subtle or subtle-ng?

[brycx]

See issues regarding the dalek-cryptography organization:

• Clarification on possible crate-owner lockout dalek-cryptography/curve25519-dalek#345
• Update rand_core to 0.6 dalek-cryptography/curve25519-dalek#338 (comment)

I'm not sure I'm comfortable continuing to rely on the subtle crate. The above seem to be somewhat opposing statements of what has happened, though I still feel weird about the removal of crate owners, even if "warranted" by the maintainer of the org. IMHO, the thing should have happened with more transparency to begin with (like they should've made an announcement).

Currently, I'm leaning towards switching to subtle-ng.

[vlmutolo]

At the end of the day, all we know about the situation is that founder A claims the he removed maintainer B from his project due to Code of Conduct violations, maintainer B claims that he and other maintainers were removed for reasons that remain undisclosed, and we as outsiders don’t really have a way of verifying any of that.

The lack of transparency from the dalek founder is a little concerning. I would have preferred to know exactly which part of the Code of Conduct was violated.

It would also be helpful to hear from the other maintainers on the issue. They may be able to clear some things up.

But what it really comes down to is whether subtle-ng will be maintained as actively as subtle going forward. If so, they I personally would switch due to the lack of transparency from the owner of subtle. That would be enough for me to make the change.

But if subtle-ng won’t have the same resources behind it, then it may be hard to justify switching over. But maybe subtle doesn’t need that much maintenance.

[cathieyun]

I added some clarification here. Hope that helps.

[brycx]

It definitely helps @cathieyun! Thanks again for clarifying/confirming.

[brycx]

I wrote @hdevalence a bit back, about expected support for subtle-ng, but haven't gotten any answer yet. I agree with you @vlmutolo. Currently, subtle probably does not need that much maintenance. Seeing as the subtle is currently used more than subtle-ng, I think we can stick with it for now.

I'll keep the issue open in case there are other developments, like subtle not getting attention, etc. Let's keep a close eye on the dependency for a bit. Unless any sudden developments occur, we're keeping subtle for 0.16.