auxiliarymoose

Communicating with a SQL driver by concatenating strings containing user input and then evaluating it? wat?

I'm very interested in what tech stack you are using where this is a problem.

How can user input be unsafe on the server? Are you evaluating it somehow?

User-generated content shouldn't be trusted in that way (inbound requests from client, data fields authored by users, etc.)

If you sanitize on the server, you are making assumptions about what is safe/unsafe for your clients. It's possible to make these assumptions correctly, but that requires keeping them in sync with all clients which is hard to do correctly.

Something that's sanitized from an HTML standpoint is not necessarily sanitized for native desktop & mobile applications, client UI frameworks, etc. For example, with Cloudflare's CloudBleed security incident, malformed img tags sent by origin servers (which weren't themselves by themselves unsafe in browsers) caused their edge servers to append garbage (including miscellaneous secure data) from heap memory to some requests that got indexed by search engines.

Sanitization is always the sole responsibility of the consumer of the content to make sure it presents any inbound data safely. Sometimes the "consumer" is colocated on the server (e.g. for server rendered HTML + no native/API users) but many times it's not.

Or maybe rot26 — I've heard it's twice as secure as rot13!

My understanding is that this one is "verifiable" which means you get a reproducible result (i.e. consistent result comes out of a computation that would take much longer to do classically).

Non-verifiable computations include things like pulling from a hard-to-compute probability distribution (i.e. random number generator) where it is faster, but the result is inherently not the same each time.

From the article:

> in partnership with The University of California, Berkeley, we ran the Quantum Echoes algorithm on our Willow chip...

And the author affiliations in the Nature paper include:

Princeton University; UC Berkeley; University of Massachusetts, Amherst; Caltech; Harvard; UC Santa Barbara; University of Connecticut; UC Santa Barbara; MIT; UC Riverside; Dartmouth College; Max Planck Institute.

This is very much in partnership with universities and they clearly state that too.

Keep in mind that Theo said the Vanilla benchmark was running too fast so he made it "way way slower" so 4x is not representative of a direct comparison

https://youtube.com/clip/UgkxvcydgHKf-76rZasr0ykMZZol57apKp9...

Yeah it bothers me to no end with the "engineering"-inflation of various jobs.

Like, I'm definitively not an engineer, nor does my day job really involve engineering, yet my title contains Engineer! I'm a proud CRUD monkey and designer.

I have done engineering work previously when developing hardware, and it's really a different mindset (even in an agile & fast-moving engineering org). Safety, cost, reliability, multidisciplinary integration, etc. just don't really come up in a lot in web and app development (which is a wonderful thing, really—I love it!)

Here is an alternative vanilla approach that uses a single-file/single-class-declaration custom element without Shadow DOM: https://jsfiddle.net/auxiliarymoose/tcgk1Ljv/98/

Usually I write a few helper functions to streamline working with elements, attributes, and registration of element + CSS. But even without those, I think this approach provides a good level of simplicity without introducing libraries or frameworks.

Yeah, I have to admit I don't really understand the need for front end frameworks in 2025 with how fully featured vanilla JS and CSS are.

With web components and a little bit of good architecture you can sidestep most front-end complexity. And server-side rendering dramatically simplifies state, because your state is now the database.

With WebUSB, you can program a microcontroller without needing to install local software. With Web Bluetooth, you can wirelessly capture data from + send commands to that microcontroller.

As a developer, these standards prevent you from needing to maintain separate implementations for Windows/macOS/Linux/Android.

As a user, they let you grant and revoke sandbox permissions in a granular way, including fully removing the web app from your computer.

Browsers provide a great cross-platform sandbox and make it much easier to develop secure software across all platforms.

WebUSB and Web Bluetooth are opt-in when the site requests a connection/permission, as opposed to unlimited access by default for native apps. And if you don't want to use them, you can choose a browser that doesn't implement those standards.

What other platform (outside of web browsers) is a good alternative for securely developing cross-platform software that interacts with hardware?

There are definitely legitimate reasons—for example, a browser-based CAD system communicating with a 3D mouse.

The phone is ringing—Java Applets called B-)

The article discusses how that turns into an infinite loop and causes a hang.

When you subtract a small float from a very large float, the value doesn't change. This is because the "steps" between float values increase with the size of the value (i.e. floats have coarser resolution for larger magnitudes)

To see this in action, try running the following in a JavaScript interpreter:

console.log(1_000_000_000_000_000_000 - 1);

This was touched on in the video a little bit—essentially, the TypeScript codebase has a lot of polymorphic function calls, and so is generally hard to JIT optimize. JS to Go therefore yielded a direct ~3.5x improvement.

The rest of the 10x comes from multi-threading, which wasn't possible to do in a simple way in the JS compiler (efficient multithreading while writing idiomatic code is hard in JS).

JavaScript is very fast for single-threaded programs with monomorphic functions, but in the TypeScript compiler's case, the polymorphic functions and opportunity for parallelization mean that Go is substantially faster while keeping the same overall program structure.