Vincent sgherzi

Britain continuing their long history of leadership in ruining the world

Spill spill spill

Rust in Android: move fast and fix things Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in ...

“We adopted #rustlang for its security and are seeing a 1000x reduction in memory safety vulnerability density ... with Rust changes having a 4x lower rollback rate and spending 25% less time in code review, the safer path is now also the faster one.”

security.googleblog.com/2025/11/rust...

me: "Software owes it to its users to be secure"
HN: "there is no such obligation"

We owe it to the craft to product correct and performant software. We are meant to understand and mitigate risk so others don't have to.

This is the social contract of being a software engineer.

#rustlang

Makes sense, does seem like a difficult task. Maybe once I get better at compilers.

I really wish there was a lighter version that only did like type hints and a broad error at the expense of less ram. Not sure if it’s even possible.

Announcing the Swift SDK for Android Swift has matured significantly over the past decade — extending from cloud services to Windows applications, browser apps, and microcontrollers. Swift powers apps and services of all kinds, and thank...

www.swift.org/blog/nightly...

Gotcha l, I was looking more at this. I haven’t written much swift but I appreciate alot of the ideas esp the cpp interop

I’m really hoping swift can go cross platform as another valid option seems like Apple is interested

A screenshot of a quote tweet from Sequoia partner Shaun Maguire quoting Silicon Valley legends (including Don Valentine, Pierre Lamond, and Mike Moritz) explaining that he has "Sequoia-sized shoes to fill". The quote tweet is an image of Lloyd Bentsen in the 1988 VP debate, immediately before telling Dan Quayle that he is "no Jack Kennedy."

Forgive me, for I have broken my vow to not tweet.

Ima be honest I have no idea, kinda neat tho

Giga mistype 💀

I’m already firmly a REACT hater

Holy mistype of the year
(Edited 3:43 PM via @skeetsapp.com)

Neat!

What’s the iOS one?

Does async rust cause autism? I’m just asking questions.

This is what I’ve been saying. I got gutted for it on HN. I don’t hate dependencies but I do want better solutions.

vincents.dev/blog/rust-de...?

I've done a 180 on supply chain security - I used to think it was mostly a theoretical problem: between communities of mostly good actors, many eyes to review, good policies for announcing vulns and removing crates, and basic due diligence, issues would be found and addressed before doing damage

That sucks :( hopefully it’s not something they end up rejecting just due to the ad blocking concept as a whole. I’ve wanted something like this for a while. Best of luck!

Any idea of when Apple might open something like that up? Looking forward to filter.

SpongeBob screaming yes

TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware | Edera Blog Edera uncovers TARmageddon (CVE-2025-62518), a Rust async-tar RCE flaw exposing the real dangers of open-source abandonware and supply chain security.

edera.dev/stories/tarm...

Impressed that crates io didn’t go down with the whole aws outage. The optimist in my wants to think that it’s redundant across multiple regions

#rustlang

Yep, pretty interesting dialog really makes you think. For a lot of people (myself included) anything crypto is a bit of a black box. If the nsa says it’s good who am I to question it. Anyways a sad series of events.

Thank you for the kind words and the thoughtful response. I'm deeply sympathetic to your viewpoint, and some days I certainly feel like Rust is creaking under its own weight. Why does your typical backend web service need all this complexity with borrows and lifetimes and manual memory management? But allow me to present the other side of the argument. My background is in systems-level developer tools, and Rust has a combination of things that no other programming environment has: * & and &mut, which enforce a rigorous separation between mutable and immutable state. I think this is the single most important feature of Rust, and the closest analog to this in other environments is purely functional languages like Haskell * enums with data + exhaustive pattern matching; the latter is something even Haskell lacks * high-level idiomatic code that performs like low-level code (e.g. iterators): Rust achieves this through an extraordinary combination of monomorphizing and inlining * working in memory-constrained environments: tracing GC tends to have significant memory overhead, and I've worked in server environments where a big limiting factor was the amount of DRAM being produced globally * good polymorphism: I think OOP is a suboptimal paradigm that breaks under day-to-day development stress. I've written about it at https://news.ycombinator.com/item?id=42512629 * fast startup times: this is a requirement for command-line tools people use hundreds of times a day—I spent many years working on Mercurial where Python's slow startup time was a very common complaint * first-class support for using native OS calls directly; many higher-level languages like Java abstract away the details, so things like signal handling are hard to hook into * first-class Windows support: again, non-negotiable for many developer tools, since the plurality of developers are on Windows (cont)

* and last but not least, a great dependency ecosystem, which ties into all of the above points: & and &mut mean that some transitive dependency three levels down won't suddenly alter the list you pass in, idiomatic performance means that perf regressions are rare, first-class Windows support means most dependencies just work on Windows, and so on Is it possible to have an application-level/GCd/managed language that meets most or all of these requirements? Certainly. Does such an application-level language exist today? No, and there's nothing on the horizon either (Haskell has its heart in the right place, but is missing many of the more practical features here). Rust isn't a great application-level language, but it's the best application-level language. And given how high the barrier tends to be for a new language to reach adoption, I'll probably be retired long before something like that shows up. And yeah, async really is quite confusing in so many ways, and it's really unfortunate that this situation has seen no improvements in so many years. And yet, through its characteristics combined with the other things listed here, it enables developers to solve real problems that are completely infeasible in any other language. So I keep trying to make Rust better :)

Why I like and keep working on Rust

It was actually from lobste.rs but same difference

blog.cr.yp.to/20251004-wea...

Yeah there was similar talk recently on HN of agencies purposely promoting weak encryption algs that they already have broken

Hm interesting, it is a little strange that they wouldn’t know at all given how security aware they are (attempting to be?)

We knew about them? Did we do cves or anything or was it just in the know knowledge

Relative crash and segmentation fault reporting frequency in OpenSource projects across four systems programming languages

Went and did a quick data collection on the relative frequency of GitHub issues mentioning "crash" or "sefault"/"segmentation fault" in #Rustlang, #Ziglang, #C++, and #C. Selected 10 most starred repositories that use GH issues. Not the most scientific data selection, but it was fun!

Canonical releases Ubuntu 25.10 Questing Quokka | Canonical The latest interim release of Ubuntu comes with compatibility enhancements at the silicon level, accessibility upgrades and a robust security posture that sets the stage for the next LTS. October 9, 2...

#Ubuntu 25.10 released, switching all basic commands like `ls`, `sudo`, `cd`, `cat`, ... to pure #Rustlang implementations. canonical.com/blog/canonic...