• @SuperIce
    link
    English
    422 months ago

    That software license is incredible

    • TWeaK
      link
      fedilink
      English
      372 months ago

      The author has absolutely no fucking clue what the code in this project does. It might just fucking work or not, there is no third option.

      lmfao

    • Aatube
      link
      fedilink
      152 months ago

      I mean, pretty sure legally that that’d be very bad for whoever makes contributions-

      This is the exact reason why I’ve released this [license] with GLWT license and I have no intention to spend my time discussing or change the license. Try to figure out how you can use it on your project. Or don’t use it at all. I don’t care. Good luck.
      —Ahmed Shamim, 2021

      • @abhibeckert
        link
        6
        edit-2
        2 months ago

        The sentence “IN NO EVENT SHALL THE AUTHORS BE LIABLE” doesn’t fly where I live. You don’t get to choose wether or not you’re liable - the law decides who is liable. This thing is about as enforceable as those sovereign citizen license plates and would get the same reaction in a court room.

        Plenty of other commonly used licenses have the same issue unfortunately and and the biggest nightmare (at least in my country) is laws against “misleading” or “deceptive” conduct. Telling someone you’re not liable for anything is blatantly misleading/deceptive.

        Even if your software works perfectly, you are still breaking the law… a victimless crime that would normally fly under the radar or result in a “cut that shit out” order by the court… but it’ll really hurt your case if there is actually a victim (e.g. if your software has a bad security flaw that caused real damage).

        That’s why organisations with big legal teams tend to choose licenses like Apache 2.0. Ones with language like “unless required by applicable law (such as deliberate and grossly negligent acts)”.

          • Aatube
            link
            fedilink
            2
            edit-2
            2 months ago

            Most of them with any sort of cybersecurity law

        • Aatube
          link
          fedilink
          32 months ago

          At least nobody would actually want to infringe on the rights of this code.

          • Oliver Lowe
            link
            fedilink
            12 months ago

            @Aatube Oh I wouldn’t be so sure… we’ve all had those colleagues and vendors where we think they’d import something like this to make our lives miserable ;)

            @programming

  • @WalrusByte
    link
    English
    222 months ago

    Giving off a lot of mixed signals with this one, lol 😅

    • @[email protected]
      link
      fedilink
      43
      edit-2
      2 months ago

      It’s utilizing an obscure bug in the Rust compiler that unfortunately lets you circumvent the safety guarantees in order to produce undefined behavior - it’s mostly just a joke though, you will not run into the bug in normal code

    • TWeaK
      link
      fedilink
      English
      92 months ago

      My thoughts exactly!

      Now, with cve-rs, you can corrupt your program’s memory without corrupting your program’s memory.

  • KiranWells
    link
    fedilink
    142 months ago

    For anyone who is confused: This is exploiting an old soundness bug in the Rust compiler that is still present. The GitHub issue page has this comment from maintainers:

    we already had a crate published on crates.io before which used this bug to transmute in safe code, see #25860 (comment).

    this issue is a priority to fix for the types team and has been so for years now. there is a reason for why it is not yet fixed. fixing it relies on where-bounds on binders which are blocked on the next-generation trait solver. we are actively working on this and cannot fix the unsoundness before it’s done.