June 24, 2026
Push to publish... if GitHub allows
GitHub shouldn't be a dependency for publishing Rust on crates.io
Rust fans erupt over GitHub holding the keys to package publishing
TLDR: Rust's package hub still relies on GitHub accounts for publishing, and that sparked backlash from users who say one outside company should not control access to open-source work. Others pushed back that a fix is finally in motion, turning the comments into a mix of panic, sarcasm, and weary realism.
A spicy little fight broke out after security-minded poster Taggart said the Rust package site, crates.io, still makes people use a GitHub account to sign in and publish software. In plain English: if you want to share code with the Rust world, another company is still standing at the door. And the crowd was not having it. The loudest reaction was pure outrage: open-source fans blasted the setup as a dangerous single choke point, with one commenter warning that no outside platform should be able to "gatekeep" who gets to publish. Another turned it into a full-on anti-big-platform rallying cry with "ANY SYSTEM that depends on others are just asking for trouble" and a dramatic #TakeTheInternetBack flourish.
Then came the sarcasm. "Especially not now, what if they're down? ;)" joked one commenter, twisting the knife with the kind of smirk only the internet can deliver. But not everyone came just to riot in the replies. A few cooler heads showed up with receipts, pointing to a long-running official issue and a newly merged proposal that could finally loosen GitHub's grip. Translation: yes, people agree it's a problem, but fixing it has been slow because volunteers have to do the work. Still, the drama hit peak comment-section chaos when one person basically shrugged, called this "one of the many Rust reasons," and declared they chose C instead. The real headline? The community agrees this dependency looks bad — but they're split between furious doom-posting, gallows humor, and exhausted "we're already working on it" realism.
Key Points
- •The article content is a Mastodon post by Taggart on infosec.exchange.
- •The post states that crates.io requires a GitHub account to log in.
- •The post says this GitHub login requirement also affects the ability to publish Rust packages.
- •Taggart characterizes GitHub as a "shadow dependency" of the Rust ecosystem.
- •The post argues that GitHub should not be a dependency for publishing on crates.io.