TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Maintainer of Rust crate 'dirs-sys' intentionally poisons dependents with MPL

3 pointsby rustman123over 1 year ago

2 comments

rustman123over 1 year ago
They intentionally added a copyleft-licensed library (options-ext) written by himself to poison the supply chain via `dirs-sys`. (Commit: <a href="https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;commit&#x2F;e169da7af901eb621e5d244efe960f4da8ed150d#r109131407">https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;commit&#x2F;e169da7af901e...</a>)<p>The dependency adds nothing of value and can trivially be removed. (<a href="https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;pull&#x2F;22&#x2F;files">https:&#x2F;&#x2F;github.com&#x2F;dirs-dev&#x2F;dirs-sys-rs&#x2F;pull&#x2F;22&#x2F;files</a>)<p>When asked about it, they claim to prefer MPL and that the current license was an accident they &#x27;may or may not correct&#x27;.<p>Popular dependents include - cross (<a href="https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;cross" rel="nofollow">https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;cross</a>) - terminfo (<a href="https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;terminfo" rel="nofollow">https:&#x2F;&#x2F;crates.io&#x2F;crates&#x2F;terminfo</a>)
cpburns2009over 1 year ago
MPL 2.0 is not a &quot;viral&quot; license like the GPL. It is cross compatible with both Apache 2.0 and MIT. The knee jerk reaction to drop dirs-sys-rs over a non-existent licensing issue makes no sense.