ratmice

I couldn't agree with you more, the thing is our underlying security models are protecting systems from their users, but do nothing for protecting user data from the programs they run. Capability based security model will fix that.

I wasn't able to google it, or find a public link to the email (but it was posted on a public list) so here is some relevant snippets from it.

Nov 20 2022 titled CapROS status

"When I retired a year ago I hoped to correct some of those issues, but I want to enjoy retirement and not just have a full-time unpaid job.", ...

"I am considering just abandoning CapROS. I believe there are some useful ideas in the system, but so far no one seems to have known or cared about them."

Yeah, I did see a email on a capabilities list from him about him no longer working on it because of lack of feedback & wanting to just enjoy his retirement. That was the impression I got.

When he had resumed his work on it, I personally had been going through a back injury. I still feel bad that I didn't get a chance to contribute any of the hardware ports and software I wrote for it.

I'd also note capros doesn't fit that description either. I don't know that there were examples that ran more than a single process.

That's probably not true, for anything relying on drivers since user mode drivers are basically processes there... but in the way that people might think of a process.

I wish he had just said 50 years of LCF, since he even mentions automath in the article but that was but that was late 60s

Presumably unsigned want to return errors too?

Edit: I guess they could get rid of a few numbers... Anyhow it isn't a philosophy that is going to get me to consider nimony for anything.

Presumably since this language isn't C they can define it however they want to, for instance in rust std::i32::MIN.wrapping_sub(1) is a perfectly valid number.

that all integers are either even or odd, and that for an even integer that integer + 1 and - 1 are odd and vice versa for odd numbers. That the negative numbers have an additional digit from the positive numbers ensures that low(integer) and high(integer) have different parity. So when you wrap around with overflow or underflow you continue to transition from an even to odd, or odd to even.

Without the low int the even/odd theorem falls apart for wrap around I've definitely seen algorithms that rely upon that.

I would agree, whether error values are in or out of band is pretty context dependent such as whether you answered a homework question wrong, or your dog ate it. One is not a condition that can be graded.

My feeling is that languages with other packing models are merely less convenient, and there is no actual tangible difference security-wise. Just take C and replace "look for writable repositories". It just takes more work and is less uniform to say write a worm that looks for writable cmake/autoconf and replicate that way.

What would actually stop this is writing compilers and build systems in a way that isolates builds from one another. It's kind of stupid that all a compiler really needs is an input file, a list of dependencies, and an output file. Yet they all make it easy to root around, replicate and exfiltrate. It can be both convenient and not suffer from these style of attacks.

Seems doubtful, given that generics and the gccgo compiler were both spearheaded by Ian Lance Taylor, it seems more likely to me that him leaving google would be a more likely suspect, but I don't track go.

> * With a great non-political community (actually, this is the biggest lie of all).

I recall the opposite, that the rust language (before the foundation) position was that being apolitical was a political stance. This is not the exact message I remember https://x.com/rustlang/status/1267519582505512960 and also can't realistically cover the entire community at large, as if that even has a single political stance.

The thing I love most about wezterm is the `wezterm cli list --format json`, and being able to get various values like the cwd of any terminal by window id. While I don't much tweak my actual wezterm config at all. I use that a lot for various scripts to launch other terminals/file managers in the same directory as the currently active terminal...

What I find funny about your argument is how completely degraded fair use has become when using anything by a corporation capable of delaying and running up legal fees. It sure feels like there are a separate set of rules.

As far as I'm concerned the problem isn't that one is easier than the other. It's that in the github case it completely routes around the git client. With AGit+gitea or forgejo you can either click your "create pull request" button, or make a pull request right from the git client. One is necessarily going to require more information than the other to reach the destination...

It's like arguing that instead of having salad or fries on the menu with your entree they should only serve fries.

I doubt this hypothesis, because duckdb written in c++ should be able to tolerate memory failure, while this written in rust has to deal with rusts memory allocation failures are panic's behavior.

That is to say that if the issue is duckdb running out of memory, it is most likely because the rust implementation is using memory more efficiently for whatever query is crashing duckdb, rather than graceful handling of memory allocation failure.

Where it is possible in c++ to gracefully handle memory allocation failure, it is not really a thing in rust I'm not even sure whether it is possible to catch_unwind it. I say this as a rust person who doesn't fancy c++ in the slightest...

One thing worth pointing out here is you that when reading you rarely will actually find the bug that you set out to, undoubtedly you'll notice others. Because you're reading the code with a mindset of "what awkward conditions failed to be handled appropriately such that xyz could happen".

It is also valuable to both form a hypothesis of how you think the code works, and then measure in the debugger how it actually works. Once you understand how these differ, it can be helpful in restructuring the code so it's structure better reflects it's behavior.

Time spent reading code is almost never fruitless.

Another thing about bytestream oriented interfaces like pipes is they tend to turn every program into a parser in order to reject invalid input. Eventually someone is just going to put a type system on top of that parser to reject more than just syntactically valid programs, but also semantically invalid ones.

As such this notion that "we don't need types, we can have parsers." kind of argument doesn't feel very inspiring.

My project hasn't really gotten to the level of actually exporting data to any database yet, but basically I'm just using standard openstreetmap data exported to geoparquet format.

That is then combined with a bunch of time series sensor readings combined with a gps data, (I'm basically still working on the device firmware so I don't have any actual data export happening yet)...

But it is a pretty basic combination of timeseries and geospatial data.

Cool, curious if there is any willingness or interest in adding a geoarrow feature, or generally some form of integration with that crate? (Though to be honest I'm not currently clear up to date on the stability/usability of geoarrow at this current point in time)

It just seems like a bad definition (or at least ambiguous), it should say "cannot", or some such excluding term. By the definition as given if a program flips a coin and performs an illegal memory access, are runs where the access does not occur memory safe?

If I'm not mistaken, gitoxide is attempting to not only be feature complete, but also the fastest. Both of which reduce development velocity

So, if he had invoked go for you would it be a compiler? Another definition is that it translates a source language into a target language.

This is very much reminiscent of "rights amplification" and "synergy" in the capability security model, where historically one of the physical manifestations of this is that of the can + can opener which combine to reveal the contents of the can.

Personally I'm extremely curious to hear about legal examples of the same, if you can provide tangible ones!

These days I would prefer it say that the documentation for communication protocols and for any computer control interface or network functionality must supplied and destination any addresses configurable by the user.

Generally yes, but there are things like lalrpop which are pure rust, I personally fall within the pure rust build.rs user purview...

> with cargo you praise the absences: there’s no gotchas, no footguns, no lore you have to learn in anger, no weirdness, no environment variables

Suppose the author doesn't use build.rs, which appears to have been composed of the listed things almost entirely.

I notice that cp437 has enspace, so I wonder if enspace combined with the "small house", is used to indicate the insertion point, or position between two characters when producing error messages.

FWIW, I like that you include water content, libraries like google's health connect seem to have completely separate data structures for nutrition and hydration.

Fairly surprised there was no mention of nitrogen fixation in the article.