against crates.io. rustfoundation.dev is not the foundation's or the project's domain. We're looking at our options for takedowns.
Open source does not, and should not, move at the speed of capitalism.
This thought brought to you by Rest is Resistance by Tricia Hersey.
I love what @leahawasser is doing with the pyOpenSci open peer review of packages https://www.pyopensci.org/about-peer-review/ that results in a list of recommended packages https://www.pyopensci.org/python-packages.html
This seems like a way more effective and accessible solution to the "what libraries are appropriate to use" problem than, say, cargo-crev.
I AM HERE! 🐍🦀 a crab amongst the snakes #PyConUS
I hope Pittsburgh finds you and doesn't let you go.
oh no, someone at dnsimple did a whoopsiedoo in production
I wrote a guest post on the Rust Foundation blog on my experience attending the #CISA Open Source Software Security Summit:
https://foundation.rust-lang.org/news/attending-cisas-open-source-software-security-summit/
what would it look like if forking an oss project wasn't seen as hostile, but was an acceptable way of making a family of projects that choose different tradeoffs?
the lesson *I'm* choosing to take from xz, as an oss maintainer, is that anyone trying to pressure or guilt me into doing something should immediately be told no, for security reasons
And ALSO interesting is that this paper is advocating that contracts between software companies could make more use of existing technology certifications to establish liability...
... existing certifications like FedRAMP...
... FedRAMP that requires using the NVD... and... 😳 *maybe* that's not the best example of something to encourage more use of, right this second 😬
So I'm reading this Lawfare paper on cybersecurity certifications and relations to regulations, liability, and contracts https://www.lawfaremedia.org/article/will-a-cybersecurity-safe-harbor-raise-all-boats
Mostly it's SUPER interesting to look at infosec problems from a completely different vantage point than my own
follow-up fight: