April 5th, 2021


Interesting times in open source

So the idea of open source is that you write some code you need/want. You then release the code so that other people can use it as well. They add features, fix bugs and extend it to work on other systems. They benefit from the original code you wrote, you benefit from the new features and fixed bugs. And if you need to use it on Arm, or a Mac or whatever in later years, then someone's probably already done the porting work for you. Win-win.

There's a relatively new language out there called Rust. It's about as fast and powerful as C++, but has a bunch of clever features that make various nasty bugs build-time errors. It's an awesome language with only a few drawbacks
1) it's fairly hard to learn
2) build times are a little slow
3) it's not supported on as many platforms as more mature languages
4) it's new enough that there aren't many jobs out there asking for it

But the benefits are large enough that it's becoming increasingly popular. And some open-source projects are starting to use it. One of which is a python cryptography library. They've decided to write some new features in Rust, first being some ASN.1 parsing code. ASN.1 is what happened if JSON/.XML was written by two guys who spent their time arguing over whether saving every possible bit of storage was more important than saving every possible CPU cycle, while standing on the dismembered remains of anyone who suggested keeping things simple. ASN.1 parsing is an ideal job for Rust: it should be quick and efficient to run, while ensuring that malformed input sequences can't cause buffer overruns.

Unforttunately the users of the library are being bitten by drawback 3). It turns out that there are quite a few platforms out there that can happily run python, but not code written in Rust. This is causing some upset.
 - The writers of the cryptography library are of the opinion that 99% of their users (including themselves) will benefit from fast, secure ASN.1 parsing, and don't see why those users should miss out on that, due to the remaining 1%
 - The writers of Rust say that they'd love to support more platforms, but they don't have enough developers or, in some cases, access to the actual hardware
 - The current users of the library on about-to-be-unsupported platforms argue that the existing library works fine for them, and if authors want Rust-based libraries, why can't they write a new library rather than screwing over users of the existing library.

It turns out that the majority of complaints from from users on
 - the Amiga
 - an obsolete IBM mainframe system

Which rather reduces my sympathy for the final group. If you can afford to buy and run an IBM mainframe (even an obsolete one), you can afford to pay someone to write some damn code for you, and you certainly can't expect the Rust developers to track down and buy a mainframe to develop on. And as for Amiga users: I have a very soft spot for my beloved A500, but I owned that in the *80s* It's time has passed. Suck it up and join the 21st century.

More info here: https://lwn.net/Articles/845535/