kpcyrd

6 ms·

31.
by kpcyrd 7mo ago
I just want to be able to call Default::default() from within const {}
32.
by kpcyrd 8mo ago
The time you lose at the syscall boundary you may be able to win back during much shorter GC pauses.
33.
by kpcyrd 8mo ago
Security, sha1 was deprecated in 2011 by NIST due to security concerns, and browsers reject sha1 certificates as invalid since 2017. Yet programmers in 2026 for some reason are still using it when signing their git tags and commits. Unless
34.
by kpcyrd 8mo ago
What about using the filesystem as an optimized dict implementation?
35.
by kpcyrd 8mo ago
The ch32v003 implements RISC-V without the M extension, meaning there's not even a MUL/DIV instruction. Out of all micro controllers I've worked with, only a single one had AES cpu instructions.
36.
by kpcyrd 8mo ago
I moved one of my projects from Github to codeberg because Github can't deal with sha256 repositories, but codeberg can.
37.
by kpcyrd 8mo ago
Nice, are you using something like this? iptables -I OUTPUT -p tcp --sport 22 --tcp-flags RST RST -j DROP iptables -I OUTPUT -p tcp --sport 22 --tcp-flags FIN FIN -j DROP Unfortunately this is still trivial to work around with
38.
by kpcyrd 9mo ago
Very cool! I'm wondering if Signal is doing something similar? libsignal is implemented in Rust, but I don't know about the other parts.
39.
by kpcyrd 9mo ago
The API seems to be written in Perl: https://github.com/metabrainz/musicbrainz-server
40.
by kpcyrd 9mo ago
I wish this wasn't necessary, but the next steps forward are likely: a) Have a reverse proxy that keeps a "request budget" per IP and per net block, but instead of blocking requests, causing the client to rotate their IP, the
41.
by kpcyrd 9mo ago
The target audience for the article are people building these systems, so the people who would have to pay for the centralized infrastructure. With git there's a sync protocol built-in that allows anybody who's interested to pull
42.
by kpcyrd 9mo ago
The second argument doesn't really work out in praxis. We have a quarter century knowledge about SQL injection at this point, yet it keeps happening. Instead of trying to educate everybody about how to safely use error-prone programmin
43.
by kpcyrd 9mo ago
The rootkit runs in ring0, at that point all kernel-enforced security controls are potentially compromised. Instead, you need to prevent the kernel module from being loaded in the first place. There are multiple ways to ensure no further ke
44.
by kpcyrd 9mo ago
Sure let me put all that on my credit card because some guy doesn't like git. The situation that PyPi is in is clearly worse: https://stackoverflow.com/questions/39537938/how-do-i-downlo...
45.
by kpcyrd 10mo ago
The author seems a little lost tbh, it's starting with "your users should not all clone your database" which I definitely agree with, but that doesn't mean you can't encode your data in a git graph. It then digresse
46.
by kpcyrd 10mo ago
The problem is that "once the package is qualified to be included in Debian" is _mostly_ about "has the package metadata been filled in correctly" and the fact that all your build dependencies also need to be in Debian a
47.
by kpcyrd 11mo ago
Out of the 789 npm packages in this incident, only 4 were ever used in any dependency tree of any Linux operating system (including Homebrew). Not in the affected versions, but ever. If your Rust software observes a big enough chunk of the
48.
GitHub Actions' VM image doesn't match published source code(lists.reproducible-builds.org)
9 points by kpcyrd 11mo ago|0 comments
49.
by kpcyrd 11mo ago
> Even when source is available, as in open source operating systems like Linux, approximately no one checks that the distributed binaries match the source code. This was not the case in 2023 for Arch Linux[1] back when the post was orig
50.
by kpcyrd 11mo ago
I looked into Meshtastic a while ago and they use AES with no authentication tags. Also decryption happens on the LoRa device, which is a lot easier to crack with physical access compared to my phone. Even if you delete the messages it&#x27
51.
by kpcyrd 1y ago
The partial collision is easy to verify but hard to generate, consensus is defined as "longest chain is the source of truth". If some p2p node can present you a longer chain you switch your source of truth to that one.
52.
by kpcyrd 1y ago
The post also mentions this is only a problem because of closed source, I think "I want to keep my government identity private, but here's the source code" would be a fair compromise. If one wants to be extra "there&#x27
53.
by kpcyrd 1y ago
SQL is somehow "ask two people, get three different opinions" for something as basic as: "given a BTreeMap<String, Vec<String>>, how do I do .keys() and .len()".
54.
by kpcyrd 1y ago
This isn't true, libc is magnitudes better defined than binary names in shell scripting, but it's still yet another case of approximation-API with multiple competing implementations. There are plenty of ecosystems where programs d
55.
by kpcyrd 1y ago
Almost as if programming against losely defined command-line interfaces is maybe not a very robust way of programming~
56.
by kpcyrd 1y ago
hopefully they got reported as bugs, I spent some time in June making sure a basic Arch Linux system can compile itself using uutils, and things mostly worked, the only build failures could be argued were shell scripts depending on undefine
57.
by kpcyrd 1y ago
For context: - The complaint is Github using a non-standard, custom fork of yaml - This makes it harder to develop linters/security tools (as those have to explicitly deal with all features available) - The author of this blogpost is a
58.
by kpcyrd 1y ago
This is often overlooked, to the point I created a website focusing on "the code we actually put into our computers": https://whatsrc.org/ It doesn't index all of npm, only if the package was reference by a L
59.
by kpcyrd 1y ago
Also, don't use npx. With the colors incident back in 2022, random stuff started to break not when people updated their dependencies, but immediately, because npx would resolve dependencies when the command is executed. This means it&#
60.
by kpcyrd 1y ago
How about: commit your dependency lockfiles, make sure they use content-addressing cryptographic checksums like Cargo.lock does. This is also needed for both reproducible builds and SBOMs. If you commit the actual source code you're ma

More ›