remexre

What attack _would_ be able to get past all the existing mitigations (XOM, random relinking + ASLR, msyscall) and be able to find a single existing syscall instruction but not a particular libc function entrypoint instead?

I could kind of see the value of this if the above mitigations didn't exist, but as far as I'm aware, they're already pervasive on OpenBSD.

https://isopenbsdsecu.re/mitigations/pinsyscall/ for a contrasting opinion

You use it instead of iterate, or instead of tagbody?

IMO iterate is no less a DSL (it's a code-walker!), just one that has a more sexpry flavor

How are namespaces similar to microkernels? I see them a lot more as glorified chroot; it's not like there's a modprobe namespace or anything.

is the list of the natural numbers (0, 1, 2, and so on) real?

is the length of any list real?

Well, I think a dividing line might be that if you put a Chinese Room in charge of a justice system, a corporation, or a regulatory agency, it's gonna do a pretty cruddy job of running it.

Why wouldn't the lower ISA register count lead to more spills, regardless of the physical count? Is store forwarding really that effective?

On AArch64 I think it's cheaper because losing one register doesn't hurt as much, since you've got twice as many.

I'd argue that the difference between a monad and any old type with operations of bind and pure's types is precisely reasonableness -- I can expect Control.Monad.forever to work because the monad laws allow me to reason about monads as an abstraction rather than caring about the precise way the Writer monad might be implemented.

Which static analysis tools do you recommend?

Unless their in-class performance increases as well, isn't that help "probably cheating"? (That's the "moral benchmark" I'd use, at least; if your collaboration resulted in you genuinely learning the material, it's probably not cheating.)

I think the logic is similar to why doctors aren't allowed to "just try stuff" on cancer patients without proper oversight, except on a global scale -- if it turns out a geoengineering project has a much worse second-order effect that wasn't considered, people who didn't get a say in its deployment would be impacted.

I think the selling point for JWTs are that they're a mostly-standardized way to do auth tokens such that you only need to do one very simple and cheap database query (is this a token that has been invalidated but hasn't yet expired) rather than a larger number of database round-trips to implement various authorization checks.

I think this is the OS-level signature verification; so the OS (possibly with nudging) will still allow you to _run_ the binary, but won't say "this is from FooCorp" and may nag the user on startup "this is a potentially untrustworthy binary"

This is https://github.com/jart/blink , not https://chromium.googlesource.com/chromium/src/+/master/thir... btw

SDL does pretty much only the parts you still need after choosing Vulkan or WebGPU (or OpenGL, or anything else); audio, windowing, input handling, etc.

First thing that'd come to mind for me would be replacing the unstriped Vec<Mutex<T>> with some wrapper like:

    struct Striped<T, const StripeSize: usize>(Vec<Mutex<[T; StripeSize]>>, Mutex<tinyvec::ArrayVec<[T; StripeSize]>>);

I think I'd probably want a wrapper either way to ensure I'm always taking locks in a particular order to avoid deadlocks, anyway.

I thought the famous Hobby Lobby SCOTUS case wasn't abortion, it was contraceptive coverage in the health plan?

It sounds like Safe Haskell might be getting deprecated soon [0]; it sounds like it isn't used much in practice...

[0]: https://discourse.haskell.org/t/deprecating-safe-haskell-or-...

Either to implement an interface, or because it branches to check if the value is nil before dereferencing it

But at least formal methods tools can be applied directly to the specification, to show properties like "well, if you carve out this subset of TypeScript, you have something you can safely eval()" or "you can never have type errors with this usage of this construct in this way."

I thought one of the benefits of DoH over DoT was that in the case where an adversary (e.g. a state with Internet censorship) is trying to block DNS access, it's not distinguishable from a normal HTTPS connection, which you can't block willy-nilly without breaking most of the internet.

Tracking of effects would be a big one; compare the number of sandbox escapes in Java to JavaScript to WebAssembly. It's much easier to secure a language without effects, and then slowly add the effects you can sandbox or control than to start with a large effectful language and try and slice bits of it off.

LLVM-based CFI is interesting; does this mean that distros are going to start building kernels with Clang instead of GCC?

Right, but at least anyone could look into it in the company repo, instead of needing to poke at the actual machine (or an image of it)

This is literally a tool for children to use in classrooms to learn about how to respond to their emotions reasonably

Haskell can actually do the "warn if it finds a problem" option: https://downloads.haskell.org/~ghc/7.8.2/docs/html/users_gui...

I've been meaning to write up something comparing dynamic typing + SLIME to -fdefer-type-errors and ghcid...

I thought the common speculation was that they aren't allowed to call it ARM, because they extend the ISA significantly enough that ARM-the-company was concerned it'd fragment the ecosystem.

oh, yeah, I can totally imagine that; this was being built for AArch64 though; with all the Cortex-A features, even!

Sounds like this is intended to run on targets rustc would not support, given the claim that it "does not assume 8-bit addressability".

Also, while I'm fully on board the "Rust as a default userspace systems language," the machine code I've gotten out of trying #[no_std] Rust to write part of a bare-metal project was heinously bloated. This is without even using any non-libcore dependencies! Something like 3/4s of the machine instructions looked like they were related to building error messages for panics, despite the fact that there shouldn't have been any reachable panics (and the code was small and simple enough that I expected LLVM to be able to reason about this without any MIR-level optimizations).

Maybe this would be better on a project that could use rustc as its linker, but based on this, I wouldn't necessarily recommend that a bare-metal library intended to be linked to C and hand-written assembly be written in Rust versus, say, verified with Frama-C or other C-specific tools.