Manishearth

25 ms·

1.
by Manishearth 27d ago
cargo-audit is the automated mechanism you are looking for The crate does have an advisories/"security" page on crates.io. We could try and show the existence of a security-deleted crate on the page. This is not a priority fo
2.
by Manishearth 27d ago
I mean, we have the crates available for analysis. We take snapshots before deleting them. We would probably be open to sharing files with those who ask. Probably, I don't know what other team members would think about that. This rough
3.
by Manishearth 27d ago
The response was managed by the security-response team working with the infra team and the Rust Foundation's Security engineer. Tobias from the crates.io team was also involved but on vacation so it was not as active. This is normal. W
4.
by Manishearth 3mo ago
I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is bro
5.
by Manishearth 3mo ago
Yeah. I do use this trick. Some "root" passwords are ones I do not put in my password manager out of "what if my pwd manager gets compromised" paranoia, but that makes me more vulnerable to this. And annoyingly some we
6.
The Future of the Con Is Here, It's Just Not Evenly Distributed(manishearth.github.io)
8 points by Manishearth 3mo ago|0 comments
7.
by Manishearth 6mo ago
.... we're talking about serialization here. "convert to a raw string" is sort of the name of the game. It's a string in a well specified string format. That's typically what you want for serialization. Temporal is
8.
by Manishearth 11mo ago
Yeah, and it's even better if you have a GC where you can control when the collection phase happens. E.g. in a game you can force collection to run between frames, potentially even picking which frames it runs on based on how much ti
9.
by Manishearth 11mo ago
Worth highlighting: library-level GC would not be convenient enough to use pervasively in Rust anyway . library-level GC does not replace Rust's "point". It's useful to have when you have complex graph structures. Or wh
10.
by Manishearth 1y ago
Diplomat has a wasm backend so it would even be really easy to produce a WASM ffi target with idiomatic JS and TS bindings. Also, Diplomat supports traits and callbacks so you could actually make the timezone impl pluggable. Though we don&#
11.
by Manishearth 4y ago
They're also explicitly tracking new code by language, and talking about memory safety vulnerabilities per year, and they also link to [1] which talks about how most memory safety bugs they get are in new code. Most of the graphs h
12.
by Manishearth 4y ago
I always say that if the strongest complaint people have about your language is syntax; you've already succeeded.
13.
by Manishearth 4y ago
I don't understand your question. GATs allow traits to abstract over associated types that are themselves to some degree abstract. In this case, it's necessary to do the relevant trait machinery around lifetime transformation sinc
14.
by Manishearth 4y ago
(the person who posted the article here isn't the author (me)) The bugs in part 1 all around using higher ranked trait bounds. I'd disagree with the characterization that they're "feature requests": five years ago,
15.
by Manishearth 5y ago
> Total BS too. Maybe in India. This has been the case at both my current and previous (American tech) jobs. And it's pretty racist to assume that a person is working or has worked in India just because they have an Indian name.
16.
by Manishearth 6y ago
I think most of these companies have had a pretty large investment, they're just not really open about it in many cases. So yeah, it's a pretty visible signal, but the investments they had already were much larger ones. A team o
17.
by Manishearth 6y ago
The wgpu crate is being developed by Firefox engineers for Firefox. As lastontheboat said we had a student integrate it into Servo this year.
18.
by Manishearth 6y ago
The Linux Foundation is basically a catch-all foundation for smaller open source projects, this is not "Linux owns a browser engine". The "Linux" there is more of an indicator of its origins than its purpose.
19.
by Manishearth 6y ago
Many of us are looking for (or have found) dayjobs, but it's possible some folks may be open to contracting work on servo/etc. But nobody is being paid to work on servo right now.
20.
by Manishearth 6y ago
We spent a significant amount of effort in the last year and a half working on a redesigned modular/parallel layout subsystem. The VR focus was because it was a good way to get servo out to end users early without needing to be fully w
21.
by Manishearth 6y ago
Servo was never tightly integrated with a sizeable browser project. It shared some components with Firefox, but the only time Servo itself was inside an actual browser release was Firefox Reality for AR. Which still exists, though I'm
22.
by Manishearth 6y ago
So this is the core problem with all of the general relativity materials that model it as a rubber sheet causing curvature in spacetime. They always model it with focus on _spatial_ curvature: which is totally able to model an orbit or a hy
23.
by Manishearth 6y ago
No, not quite, the signature will be `fn foo<'a>() -> &'a u8` (there is no way to elide this) However, Rust lifetimes are stretchy-squeezy, and a free lifetime is basically the same as 'static when it comes to co
24.
by Manishearth 6y ago
I agree, as someone who works on rustc I think it's a significant endeavor to maintain a substantial fork of either Rust or LLVM. (Rust does maintain a fork of LLVM, but it's just a couple minor patches that typically get upstre
25.
by Manishearth 6y ago
The text was changed due to feedback provided elsewhere in this HN page. The blog post was drafted by the core and foundation team, however we did get sign-off from Mozilla on it. Mozilla currently owns the trademarks that the Rust foundati
26.
by Manishearth 6y ago
I want to clarify: The Rust project has been largely "outside" of the Mozilla incubator for quite a while already; with most of the governance being non-Mozilla individuals. The main things Mozilla provided was infrastructure (a l
27.
by Manishearth 6y ago
When it comes to the Rust project: it was already well outside the confines of Mozilla, with an independent leadership team, and with a lot of the infrastructure being run by other companies (Github/Microsoft for CI, Amazon for storage
28.
by Manishearth 6y ago
This does not seem simpler to me, this seems easier to mess up. The most common use case is dropping all fields. Furthermore, you still have to special-case Drop because now you have to support destructive destructuring for Drop types becau
29.
by Manishearth 6y ago
> but Rust's Drop makes the same mistakes as C++: destruction needs to be for consuming data, not borrowing it and mutating it. but Rust's drop isn't for that purpose. It's not for the actual cleanup of the struct and
30.
by Manishearth 6y ago
Yeah this was my biggest fear with edition changes: You can fix live code, but you can't as easily fix existing programmers' mental models, and you can't update all existing online resources. OpenGL has this issue and it suc

More ›