ljackman

7 ms·

1.
by ljackman 6y ago
That's a good point. Generally, I opt for languages that either compile away their nicities to avoid runtime hits, such as Rust being compiled to WASM, or languages that bring nicities in runtimes that they _completely own_, such as Ja
2.
by ljackman 6y ago
`Async`/`await` or something like Kotlin's `suspend` are great language features for certain domains in which a developer needs to manage blocking system calls: in lower-level languages such as Rust or C, you probably don't w
3.
by ljackman 6y ago
The whitelisting looks great. Even with the remaining concerns I raised in the other comment, the ability to whitelist only allowed domains for network connections is a massive step up security-wise, even if they are allowed for the entire
4.
by ljackman 6y ago
That's a good start, supporting the dropping of privileges after performing something on startup. What about keeping the network allowed in the layer handling, say, inbound HTTP connections, but blocking it in the data access layer or
5.
by ljackman 6y ago
It looks like a good evolutionary improvement over Node.js. However, I have a concern about its security claims. Perhaps someone on the project can allay these concerns. My brief skimming of its site indicates that its security model is bas
6.
by ljackman 7y ago
I wonder whether Project Loom will create a split in the Kotlin ecosystem between coroutine-based concurrency and Loom lightweight thread-based concurrency. Java will have a similar problem with CompletableFuture and third-party projects li
7.
by ljackman 7y ago
There might be, but unfortunately I don't know it. I learnt Java initially from the first edition of Just Java, read from various other sources about the 1.5 and 1.6 additions it didn't cover, and then learned new features from Op
8.
by ljackman 7y ago
Thanks for the clarification on the final NRT behaviour. Just to say, my point about "didn't align with good taste" was itself lacking taste. I'm sure each of those features I critiqued made sense as they were proposed a
9.
by ljackman 7y ago
Fair enough; I do miss keyword and default arguments from C# when using Java. A long list of overloads and argument forwarding to fake default arguments gets old.
10.
by ljackman 7y ago
FWIW, I could have produced an equally-long list of Java flaws. I'm not terribly attached to either language. I just wanted to challenge the meme that "C# is a better Java" I hear on the Internet every other week. "Infin
11.
by ljackman 7y ago
These C# issues arguably demonstrate haphazard additions that didn't align with good taste: * Too many overlapping concepts for referring to code by value and defining them inline: events, delegates, anonymous delegates, and lambdas. *
12.
by ljackman 7y ago
While Java's slow and cautious evolution frustrates developers, it still arguably demonstrates longer-term thinking than the constant accrual of features in its contemporaries such as JavaScript and C#. That isn't to say the desig
13.
by ljackman 7y ago
Agreed. A lot of serialisation support in mainstream languages seem to stand in stark contrast to the principles of langsec [1]. This bug reminded me a bit of Heartbleed actually; it’s pretty different but has that one similarity of two pay
14.
by ljackman 7y ago
I’m glad we’re seeing so many security vulnerabilities being exposed in the lower-level parts of the consumer OSes whose security we all take for granted. Doing writeups of compromised webapps is also great of course, but selling the import
15.
Using Single-Field Wrapper Types to Reduce Bugs(volatilethunk.com)
1 points by ljackman 7y ago|0 comments
16.
by ljackman 7y ago
By ‘constant stack value’, I was referring to ‘effectively constant’ stack values, i.e. ones who aren’t reassigned in the scope or passed by mutable reference (or indeed are but aren’t actually modified by those functions anyway if the comp
17.
by ljackman 7y ago
You’re completely correct. I was conflating the ODR-adhering standard ‘inline’ keyword with the various inlining pragma in some compilers that actually are about solely forcing inlining as an optimisation.
18.
by ljackman 7y ago
The key difference between `const` and the `register` and `inline` keywords is that, despite all of them often flagging optimisations that the compiler can often work out anyway, `const` still aids human comprehension by declaring constrain
19.
by ljackman 7y ago
Some templating languages such as Jsonnet[0] add built-in templating and just enough programmability to cover basic operations like templating and iteration. I originally felt it was overly complex, but after seeing some of the Go text&#x2F
20.
by ljackman 7y ago
Apple has been slowly phasing out GPLed software from their own software, such as Catalina's migration from Bash to Z Shell, but even writing third party apps with the GPL has apparently been problematic in the past: https:/&#x2F
21.
by ljackman 7y ago
My experience of Bamboo has included: * Broken base Ubuntu images being recommended by Atlassian as the default for agent Image configuration, only to be fixed to a usable state months later; * Being generally years behind other CI tools, e
22.
by ljackman 8y ago
I agree that CPython and V8 omitting the ability to juggle multiple stacks is a mistake. For higher-level languages, undelimited coroutines or continuations allow for very useful abstractions like Go's and Erlang's transparently n
23.
by ljackman 8y ago
Most common coroutine implementations, such as JavaScript's and Python's, are delimited or "symmetric". This means the most obvious implementation is in terms of compiler transformations in the source language. It seems
24.
by ljackman 8y ago
Yes, macOS seems to be heading in the right direction (even if it means frustrating legitimate usage patterns at times). In particular, I like that it kept it simple by either an application being sandboxed with explicit user permissions fo
25.
by ljackman 8y ago
Good point. The lack of visibility into today's blackbox commodity hardware is frightening, such as Intel ME. It's even worse when that hardware is listening to external commands via the EM spectrum and the like, as you point out.
26.
A DOMain of Shadows(gbracha.blogspot.com)
2 points by ljackman 8y ago|0 comments
27.
by ljackman 8y ago
This approach being even viable is a testament to the host platform portability of Clojure, but even more to Common Lisp's ability to read other language's token-level syntax via reader macros (unless I've misunderstood how t
28.
by ljackman 8y ago
Most laptop OSes, like Windows, macOS, and Linux, are a decade behind mobile OSes in terms of application sandboxing and also still lagging behind on restricting OS tampering and implementing reliable chains of trust from the system softwar