See also: <a href="https://internals.rust-lang.org/t/pre-rfc-sandboxed-deterministic-reproducible-efficient-wasm-compilation-of-proc-macros/19359" rel="nofollow noreferrer">https://internals.rust-lang.org/t/pre-rfc-sandboxed-determin...</a><p>Authors comment:<p>>"Someone else is always auditing the code and will save me from anything bad in a macro before it would ever run on my machines." (At one point serde_derive ran an untrusted binary for over 4 weeks across 12 releases before almost anyone became aware. This was plain-as-day code in the crate root; I am confident that professionally obfuscated malicious code would be undetected for years.)<p>He got some hate for that in the replies but I think it is a great point. Pardon my snark, but every "security expert" that voiced their opinion over the last couple of days, yet failed to recognize the situation for almost a month, should reassess their reaction once the anger subsides.<p>The current macro situation is dangerous (and wasteful), hopefully some real progress can be made.
I feel for him/her. When you provide a usefull service in OSS, this is the result of the slightest transgression, real or imagined.<p>I also think this displays 'emperors clothes' behaviour. In a perfect world, many eyeballs make all bugs shallow, and long term, it actually mostly works. But short term, we collectively severely fall short of our ideals. I think part of the harshness an OSS contributor receives in this kind of situation comes from everyone realizing we've been caught with our pants down.<p>It's human to shoot the messenger, but let's not forget this only happens because someone worked hard enough to make the whole world trust him or her.
Thanks to dtolnay for boldly doing what it took to make some real progress on the problem of proc macro compile times. It's unfortunate that we reacted the way we did, driving him to abort the experiment. I'm sorry I contributed to the pile-on with my first comment on the infamous GitHub issue, the one I directed specifically at him. I'll be slower to react next time.
This provides some additional context for why the pre-built binary was added:<p><a href="https://github.com/serde-rs/serde/issues/2584#issue-1858075241">https://github.com/serde-rs/serde/issues/2584#issue-18580752...</a><p>Due to the way that the derive feature was causing the dependency chain in Cargo to be longer than necessary, thereby making it impossible for cargo to compile multiple crates in parallel.
> eventually we'd like to use a first-class precompiled macro if such a thing becomes supported by cargo / crates.io<p>Distributing binaries is what distributions are for. It does not matter if it is for macros or for the rest of a crate.<p>Anyone can write and publish a cargo plugin that provides binaries via a separate channel.<p><a href="https://crates.io/crates/cargo-prebuilt" rel="nofollow noreferrer">https://crates.io/crates/cargo-prebuilt</a> has been around for a while. (I've not used it, just looked for it now)
See <a href="https://news.ycombinator.com/item?id=37183361">https://news.ycombinator.com/item?id=37183361</a>, <a href="https://news.ycombinator.com/item?id=37189462">https://news.ycombinator.com/item?id=37189462</a> for context.
See also the PR: <a href="https://github.com/serde-rs/serde/pull/2590/files">https://github.com/serde-rs/serde/pull/2590/files</a>
I’ve seen a lot of complaints about this. I would love some insights into the author’s intentions, though. Why did they choose binary distribution? They must have had a reason.
I think also one of the issues was that it wasn't opt-in, it wasn't deterministic from day one (I truly believe it should have), and it broke building when using git references as the detection was just triple based.
Nice to see the maintainer stop being so stubborn.<p>I wish I could say this left a good taste in my mouth as a strong proponent of Rust.<p>Especially after dtolnay banned me on the repo after I commented on the PR. Can't even give thumbs up on someone else's comment let alone open an issue or a PR.<p>Interesting to see how glorified janitorial roles make people think they have some real power.<p>Just take a look at <a href="https://github.com/andreisilviudragnea/serde-blocked/discussions/1">https://github.com/andreisilviudragnea/serde-blocked/discuss...</a><p>David went on a full on power trip rampage, going as far as banning people who participated with emojis on that PR from the serde org on GitHub.