csande17

8 ms·

91.
by csande17 1y ago
Dubious "regular expression denial of service" vulnerabilities seem like a general issue with the CVE bureaucracy lately. Like, maybe CVE-2020-10735 had a point that Python's default "int" type having unbounded size
92.
by csande17 1y ago
OP seems to be a startup selling an eBPF script that tries to identify whether individual executables running as your user "should" or "should not" do particular things. (Like a Windows antivirus program, but for build s
93.
by csande17 1y ago
I don't think the SQLite authors actually edit the single giant source file directly. Their source control repository has the code split up into many separate files, which are combined into "the amalgamation" by a build scrip
94.
by csande17 1y ago
I agree that it's a tough situation. "The type system guarantees memory safety" is an extremely important pillar of Rust's identity. They kind of have to portray all soundness issues as "more compiler bugs than some
95.
by csande17 1y ago
Oh, I didn't realize steveklabnik wasn't an official member of the project anymore (as of 2022 apparently: https://blog.rust-lang.org/2022/01/31/changes-in-the-core-te... ). I do think he still expr
96.
by csande17 1y ago
> Is it getting brushed off as merely a compiler bug? Yes, this thread contains an example: https://news.ycombinator.com/item?id=45587209 . (I linked the same bug you did in the comment that that's a reply to.) Th
97.
by csande17 1y ago
You are correct that Rust's marketing does not claim that there are no bugs in its compiler. In fact it does the opposite: it suggests that there are no problems with the language , by asserting that any observed issue in the language
98.
by csande17 1y ago
In general, the way Rust blurs the line between "bugs in the compiler" and "problems with how the language is designed" seems pretty harmful and misleading. But it's also a core part of the marketing strategy, so...
99.
by csande17 1y ago
One question towards maturity: has any working version of the Rust compiler ever existed? By which I mean one that successfully upholds the memory-safety guarantees Rust is supposed to make, and does not have any "soundness holes"
100.
by csande17 1y ago
Basically, the HTMX code says: "when this span is clicked, fetch /rebuild/status-button, extract the #rebuild-bundle-status-button element from the returned HTML, and replace the existing #rebuild-bundle-status-button element
101.
by csande17 1y ago
The article links a statement from an NSA official that explicitly says the NSA has been asking vendors for this, which seems like fairly strong support to me.
102.
by csande17 1y ago
FWIW, https://blog.cr.yp.to/20240102-hybrid.html reads to me like a more direct attempt to engage with the counterarguments. I am curious what the costs are seen to be here. djb seems to make a decent argument that the code
103.
by csande17 1y ago
Yeah. Like, the argument here is that the reason government agencies push stuff into standards is because they do in fact want people to use it. "Well government purchasing is just Like That, surely no one will actually use this option
104.
by csande17 1y ago
And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it
105.
by csande17 1y ago
Realistically, the future for small/custom window managers on Wayland is probably to write them as plugins for GNOME or KWin or Hyprland or something. That's kind of the closest equivalent we have to the X world where you could li
106.
by csande17 1y ago
One of the reasons why Wayland is "simpler" than X is that it doesn't include the APIs that window managers like Xmonad need. Instead, window managers have to implement a lot of the complex low-level graphics details themselv
107.
by csande17 1y ago
> When the chef said, ‘Hey, Meta, start Live AI,’ it started every single Ray-Ban Meta’s Live AI in the building. Wait, isn't that even worse? The problems with the chef demo looked like run-of-the-mill AI hallucinations (and I&#x27
108.
by csande17 1y ago
They edited the article to clarify that they're only dropping support for 32-bit x86.
109.
by csande17 1y ago
The "Transitioning elements on DOM addition and removal" example in that article uses a setTimeout() to wait an extra 1000 milliseconds before removing the element from the DOM. If you immediately remove the element from the DOM (
110.
by csande17 1y ago
I'm pretty sure "Google-certified" is just the latest term for "has signed a contract to ship the proprietary Google parts of Android". (Google's blog post about this change links to a page which calls it &quot
111.
by csande17 1y ago
The Unicode Consortium has indeed published documents recommending that people adopt the UTF-16 worldview when working with strings, but it is not always a good idea to follow their recommendations.
112.
by csande17 1y ago
Although they're different encodings, the thing that they are encoding is exactly the same. I kinda wish I could edit "string representation" to "modeling valid strings" or something in my original comment for clari
113.
by csande17 1y ago
I could be mistaken, but I think Python cares about making sure strings don't include any surrogate code points that can't be represented in UTF-16 -- even if you're encoding/decoding the string using some other encoding
114.
by csande17 1y ago
IMO if you care about surrogate code points being invalid, you're in "designing the system around UTF-16" territory conceputally -- even if you then send the bytes over the wire as UTF-8, or some more exotic/compressed f
115.
by csande17 1y ago
Yeah, I feel like the only really defensible choices you can make for string representation in a low-level wire protocol in 2025 are: - "Unicode Scalars", aka "well-formed UTF-16", aka "the Python string type"
116.
by csande17 1y ago
Unicode really is an impossibly bottomless well of trivia and bad decisions. As another example, the article's RFC warns against allowing legacy ASCII control characters on the grounds that they can be confusing to display to humans, b
117.
by csande17 1y ago
Two distros, actually: https://omakub.org/
118.
by csande17 1y ago
There's a more standard, general rule in English grammar that web searches tell me is called "delayed right constituent coordination". It lets you read sentences like "He washed and dried the clothes" as "He wa
119.
by csande17 1y ago
That sounds like a "personal dative" to me: https://ygdp.yale.edu/phenomena/personal-datives
120.
by csande17 1y ago
One of the largest problems identified in the original "what color is your function" article ( https://journal.stuffwithstuff.com/2015/02/01/what-color-is-... ) is that, if you make a function async

More ›