unscaled

15 ms·

91.
by unscaled 1y ago
The post's title is quite hyperbolic and I don't think it serves the topic right. Memory arenas/pools have been around for ages, and binding arenas to a lexical scope is also not a new concept. C++ was doing this with RAAI, a
92.
by unscaled 1y ago
It might not be on every use though. The assignment could very well be conditional. If a dangling reference could escape from the arena in which it was allocated, you cannot claim to have memory safety. You can claim that the arena prevents
93.
by unscaled 1y ago
I know very little about how rustc is implemented, but watching what kind of things make make Rust compile times slower, I tend to agree with you. The borrow checker rarely seems to be the culprit here. It tends to spike up exactly on the t
94.
by unscaled 1y ago
The difference that you've already noted here is that the X-Browser-Validation is new. It doesn't have to keep using SHA1, MD5 or CRC-32 to maintain compatibility with a protocol spec that predates the existence of newer algorit
95.
by unscaled 1y ago
Not just engineers. Many off-the-shelf static analysis tools would happily jump at every mention of a deprecated algorithm such as SHA1 in your code. It's just too much noise, and the performance cost of SHA-256 is negligible on modern
96.
by unscaled 1y ago
Some employees can be replaced by AI. That part is true. It's not revolutionary (at least not yet) — it's pretty much the same as other post-industrial technologies that have automated some types of work in the past. It also takes
97.
by unscaled 1y ago
> There are basically only two “real” reasons to use Docker or containerization more generally: > 1. People who do not know how to use Unix-based operating systems or specifically GNU/Linux. > 2. People who are deploying a pro
98.
by unscaled 1y ago
macOS (since version 10) is Unix. You can say most macOS users are not using the terminal or that back in the 1990s and 1980s, all the popular desktop OSes weren't based on Unix and that would probably be more accurate. The massive e
99.
by unscaled 1y ago
Go doesn't even classic type-safe integer-value enums like in C++ or enums. Yes, you can emulate this style of enums by using iota to start a self-incrementing list of integer constants. But that's not what any language (except fo
100.
by unscaled 1y ago
1. Cookies remain valid on logout (unless you implement a session revocation mechanism). This can be mitigated by making the JWT live a very short time (e.g. 5 minutes), but you still don't get immediate expiry. This may not be accepta
101.
by unscaled 1y ago
This article focuses about memory, but even if memory wasn't an immediate issue (e.g. if you had smaller pages and didn't restrict the heap size to 1GB), you still want backpressure in this case. What really happens here is that w
102.
by unscaled 1y ago
You can catch OutOfMemoryErrors in Java, but it wouldn't be as simple as you describe. In a real-world program, you may be doing other things besides downloading URLs and feeding the URLs to the download scheduler. Even though the URL
103.
by unscaled 1y ago
In that case, when and how would you reload the statuslist? Again, it doesn't matter if TTL and caching is optional, what matters is that this specification has NOTHING to do with a pub/sub-based or push-based mechanism as describ
104.
by unscaled 1y ago
GNU core utils is 134 lines of code, not 50, so the Rust version is even slightly shorter. You can make yes a lot shorter in both C and Rust, but this size goes into speed. For reference, OpenBSD's yes is just 17 lines of code[2]. It e
105.
by unscaled 1y ago
tptacek's survey was already mentioned here, but I think it should be more famous. https://fly.io/blog/api-tokens-a-tedious-survey Unfortunately, it seems like 99% of the industry decides which token to use based
106.
by unscaled 1y ago
"Bearer" and JWT are orthogonal. Tokens in other format or stateful formats can be bearer tokens, while JWTs can use non-bearer authentication methods. For instance, RFC 9449 (DPoP) describes an authentication method where you hav
107.
by unscaled 1y ago
I don't think status lists solve the requirement for near-realtime revocations. The statuslist itself has a TTL and does not get re-loaded until that TTL expires. This is practically similar to the common practice of having a stateful
108.
by unscaled 1y ago
these "potential crypto attacks" resulted in multiple CVEs and several real life attacks. I think even the Storm-0558[1] could be traced to how hard it is verify a valid JWT, due to some of the over-engineering mistakes that have
109.
by unscaled 1y ago
JWT is basically just a signed JSON container format (JWS) with a couple of standard claims and recommended verification procedures. They can be used as a component of an authorization system but they would just be a small component of that
110.
by unscaled 1y ago
Some optional OAuth extension RFCs do depend on JWT, e.g. Profile for OAuth 2.0 Access Tokens (RFC 9068) OAuth 2.0 Demonstrating Proof of Possession (DPoP) (RFC 9449, JWT-Secured Authorization Request (JAR) (RFC 9101). Core OAuth 2.0 does n
111.
by unscaled 1y ago
Everything can include "claims". Claims are just fields in a JSON object. If you're using your own token format which is based on Libsodium's secret box, you can just do `secretbox_seal(secret_key, json_encode(claims))`.
112.
by unscaled 1y ago
This addresses some of the hassle around buying multiple tickets, but does not address the inherent privacy issues. But there are still some problems. First of all, this remains a hassle in most countries, since handling a national identity
113.
by unscaled 1y ago
I would argue that JOSE is complex for the sake of complexity. It's not nearly as bad as old cryptographic standards (X.509 and the PKCS family of standards) and definitely much better than XMLDSig, but it's still a lot more com
114.
by unscaled 1y ago
Yes, JOSE is certainly overengineered and JWK is arguably somewhat overengineered as well. But "the rest" of ACME also include X.509 certificates and PKCS#10 Certificate Signing Requests, which are in turn based on ASN.1 (you&#x27
115.
by unscaled 1y ago
"Invented" is doing a lot of legwork here. Rockets have been invented in China in the 13th century, if not earlier. Hwacha ("fire cars") were more advanced than that, since they were an early version of an MLRS which cou
116.
by unscaled 1y ago
I've had a similar journey to you — I've gotten familiar with Lua through using embedded Lua in apps like Neovim, Hammerspoon, Sbarlua and Wezterm. But unfortunately I feel the exact opposite: the more I use Lua, the more I hate i
117.
by unscaled 1y ago
Inheritance is not the only way to share behavior across different implementations — it'a just the only way available in the traditional 1990s crop of static OOP languages like C++, Java and C#. There are many other ways to share an im
118.
by unscaled 2y ago
Looking at the various conversations involving string interpolation, this characterization is extremely unkind. They've clearly spent a lot more than 5 minutes thinking about this, including writing their own mini-proposals[1]. Are the
119.
by unscaled 2y ago
The proposal doesn't say anything about executing code in user-supplied strings. It only talks about a string literal that is processed by the compiler (at which point no user-supplied string can be available). On the other hand, the
120.
by unscaled 2y ago
For what it's worth, migrating from Java 8 to 11 is much smoother than .Net 4.x to .NET Core / Standard / 6+. In all honesty, in all the project we've migrated it was only ever so slightly more painful than migrating 11-

More ›