azakai

27 ms·

301.
by azakai 4y ago
The key mechanism for memory safety, generational references, is described here: https://verdagon.dev/blog/generational-references IIUC it's basically a form of memory tagging in userspace, but designed to be safe
302.
by azakai 4y ago
You're right that credit cards are far from guarantees. Still, I'd imagine Cloudflare do something like cluster users by risk level at some granularity. Brand-new paying accounts might be put together in the same process, while pa
303.
by azakai 4y ago
Browser requirements may differ from Cloudflare's, though. In particular, browsers run arbitrary code from anywhere - just clicking a link downloads and runs code off of anywhere on the planet, theoretically - while Cloudflare runs cod
304.
by azakai 4y ago
To be fair to Clouldflare, they do a lot of very thoughtful work on sandboxing at all levels, including at the process level as well as above and below that. A lot of interesting details here: https://blog.cloudflare.com/mit
305.
by azakai 4y ago
I can tell you as a former Firefox developer that that was not the case. Yes, Firefox has some dependencies copied into the tree, but deciding to do it, and the process afterwards (including updating), were very careful and slow. Of course
306.
by azakai 4y ago
That is not the case. In fact, Firefox itself did not do this until recent years. It is true that modern JS development often works that way (as does Rust and some others), but it is not the norm in all ecosystems, and definitely wasn'
307.
by azakai 4y ago
Correct. And, in general, I don't think this worsens it to the level of a CPU without PAC. It still takes effort to do this, since like SPECTRE, you need the ability to measure time, and you need to spend a significant amount of CPU po
308.
by azakai 4y ago
(See below for two answers about the math that gets to 5%.) > We want a margin of error of 1 percentage point (kinda reasonable, since their estimate is stated as a percentage without explicitly stating the margin of error) If the questi
309.
by azakai 4y ago
The worse case is 5% because "is a bot" is a boolean variable. That has a standard deviation of 0.5 in the very worst case (50% on value 0, 50% on value 1, so the mean is 0.5, and the deviation can't be more than 0.5). And th
310.
by azakai 4y ago
A sample size of 100 is fairly reasonable, isn't it? The worst-case standard deviation is 5%, and 100 is a small enough number that you can take the time to carefully inspect each account (by humans) to actually determine if it's
311.
by azakai 4y ago
Yes, historically Emscripten began before asm.js, targeting pure JS. That JS backend was replaced by an asm.js backend, which was later replaced by the current wasm backend (the wasm backend in upstream LLVM). (But as already mentioned, JS
312.
by azakai 4y ago
Emscripten can target both WebAssembly and JavaScript. The JavaScript option uses wasm2js - it compiles first to wasm, then compiles that to JS. https://github.com/WebAssembly/binaryen#wasm2js The emcc flag -sWASM=0
313.
by azakai 5y ago
Yes, async code in wasm is definitely possible. See for example here: https://web.dev/asyncify/ It does have some overhead atm, which a new spec (stack switching) will remove eventually.
314.
by azakai 5y ago
You may want to file a bug on Go - I believe goroutines should work, including swapping between them. The code is emitted in a form that allows that (switch-in-a-loop pattern). Another thing you can try is TinyGo, whch uses Asyncify (a gene
315.
by azakai 5y ago
I was curious how claims like this line up with the incredibly stark difference between, say, the US and New Zealand: https://91-divoc.com/pages/covid-visualization/?chart=countr... The PDF here actually mentions
316.
by azakai 5y ago
For current status ("phase 3" as that link says is maybe not obvious enough), there is a solid spec and multiple implementations, see the "Fixed-width SIMD" line here: https://webassembly.org/roadmap&#x2F
317.
by azakai 5y ago
See "Why not just use LLVM bitcode as a binary format?" on the Wasm website FAQ: https://webassembly.org/docs/faq/
318.
by azakai 5y ago
At a glance, the bindings for wasm copy the data, https://github.com/zandaqo/iswasmfast/blob/54bbb7b539c127185... If the running code is short enough then that copy might easily make the wasm version much slo
319.
by azakai 5y ago
It takes a long time to train doctors and nurses and other relevant staff. Worse, the hard working conditions those people have been enduring since 2020 has led to a lot of burnout and attrition.
320.
by azakai 5y ago
To add to that, I would say that simple forms of "porting" can be done without really understanding the overall architecture. You just need to understand each line (or a few lines around it) at a time. I understood the post to mea
321.
by azakai 5y ago
Safari does support wasm threads now! It's pretty recent: https://twitter.com/RReverser/status/1471623675623481356 Yes, wasm threading support on the web uses workers + SAB. There are some limitations (the us
322.
by azakai 5y ago
You're probably right. We'd need a new type of vaccine that is more effective for that to be realistic. There is still hope for that though.
323.
by azakai 5y ago
That would let us eradicate it entirely. It's worth trying. But we can still get mostly back to normal without that. If we get enough immunity that the worst COVID causes is a small bump in hospitalization and deaths once or twice a ye
324.
by azakai 5y ago
COVID is far less dangerous than in 2020, but it is still a problem - it's not just a "media thing". COVID is still powerful enough to fill our hospitals past their ability to cope, and also we have enough uncertainty about l
325.
by azakai 5y ago
Another option is something like Type-After-Type (make allocations use type-specific regions, so use-after-free is still fully type safe at least): https://download.vusec.net/papers/tat_acsac18.pdf
326.
by azakai 5y ago
If the code can't be deleted then an alternative to rewriting is to sandbox it like Firefox recently started to do with wasm. That would have kept any exploit in the sandbox - let them have fun in there with that 70,000 step program wh
327.
by azakai 5y ago
Fair point that as a society there may be more urgent things to focus on. However, counterpoints: 1. The carbon footprint of flying is expected to triple by 2050. It will still not be the worst sector, but it is getting worse quickly, and i
328.
by azakai 5y ago
One nice area of work there is memcpy optimizations: https://twitter.com/chandlerc1024/status/1464530620416073735 (link to paper as well as code in that tweet).
329.
by azakai 5y ago
Nice, yeah, just crashing is even simpler, and sounds good enough...
330.
by azakai 5y ago
Sorry, I should have been clearer. The new benchmark data does not look like it is influenced by the language in a noticeable way (since we see 5x or 10x differences in the mean even when using the same language, and which provider is fas

More ›