landr0id

I would assume that the tracking number has the address details tied to it (I mean, based on support claims with USPS it definitely does), but maybe there's some obscure package type where destination is not distinct and they abuse that in a pool with other sellers, then at the last mile it gets sorted appropriately?

Seems wild that this market even exists considering how USPS flat rate postage exists.

Was your package something heavy or extremely light which makes weight-based shipping more economical?

It's a patch gap, plain and simple. Removing the sandbox certainly did not help things.

"But it adds motion" was the classic reply.

As others pointed out it's also useful for e.g. click/spam farms which need a "real" iPhone.

https://blog.rust-lang.org/2026/02/13/crates.io-malicious-cr...

Not having an advisory INSTANTLY available isn't a sign of a decaying org. Chill.

I'll do you a favor though and cite a few things related to "lobbying"

The White House put out an RFI regarding open-source security: https://bidenwhitehouse.archives.gov/wp-content/uploads/2024...

Rust foundation's response: https://www.regulations.gov/comment/ONCD-2023-0002-0045

Neither have anything to do with making "programming in C illegal".

Just to add to this, on Windows for example you're really only supposed to invoke syscalls via ntdll as the syscall table is not stable so their numbering changes over time. You cannot guarantee forward or backward compat if you do not use the library.

If you look at some of the syscalls in https://github.com/j00ru/windows-syscalls, you can see they clearly do change over time too.

Here's the code: https://codeberg.org/ziglang/zig/src/commit/e44e927d33d37c44...

The closest callout in the doc comment is:

>Never reuses memory addresses, making it easier for Zig to detect branch on undefined values in case of dangling pointers. This relies on the backing allocator to also not reuse addresses.

But it's not really clear what this means. "branch on undefined values" would I think indicate that maybe they're doing a fill pattern that the compiler can detect at runtime when dereferenced? But I don't see it in the `free` path. It's not clear if this is deterministic or not either.

To clarify, is that to say that you have to use the `std.heap.page_allocator` as its backing allocator?

I don't know Zig so maybe they know something I don't, but I have seen no evidence that it catches any type of use-after-free including double-free?

While writing a blog post (below) I went through the documentation to figure out the possible runtime memory safety checks Zig can insert. The term "use-after-free" or "UaF" never occurs on that documentation page. Searching for "safety-checked" doesn't yield any related hits either.

Unless maybe they're using the DebugAllocator in release builds? Even that does not reliably surface UaF.

https://landaire.net/memory-safety-by-default-is-non-negotia...

The company itself had crazy production delays on both the Nomad and the Knob1, and seem to depend on hypebeast marketing. For $400 you would expect a very premium product and it's easy to argue that they missed the mark pretty hard.

Oh I also placed a pre-order and they refused to cancel after many delays. Unfortunately after that point it was too late for a chargeback.

*just found a random review if you want to see other opinions. The comments discuss some of the weird company shenanigans: https://old.reddit.com/r/MechanicalKeyboards/comments/1ngka3...

The Nomad [E] might be one of the worst keyboards I've ever purchased, and I owned one of the original butterfly switch MacBooks.

>Treat tests as cattle, not pets. Detect and terminate slow tests.

Not sure saying, "hey, treat your tests as an animal you can kill at will" paints the right image.

The screenshot in this repo is kind of similar to wallhacks, but you could imagine this could easily be extended to show dropped items and the 3D audio location: https://github.com/ryanjpwatts/esp-analysis

>CS2FOW uses static baked map geometry. Dynamic occluders such as doors, breakables, props, smokes, particles, and projectiles are intentionally out of scope for now.

Market window on Mirage just became more powerful on these servers :)

Very cool project nonetheless.

Thank you for pulling up the references.

What drove me crazy though was the escape key. They later added the physical escape key back but I think at that point it was a bit too late.

I wrote a blog post about this recently: https://landaire.net/reverse-engineering-with-ai/

Just yesterday I completely reverse engineered several proprietary audio codecs from a game without even having to touch the static analysis tool myself.

1. No strong stack protectors.

2. No kASLR.

That's 20-year-old exploit methodology.

For local attackers there may be easier avenues to leak the ASLR slide, but for remote attackers it's almost universally agreed it significantly raises the bar.

>I don't think it's reasonable to say that an OS that lacks it isn't "serious" about security.

When they implemented it in 2019 it had been an 18-year-old mitigation. If you are serious about security, you implement everything that raises the bar. The term "defense-in-depth" exists for a reason, and ASLR is probably one of the easiest and most effective defense-in-depth measures you can implement that doesn't necessarily require changes from existing code other than compiling with -pie.

It's basically like building a website with div and basic CSS.

gpui-component exists: https://github.com/longbridge/gpui-component

Up until sometime late 2025 GPUI wasn't even on crates.io, and it seems like the GPUI-component ecosystem still promotes using git deps. It was also in "read the code for docs" state for a very long time

It's been a while since I've used it, but there were weird things missing too like the Scollbar was located in Zed's UI component crates instead of core GPUI. Arbitrary text selection also is not possible, which is something I really value about egui.

Iroh's protocol can figure out if the devices are on the same LAN and avoid going over the internet. It can work without a discovery server too -- i.e. completely LAN.

The problem was I think something to do with like the number of git objects that it was scaling to causing crazy server load or something. I don't remember the technical details, but definitely something involving the scale of git objects.

Fun story: I don't really know what Microsoft's server-side infra looked like when they migrated the OS repo to git (which, contrary to the name, contains more than just stuff related to the Windows OS), but after a few years they started to hit some object scaling limitations where the easiest solution was to just freeze the "os" repo and roll everyone over to "os2".