Well I'm not a random HNer lol I work in security. Are you suggesting that they've come up with a novel technique that doesn't involve sharing a CPU core? I'm open to that. From what I can tell, this is not the case,…
> something that our systems are meant to prevent What prevention method did they take? Like, did they run with hyperthreading enabled or something by accident? Did they discover a new cache timing technique or is this…
uv defaults to its own trust store afaik lol
The vast majority of web services are not written in memory unsafe languages so this is not surprising. One of the exceptions (with regards to web facing attack surface in a memory unsafe language) is that people still…
It was.
I don't care, nor should anyone else
Sure, I think it was still under the same unsound tag regardless.
I don't think the definition of "memory safe" has ever required full end to end stack conformance with a proof. Very few languages have achieved that, though some have. Most people call Java memory safe, C#, Python,…
lol I was writing `l` because I thought it was `labeled-unsound` for like a fucking decade
For a long time `loop {}` was undefined behavior. Lots of l-unsounds are really nuts but a few are not. The reality is that if this were actually code that people wrote, well, it wouldn't have sat around for a decade.
lol do you think that cve-rs was required? there is literally an l-unsound tag on rustc's github, this isn't some embarrassing or secret thing. Safe rust is safe, granting `unsafe` and compiler errors. This isn't a…
This doesn't work when every candidate holds the same position.
I mostly use Haiku for really, really basic stuff, never for actual engaging work. I've used it for first-pass analysis to triage bugs, for example - all it does is related N bugs together to see if any potentially…
No. It's because Greg doesn't like the CVE system and MITRE, the stupidest decision ever, made Greg a CNA, and this is his tantrum that he's been waiting 40 years to throw.
I think the current state of bug bounties demonstrates that it's about the eyes, not the number.
> 'with enough eyes all bugs are shallow' This was always nonsense. It assumes that the eyes know what they're looking at. Most people don't know how to look at code and see attack paths.
I think the wording in this title is too strong. MicroVMs like Firecracker have stood up to agents, as noted.
Rust is not 1.5-4x slower at all. Git is not IO bound at all, it is not saturating your IO device, it just performs IO a lot.
Just use TLS / mTLS over the tunnel, no?
As someone building a language with an LLM, it is exactly an exploration of curiosity. I have a lot of ideas, I don't always know how to implement them, and I certainly lack the time. The LLM can write the code, I can…
I agree, but I think most people actually don't think that's true when it comes to services that primarily do IO.
At work we're moving almost everything to Rust on our backend. Massively reduced memory usage and significant latency improvements relative to our Typescript codebase. Even for code that you'd expect to work well in TS,…
Once a day I see a comment somewhere on the internet and go "Yes, perfect, this is the dumbest thing I'll read today. Great, that's out of the way". This is the one today!
Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But…
I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
Well I'm not a random HNer lol I work in security. Are you suggesting that they've come up with a novel technique that doesn't involve sharing a CPU core? I'm open to that. From what I can tell, this is not the case,…
> something that our systems are meant to prevent What prevention method did they take? Like, did they run with hyperthreading enabled or something by accident? Did they discover a new cache timing technique or is this…
uv defaults to its own trust store afaik lol
The vast majority of web services are not written in memory unsafe languages so this is not surprising. One of the exceptions (with regards to web facing attack surface in a memory unsafe language) is that people still…
It was.
I don't care, nor should anyone else
Sure, I think it was still under the same unsound tag regardless.
I don't think the definition of "memory safe" has ever required full end to end stack conformance with a proof. Very few languages have achieved that, though some have. Most people call Java memory safe, C#, Python,…
lol I was writing `l` because I thought it was `labeled-unsound` for like a fucking decade
For a long time `loop {}` was undefined behavior. Lots of l-unsounds are really nuts but a few are not. The reality is that if this were actually code that people wrote, well, it wouldn't have sat around for a decade.
lol do you think that cve-rs was required? there is literally an l-unsound tag on rustc's github, this isn't some embarrassing or secret thing. Safe rust is safe, granting `unsafe` and compiler errors. This isn't a…
This doesn't work when every candidate holds the same position.
I mostly use Haiku for really, really basic stuff, never for actual engaging work. I've used it for first-pass analysis to triage bugs, for example - all it does is related N bugs together to see if any potentially…
No. It's because Greg doesn't like the CVE system and MITRE, the stupidest decision ever, made Greg a CNA, and this is his tantrum that he's been waiting 40 years to throw.
I think the current state of bug bounties demonstrates that it's about the eyes, not the number.
> 'with enough eyes all bugs are shallow' This was always nonsense. It assumes that the eyes know what they're looking at. Most people don't know how to look at code and see attack paths.
I think the wording in this title is too strong. MicroVMs like Firecracker have stood up to agents, as noted.
Rust is not 1.5-4x slower at all. Git is not IO bound at all, it is not saturating your IO device, it just performs IO a lot.
Just use TLS / mTLS over the tunnel, no?
As someone building a language with an LLM, it is exactly an exploration of curiosity. I have a lot of ideas, I don't always know how to implement them, and I certainly lack the time. The LLM can write the code, I can…
I agree, but I think most people actually don't think that's true when it comes to services that primarily do IO.
At work we're moving almost everything to Rust on our backend. Massively reduced memory usage and significant latency improvements relative to our Typescript codebase. Even for code that you'd expect to work well in TS,…
Once a day I see a comment somewhere on the internet and go "Yes, perfect, this is the dumbest thing I'll read today. Great, that's out of the way". This is the one today!
Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But…
I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.