June 24, 2026

Push to publish... if GitHub allows

GitHub shouldn't be a dependency for publishing Rust on crates.io

Rust fans erupt over GitHub holding the keys to package publishing

TLDR: Rust's package hub still relies on GitHub accounts for publishing, and that sparked backlash from users who say one outside company should not control access to open-source work. Others pushed back that a fix is finally in motion, turning the comments into a mix of panic, sarcasm, and weary realism.

A spicy little fight broke out after security-minded poster Taggart said the Rust package site, crates.io, still makes people use a GitHub account to sign in and publish software. In plain English: if you want to share code with the Rust world, another company is still standing at the door. And the crowd was not having it. The loudest reaction was pure outrage: open-source fans blasted the setup as a dangerous single choke point, with one commenter warning that no outside platform should be able to "gatekeep" who gets to publish. Another turned it into a full-on anti-big-platform rallying cry with "ANY SYSTEM that depends on others are just asking for trouble" and a dramatic #TakeTheInternetBack flourish.

Then came the sarcasm. "Especially not now, what if they're down? ;)" joked one commenter, twisting the knife with the kind of smirk only the internet can deliver. But not everyone came just to riot in the replies. A few cooler heads showed up with receipts, pointing to a long-running official issue and a newly merged proposal that could finally loosen GitHub's grip. Translation: yes, people agree it's a problem, but fixing it has been slow because volunteers have to do the work. Still, the drama hit peak comment-section chaos when one person basically shrugged, called this "one of the many Rust reasons," and declared they chose C instead. The real headline? The community agrees this dependency looks bad — but they're split between furious doom-posting, gallows humor, and exhausted "we're already working on it" realism.

Key Points

  • The article content is a Mastodon post by Taggart on infosec.exchange.
  • The post states that crates.io requires a GitHub account to log in.
  • The post says this GitHub login requirement also affects the ability to publish Rust packages.
  • Taggart characterizes GitHub as a "shadow dependency" of the Rust ecosystem.
  • The post argues that GitHub should not be a dependency for publishing on crates.io.

Hottest takes

"can cancel users at will" — Animats
"what if they're down? ;)" — sscaryterry
"one of the many Rust reasons why I chose to learn C" — righthand
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.