exyi

5 ms·

1.
by exyi 3mo ago
You know that prompt injection is a thing, right? Giving opencode access to bash and malicious input is not very far from piping it right into bash.
2.
by exyi 4mo ago
Exactly. Although if you do >> 8 while working with uint8, it will be the fastest :)
3.
by exyi 4mo ago
It's 3 cycles for float multiplication (and 1 for shift right): https://uops.info/table.html?search=mulss&cb_lat=on&cb_tp=on... https://uops.info/table.html?search=shr&cb_lat=on&cb_tp=on
4.
by exyi 4mo ago
Then you also have to auto-update the containers, if it's a public facing service. Either you'll have to build containers yourself or hope the developer pushes a new update whenever the base image has relevant security fixes.
5.
by exyi 4mo ago
VSCode extensions often contain binary blobs, so it won't catch basically anything. It would also be a bit expensive.
6.
by exyi 4mo ago
At least my password won't leak as often with yubikey, but the attacker can still hack my shell to execute fake sudo. Even if I type /bin/sudo explicitly, there is ptrace, LD_PRELOAD or just replacing the entire bash binary.
7.
by exyi 4mo ago
Ok, so the malware runs a keylogger / clipboard logger, gets the password and runs sudo on it's own. Or replaces your shell by putting exec ~/hackedbash into your bashrc Password on sudo is only useful if you detect the infec
8.
by exyi 5mo ago
Whitelisting also quite likely doesn't work ("of course I will allow my agent to run find, that can do no harm")
9.
by exyi 5mo ago
Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. Also hash matching is so easily bypassed you can be sure they really want to add some "AI" detector as well
10.
by exyi 6mo ago
and cross-platform UI
11.
by exyi 6mo ago
Do you know if there is override this specifically when I want to install a security patch? UV just claims that package doesn't exist if I ask for new version
12.
by exyi 6mo ago
Except that LiteLLM probably got pwned because they used Trivy in CI. If Trivy ran in a proper sandbox, the compromised job could not publish a compromised package. (Yes, they should better configure which CI job has which permissions, but
13.
by exyi 6mo ago
If you change this you break a common optimization: https://github.com/python/cpython/blob/3.14/Lib/json/encoder... Default value is evaluated once, and accessing parameter is much cheaper than
14.
by exyi 6mo ago
Every sane approach to security relies on checking you are doing permitted actions on the server, not locking down the client.
15.
by exyi 7mo ago
Python does not need that, as it has built-in type annotation support. The annotation is any expression, so you can in theory express anything a custom type-only language would allow you (although you could make it less verbose and easier t
16.
by exyi 8mo ago
... or they teached GPT to use em-dashes, because of their love for em-dashes :)
17.
by exyi 8mo ago
Ok, run the same prompt on a legitimate bug report. The LLM will pretty much always agree with you
18.
by exyi 8mo ago
Local would imply the date is in the current machine timezone, while PlainDateTime is zoneless. It may be in the server timezone, or anything else. The main difference is that it does not make sense to convert it to Instant or ZonedDateTime
19.
by exyi 8mo ago
Only until you work with a type array (Int32Array, Float64Array, etc), then it becomes 10x slower: https://jsperf.app/doyeka/11
20.
by exyi 9mo ago
Usually yes, but it's still a neat trick to be aware of. For interpreted scripting languages, parsing can actually be a significant slowdown. Even more so when we start going into text-based network protocols, which also need a parser
21.
by exyi 10mo ago
The point is that a good library usually exists for some language, which is not necessarily the one you are currently using. IMHO, we don't lack good libraries in XY, we are lacking good interop. Going through REST or stdio is quite
22.
by exyi 11mo ago
C# portable SIMD is very nice indeed, but it's also not usable without unsafety. On the other hand, Rust compiler (LLVM) has a fairly competent autovectorizer, so you may be able to simply write loops the right way instead of the fancy
23.
by exyi 1y ago
The protocol must support it somehow already, as some bridges can send custom emojis from other platforms
24.
by exyi 1y ago
Everyone I know of will try to click "reject all unnecessary cookies", and you don't need the dialog for the necessary ones. You can therefore simply remove the dialog and the tracking, simplifying your code and improving you
25.
by exyi 1y ago
I know about netcoredbg, but I did not have much success using it. If we count this as the C# debugger, then the tooling quality is not comparable to other mainstream languages like Scala, D or Julia. JetBrains have their own closed debugge
26.
by exyi 1y ago
Kotlin did not have open LSP, C# still does not have an open debugger. The C# VSCode extension works in Microsoft's build of VSCode, not when someone else forks it and builds it themselves.
27.
by exyi 1y ago
Then you are back to what the article discusses. Each integer is in a separate box, those boxes are allocated in one order, sorting the array by value will shuffle it by address and it will be much slower. I tested this as well, see the oth
28.
by exyi 1y ago
I guess it depends on how deep you want to go, I think the real predictors are based on publicly known algorithms such as TAGE. This seems to be nice overview: https://comparch.net/2013/06/30/why-tage-is-the-b
29.
by exyi 1y ago
I don't know how large are those boxes, but normal CPU L1 cache has 32 or 48KB which should be plenty for this. Python opcodes for this program are going to be tiny, and the interpreter itself uses the instruction-L1 cache (which is an
30.
by exyi 1y ago
It corresponds to a way more than one branch at instruction level. The branch prediction AFAIK does not care based on what are you branching, it just assumes branches will go in similar sequences as they did last time. If the Python 'i

More ›