Cloudef

Relying on cloud services is a big liability. I'd think twice before feeding data to these LLM cloud products. If you make them a fundamental part of your product / development / workflow, be ready for the eventual moment the pricing and terms change.

Hello, can you tell me if I can filter syscalls made from a memory address in macos without virtualizing the process, or requiring special entitlements and root? I currently have a project where sandboxing is important and i need to prevent all syscalls from a region. This is very simple in linux, and on openbsd i dont have to do anything because openbsd by default does not allow untrusted callsites from making syscalls (and the region in this case is not loaded by openbsd's dynamic loader).

On macos i currently virtualize the process itself, but this has virtualization overhead and some emulation overhead because macos does not let you map all the host process pages to a guest.

Its opposite. Windows and MacOS lacks proper sandboxing. While openbsd has pinsyscalls and linux has seccomp-bpf. Windows and MacOS only have filesystem and worse version of user namespace sandboxes, anything else and you need to write a kernel extension or rely on a hypervisor.

> Unfortunately implementing an Apple style architecture on Linux would be very difficult.

The apple apps kind of thing already exists and its called flatpak.

I chuckled, but isnt godzilla product of the nuclear aftermatch?

The way simd speeds up "compute" is indeed mainly the reason that you operate on multiple pieces of data at once.

Its possible and boy do i have a youtube channel for you https://youtu.be/ndG-6-vONNc https://youtu.be/8dfgum9XlJc

Apple does not allow running code from internet either (even if interpreted iirc)

That said shipping JIT / interpreter with your program to recompile updates / parts of it sounds silly to me.

Try reading zig code. For me its much more readable than the other languages, and does not suffer the fact go doesnt have language level errors. Local allocators are very useful and if you dont think so, perhaps you havent dwelved too deeply into systems programming or the language isnt targeted for you.

> Secure boot prevents tampering of your kernel and/or bootloader, nothing about Linux prevents this from being possible.

By trusting another chain of trust and firmware binary blobs involved in booting your PC.

Secure boot exists only as one of the puzzle pieces for remote attestation for MS and trusted OEMs, nothing to do with your security.

Quite depends, I had times when my posix emulation of io_uring (with poll, not epoll) was faster than io_uring. For large zero-copy buffers, io_uring is king however. Also io_uring is useful even for non asynchronous IO as it can implement chain of operations as single atomic operation (mkdir + open it for example).

For something like networking, if you are maximizing packets per second, you'll hit kernel limits[1] very quickly and instead have to start leveraging features like GSO/GRO or completely bypass the network stack.

1: https://github.com/axboe/liburing/discussions/1346

Symbian was really awful OS. Nokia's mistake was ignoring Maemo.

Rust unsafe is less safe than writing C code. Rust is not good language for writing "unsafe code". C++ smart pointers are really bad compared to arena allocators, and not allocating at all. It's very easy to end up with dangling references in C++, or double frees with smart pointers. Also the fact that C++ initialization itself is a huge foot gun.

Zig is not only a language. Its whole toolchain and takes freestanding as a target seriously.

Lot but not enough still. Most web tech is like that, almost there but not really. Webaudio prob being the worst one. Webgpu being weird thing that nobody really knows who it is for.

You can let agent churn unattended if you have some sort of known goal. Write a test that should not pass and then tell the agent to come up with something that passes the test without changing the test itself.

For this kind of fuzzing llms are not bad.

Wouldnt that be stackless (shared stack)

You are not wrong and this is indeed what zig is trying to push by making all std functions that allocate take a allocator parameter.

Trusted computing isn't about security. Its about vendors not trusting you.

Why haven't prebuilt PC market been doing this to hide the fact they are using a single RAM stick?

I see. I can not give more insightful answer here then. From personal experience, I've noticed with 0.16 with the std.Io async stuff that you cannot do:

   io.concurrent(foo, .{});

where foo's return type is `error{foobar}!noreturn`, because the compiler crashes when it tries to use that type as a std.Io.Future(T)'s struct field. Might be related or not.

I think rust calls them "zero sized types".

Indeed what was referred to here is the zig build system cache.

AFAIK garbage collection is basically not implemented yet. I myself do `ZIG_LOCAL_CACHE_DIR=~/.cache/zig` so I only have to nuke single directory whenever I feel like it.

0.16 is the development version. 0.15.2 is latest release.

The language itself does not change much, but the std does. It depends on individuals, but some people rely less on the std, some copy the old code that they still need.

> Are there cases where packages you may use fall behind the language?

Using third party packages is quite problematic yes. I don't recommend using them too much personally, unless you want to make more work for yourself.

Very cool

Every paragraph in the article is exactly what LLM produces

I feel safe when claude outputs dd commands that wipe your drive to benchmark disk write speed :)

You can enable error traces for release-fast builds as well, without enabling full debug info. Though the quality of call stack of course vary depending on optimization level.

Note the person behind your link isn't Andrew Kelley