kpcyrd

7 ms·

61.
by kpcyrd 1y ago
> it's extortion That's a wild take for "somebody provided something for free but decided they don't want to anymore". Sucks for you, looks like you have to do your job yourself now.
62.
by kpcyrd 1y ago
The actionable items are "write code" and "build systems". The cypherpunk scene is still alive and evolving, but it's fairly niche, and a tough environment for people driven by external validation while 'things
63.
by kpcyrd 1y ago
I really like the rp2040-zero and used it in most of my embedded Rust projects. Right now the "rp2350 mini zero" costs me about 4.50€/unit to source on aliexpress, while the rp2040-zero costs me about 2€/unit. So I'
64.
by kpcyrd 1y ago
oss-rebuild is for independent verification, which cache.nixos.org doesn't have yet. I'm still waiting for https://github.com/nix-community/trustix to become a thing. Until then they are still behind Debian a
65.
by kpcyrd 1y ago
For packages in Linux distributions you probably want one of: - https://reproducible.archlinux.org/ (since 2020) - https://reproduce.debian.net/ (since 2024) There's arch-repro-status and debian-repro-
66.
by kpcyrd 1y ago
I briefly looked a this and there's already cargo-c configuration, which is good, but it's currently namespaced differently, so it won't get automatically detected by C programs as `libbz2`: https://github.com&#x2F
67.
by kpcyrd 1y ago
ssh-ed25519 is different from a gnupg ed25519 key, since it doesn't have any of the technical baggage that gnupg has. Even with ed25519, sha1 is still hardcoded into RFC4880, the standard that gnupg implements. Fingerprints are typical
68.
by kpcyrd 2y ago
Their point is that you'd need something like https://bootstrappable.org/ (which does exist).
69.
by kpcyrd 2y ago
Due to the python reference I think you mean "compiles into a single binary", not necessarily "static linking". This binary may be statically linked, or link to system libraries. Quite a few times the only system library
70.
by kpcyrd 2y ago
> It is not the only tool The burden of proof is on you. I asked which tool specifically would have detected CVE-2025-0665 and I don't mean to be mean, but your reply is essentially a very confident "I don't know but I&#x2
71.
by kpcyrd 2y ago
The blogpost claims they are already running "all the tools", can you please be more specific which one they are missing? Maybe the tool to avoid this kind of lifetime issue just happens to be rustc?
72.
by kpcyrd 2y ago
> We count about 40% of our security vulnerabilities to date to have been the direct result of us using C instead of a memory-safe language alternative. This is however a much lower number than the 60-70% that are commonly repeated, orig
73.
by kpcyrd 2y ago
There is nothing that can be done beyond what they are doing? You can receive their public keys out-of-band through an https-authenticated connection. Which means their approach to "the initial trust problem" is _not_ "trust
74.
by kpcyrd 2y ago
As somebody who cooks quite a lot (for a diverse set of people), I have the opposite experience of what you describe (also I hate having to touch my screen while cooking). The cooking book scene has been openly criticized for not actually t
75.
by kpcyrd 2y ago
It's a limitation in the ssh protocol. I wish they would fix it, but I'm not holding my breath. Trying to do anything about it would be a compatibility nightmare. If you need to pass data through ssh you're better off doing i
76.
by kpcyrd 2y ago
It's still a gotcha in Rust, I've seen code like: #[non_exhaustive] pub enum Protocol { Tcp, Udp, Other(u16), } It allows you to still match on the unrecognized case (like `Protocol::Other(1)`, which is nice
77.
by kpcyrd 2y ago
> * IPv6 clients can connect to v4 only hosts. May I introduce you to my ipv6-only vps
78.
by kpcyrd 2y ago
I run a ghcr proxy server to avoid having to rent an ipv4 address just to pull the container images I build with github actions: docker pull ghcr.proxy.orca.toys/kpcyrd/apt-swarm:edge My services are often run behind cloudf
79.
by kpcyrd 2y ago
I use repro-env to implement reproducible builds for my Github binaries and custom apt repository[1]: - https://github.com/spytrap-org/spytrap-adb/releases/tag/v0.3.3 - https://github.com&#
80.
by kpcyrd 2y ago
Arch Linux has .BUILDINFO files embedded in their .pkg.tar.zst files, which references files on https://archive.archlinux.org/ . Debian has .buildinfo files over at https://buildinfos.debian.net/ referencing
81.
by kpcyrd 2y ago
Thanks! The kind of work I do is about making an existing operating system issue reproducible packages, to the point that you can install a system with reproducible-only packages. This assumes "trusted source code and compiler", b
82.
by kpcyrd 2y ago
Yes, here you go https://reproducible-builds.org/_lfs/presentations/2025-02-0...
83.
by kpcyrd 2y ago
It unfortunately doesn't help in cases like this. Reproducible Builds gives you a trusted path from source to binary, but it doesn't help with backdoors in the source code/build instructions. For that we'd need some sort
84.
by kpcyrd 2y ago
hello, I'm one of the speakers. I've been working on this since 2017, happy to answer any questions the hackernews crowd might have.
85.
by kpcyrd 2y ago
I wish I could get this on Linux </3 Any ideas how to get there (without reaching out to network apis, like openai)? I assume since it's built on Apple's CoreML framework it's not possible?
86.
by kpcyrd 2y ago
The title of the submission is somewhat bait, unfortunately the Cargo.lock doesn't seem to be public. Since my current Rust side-project also has some kind of database (along with, well, a p2p system) and also totals 454 dependencies,
87.
by kpcyrd 2y ago
It's not a security control, it's for copyright compliance and in case of incorrectly filled out package metadata.
88.
by kpcyrd 2y ago
> when there is no reasonable packaging story for the language For context: I've been around in the Debian Rust team since 2018, but I'm also a very active package maintainer in both Arch Linux and Alpine. Rust packaging is abs
89.
by kpcyrd 2y ago
> but given the relative "freshness" of your typical Rust package vs say... Debian stable That's not how Debian development is done, fresh software is uploaded to unstable only and then eventually ends up in a stable relea
90.
by kpcyrd 2y ago
This is outdated information. Debian (and other distros) already had their own SBOM format called buildinfo files that encodes this kind of information. In Debian stable ripgrep on amd64 is currently on version 13.0.0-4+b2. The relevant bui

More ›