Provide opt-out cfg to use `serde_derive` source by pinkforest · Pull Request #2580 · serde-rs/serde
github.com
Closes #2538 Supercedes #2579 Follows my recommendation: #2579 (comment) Current choice: Opt-Out (current commit) Override via cfg(serde_derive_build = "source") to build from source Alterative: Op...
  • ck_@discuss.tchncs.de
    13·
    1 year ago

    My personal gut feeling: the maintainer will just shoot this attempt down and close the PR.

    Happy to be proven wrong here though.

    • Anders429@lemmy.world
      8·
      1 year ago

      dtolnay isn’t the only maintainer though. oli-obk is also a maintainer and is participating in the discussions on the PR.

      • ActuallyRuben@actuallyruben.nl
        6·
        1 year ago

        I don’t think oli-obk has any say in this as they stated the following:

        Because this crate is owned by dtolnay and he may do with it as he wishes. My personal opinions on the topic are irrelevant.

        Source

      • ck_@discuss.tchncs.de
        3·
        1 year ago

        Technically true, but he has two merge commits in last three years. Not sure that will still give him much of a pull.

    • miniu
      3·
      1 year ago

      Author of the PR made it opt-out. I think it may be enough of the compromise for the maintainer.

    • TehPers@beehaw.org
      1·
      1 year ago

      Has dtolnay shown a strong sentiment towards having it be on always? I can’t imagine there’s much reason not to make it configurable.

      • d_k_bo@feddit.de
        3·
        1 year ago

        The precompiled implementation is the only supported way to use the macros that are published in serde_derive. If there is implementation work needed in some build tools to accommodate it, someone should feel free to do that work

        ~ dtolnay (source)

        That sounds like he doesn’t like to (re-)introduce any other options.

        • TehPers@beehaw.org
          3·
          1 year ago

          That seems a bit concerning. At first I was under the impression the binary was compiled on the user’s machine, but once I saw that it’s distributed with serde I can see why people are upset.

          • d_k_bo@feddit.de
            3·
            1 year ago

            I was under the impression the binary was compiled on the user’s machine

            That’s how procedural macros used to and were intended to work.

        • ButtonsEnglish
          3·
          1 year ago

          The precompiled implementation is the only supported way to use the macros that are published in serde_derive

          That statement is straight up gaslighting.

          The precompiled binary is only provided for one platform, Linux. Windows does not use a precompiled binary but compiles its own from the source. How can he claim it’s the “only supported way”, when for most platforms he is doing it another way? Also, the crate, throughout most of its life, has been doing it another way.

  • argv_minus_one@beehaw.orgEnglish
    8·
    1 year ago

    So, the general unsuspecting public will still be executing this potentially-malicious binary, and only those in the know will be able to avoid it?