staticassertion

212 ms·

3541.
by staticassertion 6y ago
Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes
3542.
by staticassertion 6y ago
Macros: #[Foo] struct Bar {} baz!() cat!{} blah![]
3543.
by staticassertion 6y ago
Cool, that sounds reasonable then. Good stuff.
3544.
by staticassertion 6y ago
Surprised no one has yet commented on eBPF, and the impact this has. ebpf already gives users the right to run code as the kernel, and this is a security win in many cases - you can audit your system better. On a server, I think I'd
3545.
by staticassertion 6y ago
I started going through the docs. This language starts off with some heft sells - prevent errors, increase test coverage, etc. Then the docs mostly cover things like "you can call an array an array or a list" and stuff that isn&#x
3546.
by staticassertion 6y ago
Ah, I skimmed your comment history. I'm opting out of this conversation. I think we disagree too much to find common ground here.
3547.
by staticassertion 6y ago
Not much, I was a child. I think it would be sort of a waste of time to compare 9/11 to Covid with regards to government overreach. Off the bat, the threat is of a completely different nature, we understand the threat in a completely d
3548.
by staticassertion 6y ago
Very little about this feels like the Patriot Act. I also don't really see why the government would want to tank its economy. I mean, I can think of some really out there reasons, but I don't really feel it's worth entertai
3549.
by staticassertion 6y ago
> If instead of saying "I want a haircut.", they would say like Benjamin Franklin: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." would they be
3550.
by staticassertion 6y ago
There are two separate things here. There's going to a company and saying "Are you SOC2? If not, we need you to be, and that requires a pentest - please go do that before we engage." There may also be, in this same vein, &quo
3551.
by staticassertion 6y ago
> I find that very surprising that you uncommonly pen test 3rd party vendors. Just so we're clear "you" is not Dropbox, and I'm not talking about what Dropbox does or doesn't do. I'm saying that, in general,
3552.
by staticassertion 6y ago
Disclaimer: I worked on Dropbox security. Not in appsec. I won't comment on the article, or the accuracy of the article, or anything that wasn't public before the article. I'm mostly just going to talk about what is broadly t
3553.
by staticassertion 7y ago
Ok, at that point, why not just write the Python directly in your Rust application?
3554.
by staticassertion 7y ago
There are exploits though - for example, the lowest barrier to exploit vulns like 'zoom bombing' are being exploited quite often. Others, like perhaps an RCE, are not being seen. This is for a lot of reasons. * Many are being foun
3555.
by staticassertion 7y ago
To me, a company that wants 2% of a pool has to be extremely competitive. 2% is a lot.
3556.
by staticassertion 7y ago
https://en.wikipedia.org/wiki/Software_engineering_demograph... 612k engineers. Let's assume that Amazon aims to hire the top 20% (I would expect software engineering skills to follow a power curve), so roughly 10
3557.
by staticassertion 7y ago
I am referring to programmers, and specifically a subset of programmers that can pass a difficult interview - most developers are absolutely terrible, probably > 50%, so cut that number in half at least. It's a relatively small nu
3558.
by staticassertion 7y ago
Their pool is not the entire US workforce, it's a relatively small group of highly skilled workers in a market where those workers can make tons of money at many different companies. Alienating a fraction of that workforce will impact
3559.
by staticassertion 7y ago
It's definitely a fine sanity check but I'd have to really think about whether it's a barrier. Immediate things I worry about are around URL parsing. Is evil.com<insert something here>steampowered.com going to pass as &
3560.
by staticassertion 7y ago
> Past behavior is a good predictor of future behavior. Is it? Past behavior on the scale of decades, with leadership and org changes, market changes, culture changes in between? I don't think that my behavior 10 or 20 years ago is
3561.
by staticassertion 7y ago
I'm curious why you need the SOC2 report itself instead of some sort of signed statement of compliance. The details of the SOC2 don't seem like they should be important?
3562.
by staticassertion 7y ago
I've never personally seen or used mem::forget. I'm sure it happens, of course, and I'm in agreement that the API should be unsafe. I'm just saying it's not clear that they "don't care".
3563.
by staticassertion 7y ago
This doesn't read to me as "the maintainer doesn't seem to care" so much as they feel that the unsafety is likely an edge case and, in another issue, there's some more discussion around fixing it. https:/&#x2F
3564.
by staticassertion 7y ago
> Longer term, there is absolutely nothing inherent to being a “startup” that will make it any better at weathering the future than any other type of business. I think the assumption is that "longer term" is "within your r
3565.
by staticassertion 7y ago
It's harder to extract patterns from high entropy data. I don't think anyone's saying that this is even an OK thing to rely on, at all, just that the nature of the data means that this specific weakness is likely more difficu
3566.
by staticassertion 7y ago
> Don't use agent forwarding unless you know you can trust the machine on the other end. On both ends. Agent hijacking can happen on client or server, with an attacker present. And is there any machine you can 'trust' ?
3567.
by staticassertion 7y ago
https://dropbox.tech/infrastructure/rewriting-the-heart-of-o... > The Control thread is designed to be entirely deterministic when its inputs and scheduling decisions are fixed. We use this property to fuzz it with
3568.
by staticassertion 7y ago
Dropbox does, essentially, fuzzing of Rust async code and it is determistic. I couldn't find a post about it, sadly, but I know the information is out there somewhere.
3569.
by staticassertion 7y ago
I've repeatedly seen requests of this nature handled by AWS - 75% cuts to billing, 90% cuts even.
3570.
by staticassertion 7y ago
You ever run a pip install? Maybe an apt-get install?

More ›