• TWeaK@lemm.ee
      link
      fedilink
      English
      arrow-up
      38
      ·
      8 months ago

      The author has absolutely no fucking clue what the code in this project does. It might just fucking work or not, there is no third option.

      lmfao

    • Aatube@kbin.social
      link
      fedilink
      arrow-up
      16
      arrow-down
      1
      ·
      8 months ago

      I mean, pretty sure legally that that’d be very bad for whoever makes contributions-

      This is the exact reason why I’ve released this [license] with GLWT license and I have no intention to spend my time discussing or change the license. Try to figure out how you can use it on your project. Or don’t use it at all. I don’t care. Good luck.
      —Ahmed Shamim, 2021

      • abhibeckert@lemmy.world
        link
        fedilink
        arrow-up
        9
        arrow-down
        4
        ·
        edit-2
        8 months ago

        The sentence “IN NO EVENT SHALL THE AUTHORS BE LIABLE” doesn’t fly where I live. You don’t get to choose wether or not you’re liable - the law decides who is liable. This thing is about as enforceable as those sovereign citizen license plates and would get the same reaction in a court room.

        Plenty of other commonly used licenses have the same issue unfortunately and and the biggest nightmare (at least in my country) is laws against “misleading” or “deceptive” conduct. Telling someone you’re not liable for anything is blatantly misleading/deceptive.

        Even if your software works perfectly, you are still breaking the law… a victimless crime that would normally fly under the radar or result in a “cut that shit out” order by the court… but it’ll really hurt your case if there is actually a victim (e.g. if your software has a bad security flaw that caused real damage).

        That’s why organisations with big legal teams tend to choose licenses like Apache 2.0. Ones with language like “unless required by applicable law (such as deliberate and grossly negligent acts)”.

    • SorteKanin@feddit.dk
      link
      fedilink
      arrow-up
      45
      ·
      edit-2
      8 months ago

      It’s utilizing an obscure bug in the Rust compiler that unfortunately lets you circumvent the safety guarantees in order to produce undefined behavior - it’s mostly just a joke though, you will not run into the bug in normal code

    • TWeaK@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      8 months ago

      My thoughts exactly!

      Now, with cve-rs, you can corrupt your program’s memory without corrupting your program’s memory.

  • KiranWells@pawb.social
    link
    fedilink
    arrow-up
    14
    ·
    8 months ago

    For anyone who is confused: This is exploiting an old soundness bug in the Rust compiler that is still present. The GitHub issue page has this comment from maintainers:

    we already had a crate published on crates.io before which used this bug to transmute in safe code, see #25860 (comment).

    this issue is a priority to fix for the types team and has been so for years now. there is a reason for why it is not yet fixed. fixing it relies on where-bounds on binders which are blocked on the next-generation trait solver. we are actively working on this and cannot fix the unsoundness before it’s done.