Informatik Student, lerne 日本語, Strategiespiele

Migrated to [email protected] due to feddit.de having various errors for a longer period now.

  • 0 Posts
  • 81 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle






  • This is a question too complex for a Lemmy thread, here are some thoughts.

    1. Being a net positive will make things better, per difinition. That’s what everyone of us can do, regardless of what you are doing. Of course this requires a reasonable process of deciding what’s right, so take a look at the next point.

    2. Think. To think is naturally the greatest skill of any human. Our intelligence has been key since we started civilisation. Think about everything, be critical about any ideas. Only ideas supported by facts can be good ideas. This is how you find the stuff that makes your life worse. Does your city need to be designed like this? Does a omnipotent being make sense? Do I need to slack off today?

    3. Unrelated, but working together with others is beneficial to everyone. Cooperation is what got us so fary and what will bring us beyond the stars. One thing I want to point out specifically is that world federalism, albeit hard to achieve, is a worthwhile end goal.








  • Besides software mentioned by others:

    NeoVim: The single most perfect editor of all time.

    QOwnNotes: A pretty good note taking app for markdown notes with tons of extension and options. But tbh Obsidian is still the gold standard.

    SSH: It’s everywhere. Controlling my servers from remote is a trivial task. Also, it does tunneling.

    Syncthing: Syncing files around has never been easier than with syncthing. And it’s decentralized, encrypted, private.

    Kitty: A great Terminal Emulator






  • Analyzing without running might lead to bad situations, in which code behaves differently on runtime vs what the compiler / rust-analyzer might expect.

    Imagine a malicious dependency. You add the thing with cargo, and the rust analyzer picks it up. The malicious code was carefully crafted to stay undetected, especially in static code analysis. The rust analyzer would think that the code does different things than it actually will. Could potentially lead to problematic behavior, idk.

    Not sure how realistic that scenario is, or how exploitable.


  • I don’t think this is a problem with proc macros or package managers. This is just a regular supply chain attack, no?

    The way I understand it, sandboxing would be detrimental to code performance. Imagine coding a messaging system with a serve struct, only for serde code to be much slower due to sandboxing. For release version it could be suggested to disable sandboxingy but then we would have gained practically nothing.

    In security terms, being prepared for incidents is most often better than trying to prevent them. I think this applies here too, and cargo helps here. It can automatically update your packages, which can be used to patch attacks like this out.

    If you think I’m wrong, please don’t hesitate to tell me!