uecker

8 ms·

181.
by uecker 3mo ago
1. What would this be? 2. Good point, but for most purposes I think exploiting some aspect of the build system or the language that moves the exploit code or causes it to be executed before main would be easier than exploiting a memory iss
182.
by uecker 3mo ago
For this to be useful you would need to modify the compiler binary to make the exploit persistent. Otherwise why put an exploit for the compiler in the source to so that the compiler can put some malware in a binary, when you can put the
183.
by uecker 3mo ago
The aspects where I think Rust is worse are: compilation time, high complexity, less stable, only one implementation, no international standard, no proper ABI. xz was a highly sophisticated attack using social engineering and hiding malwar
184.
by uecker 3mo ago
Rust is not a lot better than C. In many aspect, it is worse. It is better if you focus on a specific point (memory safety) and exaggerate its importance beyond all other considerations and ignoring all other options to make progress in thi
185.
by uecker 3mo ago
Also waypipe is inferior by design as it is a proxy added after the fact. But it does not matter that they now have some kind of a solution for a use case for which they denied that it even exists for a long time. I will avoid Wayland becau
186.
by uecker 3mo ago
Not much, and people also should not to do this. One should at least have a check of hash of the download vs some document signed with a key. In any case, the curl|bash from a website is way worse as it leaves no trace. Here, you have an
187.
by uecker 3mo ago
And all the gaslighting. Using X forward basically every day but being told it is useless and broken and nobody needs it...
188.
by uecker 3mo ago
The better choice would have been to double down on N9 and successors. This was my opinion at that time and still is. You may be right about all the internal problems that delayed thing, but the Windows Phone decision was bad and poorly ex
189.
by uecker 3mo ago
"But the N9’s accolades did not ultimately carry the day. " I think it would have. The N9 was killed before it came to market. It was never sold in any of the major markets, the platform was declared dead as the switch to Windows
190.
by uecker 3mo ago
I think Rust is annoyingly complex and badly designed (although it has good parts) and this would be the same mistake as past pushs to move projects to C++ because "object orientation is clearly better", and as such also step towa
191.
by uecker 3mo ago
Not really, there a lot of factors making nuclear expensive apart from regulations. And is also clear that you need some regulations.
192.
by uecker 3mo ago
This is nonsense. There is quite a subset of C which is perfectly safe and an even larger one which can easily be safe with tooling. You could argue that unsafe keyword is easier to spot than the unsafe features of C, so that makes it somew
193.
by uecker 3mo ago
Or Rust, when not sticking exclusively to safe Rust, but this is not really possible in many systems programming scenarious.
194.
by uecker 3mo ago
Ok, you are right. There are situation where something should be re-designed from scratch. I am also not against building something new or better alternatives. But I would still argue that far more often than not rewrites are misguided.
195.
by uecker 3mo ago
Exactly. Nothing which should exist.
196.
by uecker 3mo ago
Sorry, I think the idea that rewrites are good way to achieve more maintenable software is basically always based on a delusion. It is a very common and well understood delusion for programmers who always see the existing code as crap and i
197.
by uecker 3mo ago
I don't think this is what we want. We want people to maintain and incrementally improve existing software and tooling and not rewrite and change things all the time.
198.
by uecker 3mo ago
A long time ago, I also thought one should use unsigned mostly but I am now in the opposite camp. Unsigned integers in C have semantics for modulo arithmetic. They are suitable if you need this, so for crypto, hashes, or if you only care ab
199.
by uecker 3mo ago
Because it is not trustworthy, which is really the most important thing.
200.
by uecker 3mo ago
I do not keep track of them, but google finds CrateDepression, faster_log, async_println, finch-rust or recently: https://cybersecuritynews.com/supply-chain-trapdoor-malware/ It is not FUD as it is a real risk. cargo a
201.
by uecker 3mo ago
Of course, the point was that it is not a great step forward in software engineering but zig catching up to what was is a reasonable design.
202.
by uecker 3mo ago
I think there were enough attacks already for cargo that one can not call this FUD. It is also obvious that this way to distribute software is susceptible to supply chain attacks. cargo audit is an attempt to fix this retrospectively, but d
203.
by uecker 4mo ago
I would agree that the zig developers know what they are doing. But not necessarily all fans of the language...
204.
by uecker 4mo ago
It is exactly because software is a social activity that one should try to understand the purpose of a design before changing it.
205.
by uecker 4mo ago
Fair, but with all the new C-alternative languages I also see a lot of Chesterton's Fences being teared down. In part, this is also perfectly fine for experimentation, but sometimes it leaves me wondering as well.
206.
by uecker 4mo ago
On the other hand, systems like cargo a clearly a supply chain disaster. I also think that languages should not have their own specific packaging system. This should be done on a distribution level, which provides curated lists of software.
207.
by uecker 4mo ago
It was a resounding endorsement in 2020, but the proof is in the pudding. So far I am not impressed. It is also not something I think is terribly important. Even if they managed to improve memory safety in the kernel using Rust (but I assu
208.
by uecker 4mo ago
I wonder whether the "replacing c in the linux kernel" is not more wishful thinking by Rust enthusiasts. As of know it has less than 1% and less than bash.
209.
by uecker 4mo ago
Rust isn't perfect, this is my point. But its marketing is based on this idea ("rule out whole class of bugs"). If this were true then the bugs I cited could not exist, so they severe as counter examples that clearly invalid
210.
by uecker 4mo ago
I think Rust helps a lot for people who would other struggle because they would otherwise create a mess by enforcing certain high-level structure that rules out certain problems. But you can just use very similar structures yourself in C pr

More ›