HackerTrans
TopNewTrendsCommentsPastAskShowJobs

Manishearth

no profile record

Submissions

The Future of the Con Is Here, It's Just Not Evenly Distributed

manishearth.github.io
8 points·by Manishearth·hace 23 días·0 comments

comments

Manishearth
·hace 13 días·discuss
I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is broken" not "this is directly exploitable", but I didn't want to just file LLM output as issues on these repos.

I very briefly considered doing something like this: if I just post the results on the internet, people can crowdsource filing issues and working on fixes. It's certainly not the nicest way of doing this, but on balance I'd like these issues to be fixed eventually.

I ended up not doing that and am instead filing a couple issues a day because it's not that much of a burden. This was an experiment that was much more successful than I expected, so I didn't budget to spend this time, but it's also not a huge deal to slowly do it.
Manishearth
·hace 15 días·discuss
Yeah. I do use this trick.

Some "root" passwords are ones I do not put in my password manager out of "what if my pwd manager gets compromised" paranoia, but that makes me more vulnerable to this.

And annoyingly some websites like to forget you're logged in. Not Google as much, but it's a thing that happens enough that means that there's a chance that I would blindly enter a password if my guard was down. A slight chance I think (especially in the last year where i've been worried about more sophisticated scams) but a chance nonetheless.
Manishearth
·hace 4 meses·discuss
.... we're talking about serialization here. "convert to a raw string" is sort of the name of the game.

It's a string in a well specified string format. That's typically what you want for serialization.

Temporal is typed; but its serialization helpers aren't, because there's no single way to talk about types across serialization. That's functionality a serialization library may choose to provide, but can't really be designed into the language.
Manishearth
·hace 9 meses·discuss
Yeah, and it's even better if you have a GC where you can control when the collection phase happens.

E.g. in a game you can force collection to run between frames, potentially even picking which frames it runs on based on how much time you have. I don't know if that's a good strategy, but it's an example of the type of thing you can do.
Manishearth
·hace 9 meses·discuss
Worth highlighting: library-level GC would not be convenient enough to use pervasively in Rust anyway. library-level GC does not replace Rust's "point".

It's useful to have when you have complex graph structures. Or when implementing language runtimes. I've written a bit about these types of use cases in https://manishearth.github.io/blog/2021/04/05/a-tour-of-safe...

And there's a huge benefit in being able to narrowly use a GC. GCs can be useful in gamedev, but it's a terrible tradeoff to need to use a GC'd language to get them, because then everything is GCd. library-level GC lets you GC the handful of things that need to be GCd, while the bulk of your program uses normal, efficient memory management.
Manishearth
·hace 10 meses·discuss
Diplomat has a wasm backend so it would even be really easy to produce a WASM ffi target with idiomatic JS and TS bindings.

Also, Diplomat supports traits and callbacks so you could actually make the timezone impl pluggable. Though we don't currently have JS support for that.

But also tz info isn't that big I think...
Manishearth
·hace 8 años·discuss
Chrome and Chromium share the same engine, and for this stuff it is the engine that matters.
Manishearth
·hace 10 años·discuss
Not going to work; trust me, I've tried. I tried for years to avoid getting my pictures online, they got there anyway and are a Google search away. Now I've stopped caring.

If you want to participate in social media (which you have to, some people won't communicate any other way) you've got to accept that not everyone views your privacy the way you do.

And even of it did work, it wouldn't solve the issue since discrimination based on name can happen just as easily for people with obviously-black or obviously-Islamic names.
Manishearth
·hace 11 años·discuss
> templates

The vast majority of C++ template usage is acheived by generics, and in a much more type safe and debugable manner.

Most of the remaining things can be achieved by Rust's hygenic macros (which are not like C++ macros, they're more like C++ templates in how they can be used and the guarantees they provide).