Just updated rust deps. Ran `cargo-vet`, got lots of unaudited updates. Spawn an agent for each one with a prompt to review for unsafe or actively malicious dependencies. This took 11 minutes. Perfect? No. But imo a huge win.

Greg is so fucking dumb github.com/cisagov/vuln...

Request: Exclude kernel.org CVEs from CVSS/CWE enrichment · Issue #262 · cisagov/vulnrichment

We intentionally don't include CVSS scores or CWE identifiers in kernel.org CVEs, and we'd appreciate it if CISA's ADP stopped adding them. The kernel is used in everything from phones to supercomp...

github.com

I vibe coded a cargo replacement that sandboxes build scripts with wasm, adds a Manifest.toml with cap policies + lockfile so you have to ack changes to dependency sandbox policies, and forces you to ack proc macros (since they can't be sandboxed without rustc help). It pretty much "just works".

A lot of these supply chain issues could have been solved by package managers using any number of well known, well understood techniques that have been suggested a million times. Instead we're going to get "dependency cooldowns" lol

I hate that "FROM" comes after "SELECT" in sql. :[

sccache thinking it can get away with 10GB lol, off by about 10x there

Does anyone know how DLSS5 works? I don't. Is it just a generic "filter" like from Snapchat or whatever? Or is it more like a tunable feature where devs can target it/ configure it?

Line Goes Up? Large Language Models are Poor General Reasoners jamesfodor.com/2025/06/22/l...

Line Goes Up? Large Language Models are Poor General Reasoners

Introduction The recent development of large language models (LLMs) based on the transformer architecture has led to extensive discussion as to how to best measure their capabilities. The most comm…

jamesfodor.com

cdn2.qualys.com/advisory/202... It is very nice to read something like this and stumble upon work we did at Grapl. Valentina's exploits were genuinely stellar, it's always nice to see that work get referenced.

cdn2.qualys.com/advisory/202... > Last-minute note: unfortunately, no CVEs have been assigned to these vulnerabilities yet, because "CVEs are assigned after-the-fact" Linux security remains a joke.

Having a very good time with Apache DataFusion. datafusion.apache.org I was skeptical that it could incorporate some optimizations I've been working on, but nope, I've managed to fit them all in and now I get SQL "for free".

I'd never have the patience for this normally, but I've had claude move basically all of my dynamic content into sandboxed iframes with strict CSPs that have to RPC back to the main page to do anything other than render content. Null origins, no networking, etc.

Someone needs to be brave and just start producing JSON parsers that produce/consume JSON with trailing commas. I don't care if everything breaks, enough is enough.

A very silly but insanely significant advantage to maintaining a Rust codebase is how significantly less likely you are to get "hey please patch this completely stupid CVE" requests every day for CVEs that aren't even valid.

Switching hash algorithms in Rust is such an easy win. 40% performance improvement on one of my project's benchmarks.

Decades later and Linux security is still a fucking joke; www.kroah.com/log/blog/202...

Linux CVE assignment process

As described previously, the Linux kernel security team does not identify or mark or announce any sort of security fixes that are made to the Linux kernel tree. So how, if the Linux kernel were to be...

kroah.com

Absolutely insane what kind of performance opportunities there are when you replace strings with integers. Especially 32bit integers.

LLMs are definitely going to kill HN. I don't see how it'll survive with the bots signing up.

Very frustrated again that the best algorithm that's available with FIPS is AES-256-GCM. I really dislike this.

do i know anyone who works at azure that can get me access to horizondb? i can elaborate more in dms if needed.

lwn.net/SubscriberLi... "When Git was released, SHA-1 was considered to be a secure hash function" ahahaha. Wow. Revisionist history is really something else. Thankfully it's trivial to verify that this is nonsense. Linus chose the unsafe option out of hubris and ignorance.

It pains me when I hear people say "I thought about submitting a talk to the fwd:cloudsec, but didn't because..." and the reasons are often things I actually want to see presentations on! Some talk ideas I personally want to watch (the other reviewers and I will fight ⚔️):

Someone add Linus's face to the to and idk Claude or whatever to the bottom

Wish there were a way to know if a crate author is using non-phishable 2FA :C

I really wish Rust crates had binary distributions. Compile times are still an order of magnitude too slow.

I don't get why I would bother with this lol gist.github.com/MostAwesomeD... Maybe someone who's in a more "influencer" space might. But "I am tired of hearing the fallacious claim that [...] those same chatbots are able to develop any software whatsoever." is obviously true to me so who cares?

Lobsters Vibecoding Challenge (Winter 2025-2026)

Lobsters Vibecoding Challenge (Winter 2025-2026). GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

I stopped paying attention to the rust subreddit for years. Looking at it lately, it's absolute dogshit. Is this just fallout from so many rust devs moving to other forums/ leaving the community? It's a bad look to have it suck so hard.

Quick quiz: how many people in S.F. were killed by Waymos this week? How many people in S.F. were killed by human drivers this week? (The answers are zero and two, but no one would know that from the reactions today.)

Github Actions was bad on release and hasn't really improved since then. Moving to depot is 30 seconds of work and will give you 10x performance, radically better UX, and 50% of the cost. I have no idea what bonehead thought that GHA should fuck with pricing right now.

Inability to trivially mock in Rust is a real problem. Similarly, inability to assert things like "a method was called N times" etc. This would be invaluable for formally verifying some aspects of my algorithms (ie: optimizations that ensure O(N) etc) via properties of tests.