pron

45 ms·

721.
by pron 1y ago
How much of an unprecedented "flood" the post-covid rise in border encounters (and subsequent bump in expulsions) actually was is debatable, and it was Republicans who blocked a bill to fund expanded border security. More importan
722.
by pron 1y ago
Yes, and they hate him so much that they've been doing that to spite him not just in America but all over the Western world, and started decades before Trump even went into politics! Universities and hospitals in France, UK, and Korea
723.
by pron 1y ago
> it means making an actual effort to bring industry back to the US. Germany has a huge manufacturing surplus, and yet its share of employment in industry has been declining for at least 40 years now.[1] "Industry" cannot be &q
724.
by pron 1y ago
I agree with your observations about the differences between HotSpot and V8, but my general point is precisely that where you want to focus for security is complicated and application-specific, and that the relative risk of different vulner
725.
by pron 1y ago
You call it weak selective pressures, but another way of saying it is low fitness advantage. And we can see that because the programming language landscape is far from static, and newcomers do gain adoption very quickly every now and then.
726.
by pron 1y ago
If a language offered a significant competitive advantage, such an analysis wouldn't be necessary. Someone would capitalise on it, and others would follow. There are selective pressures in software. Contingencies play an outsized role
727.
by pron 1y ago
> If my day job is to reduce vulnerabilities in V8 itself, those would be totally out of scope and everybody would look at my like I’m crazy if I brought it up in a meeting. Maybe (and I'll return to that later), but even if the job
728.
by pron 1y ago
To your first point, you're sort-of right, but it's still not so simple. The value of vulnerabilities in V8 or in CPython is affected by their likelihood compared to other vulnerabilities to users using that same product (i.e. in
729.
by pron 1y ago
> Unfortunately there are too many non-believers for systems programming languages with automatic resource management to take off as they should. Or those languages had other (possibly unrelated) problems that made them less attractive.
730.
by pron 1y ago
First, UAF can be made largely non-dangerous without eliminating it (as in the link above and others). It's harder to exploit to begin with, and can be made much harder still virtually for free. So the number of UAFs and the number of
731.
by pron 1y ago
What about every Java/JS/Python/Rust/Go programmer who ever created a CVE? Out-of-bounds access is, indeed, a very common cause of dangerous vulnerabilities, but Zig eliminates it to the same extent as Rust. UAF is much
732.
by pron 1y ago
I don't know what you're saying about Zig. I have no predictions about that language's success, I just think its design is very interesting. Those examples of Rust use by industry giants are a red flag for its adoption, becau
733.
by pron 1y ago
Ten years in, Rust jobs are barely 10% of C or C++ jobs, if that. In any market segment, that is not the kind of adoption that successful products usually display. Judging from the emotion in your comment, I sense that I did touch a nerve,
734.
by pron 1y ago
> hardly questionable its adoption in the industry at scale. Really? It's heavily marketed, yet after 10+ years it's struggling to achieve even a 2% market penetration. I mean, I don't think anyone sees it as the next Fo
735.
by pron 1y ago
Oh, I didn't mean to touch a sore spot, I just assumed that by now it was obvious to everyone that a highly-marketed 10+-year-old language with less than 2% market penetration is unlikely (at least based on historical trends) to meet e
736.
by pron 1y ago
I don't claim Zig represents what the industry thinks. The sharply declining use of low-level languages for high-level applications, however, shows that that idea is certainly unpopular these days. It could still be the case that more
737.
by pron 1y ago
Given their level of adoption, those languages represented what their creators thought, not necessarily what the industry thought.
738.
by pron 1y ago
> I think it’s a good compromise, because the consequences of forgetting it are way harsher. And easier to detect. Knowing that no operation is carried out unless you can see it is important to many who do low-level programming. But ther
739.
by pron 1y ago
It's clear once you know that an object implements the Drop trait, but you can't see that at the use site, ergo it's hidden (same goes for C++ destructors). Zig wants every call to be visible. The tradeoff is between making s
740.
by pron 1y ago
AST macros are very powerful . As to them being "good", that's debatable. They have advantages but also disadvantages. For one, they operate on syntax, so they're a separate metalanguage and not so pleasant to debug. Fo
741.
by pron 1y ago
Well, that's true for simple type systems. Dependent types are not so practically usable. You're absolutely right that simple types prove some "simple" properties, but we know what characterises them: they're induct
742.
by pron 1y ago
It was a joke premised on the implicit assumption that Zig must be an "anti-Rust" because it came later. Maybe you could call different approaches contrarian if Rust had achieved some great popularity or consensus, but it hasn&#x2
743.
by pron 1y ago
Oh, I'm very pro Rust. I think that its use of the borrow checker is inspired and quite spectacular, that we can learn a lot from it. I just don't like it (as a practical programming language). It's not for me and for people
744.
by pron 1y ago
Or Rust being the anti Zig alternative for people who have spent years/decades accumulating weird knowledge about the finer details of type systems and maintain that not being able to express an algorithm, or review one, without consul
745.
by pron 1y ago
It's a language that attempts to solve more of the biggest issues with low level programming than any other current low-level programming language. Of course, there is nowhere near a universal consensus on what the biggest issues are,
746.
by pron 1y ago
I think you're missing a more internecine debate within software correctness/formal methods circles than the more general one about "writing good/correct software". Deductive theorem proving was all the rage in the
747.
by pron 1y ago
Amazon Corretto and Eclipse Temurin are developed and licensed by Oracle. They are just packaged and distributed by Amazon and IBM respectively. If you report an issue against them, the Amazon/IBM people will forward the issue to us at
748.
by pron 1y ago
Your company has bought support from Oracle - either for the JDK or for some other product bundle - and that's part of the terms of whatever commercial service your company bought. There are no audits and no cost for people who just do
749.
by pron 1y ago
> Go is a good compromise. Safety at a minor cost in performance. Go is good enough for web back end stuff. Go has both GC and "green threads". Or, for even better performance, you can use Java (24+), which has both "green
750.
by pron 1y ago
There's always legacy systems; it's part of the natural lifecycle of software. Also, what you buy is any kind of support, regardless of the version you're on. Support doesn't mean access to patches but an SLA for the tic

More ›