Readit News logoReadit News
deredede commented on Linux Sandboxes and Fil-C   fil-c.org/seccomp... · Posted by u/pizlonator
integralid · 2 days ago
Does it even work with openssh example? Pwning the parser progress will let attacker spoof arbitrary communication, which in case of SSH lets them execute arbitrary commands. Or is there a smart way to work around that?
deredede · 2 days ago
You can send arbitrary commands, but they will be rejected unless you provide valid credentials first.
deredede commented on Cloudflare outage on November 18, 2025 post mortem   blog.cloudflare.com/18-no... · Posted by u/eastdakota
throwaway2037 · a month ago
Your pair of posts is very interesting to me. Can you share with me: What is your programming environment such that you are "fine with allocation failures"? I'm not doubting you, but for me, if I am doing systems programming with C or C++, my program is doomed if a malloc fails! When I saw your post, I immediately thought: Am I doing it wrong? If I get a NULL back from malloc(), I just terminate with an error message.
deredede · a month ago
Not GP but I read "I'm fine with allocation failures" as "I'm OK with my program terminating if it can't allocate (but not for other errors)".
deredede commented on Why I love OCaml (2023)   mccd.space/posts/ocaml-th... · Posted by u/art-w
olivia-banks · a month ago
I’m curious what you mean. Surely there’s the overhead of unpredictable memory access?
deredede · a month ago
Not GP but bump allocation (OCaml's GC uses a bump allocator into the young heap) mitigates this somewhat, list nodes tend to be allocated near each other. It is worse than the guaranteed contiguous access patterns of a vector, but it's not completely scattered either.
deredede commented on Linus Torvalds and the Supposedly "Garbage Code"   giodicanio.com/2025/08/27... · Posted by u/todsacerdoti
Danjoe4 · 3 months ago
> I think Linus should be more respectful of other people

You all need to grow thicker skin. If we're really engineers, we can't dance around criticism. Linus' comment was about the code; he never insulted the developer. If you attach your self worth to the code you write that's your problem.

What would you have him do? Sugarcoat it? "Uh actually sweetie please rework this function it's not quite there".

It's a PR; honest, unbiased feedback on the code (and optionally how to improve it) is the only thing that matters. If the code is garbage then the reviewer needs to say so.

deredede · 3 months ago
You can give honest, unbiased feedback without insulting either people or their work.

Software engineering is a collaborative process, not an adversarial one.

deredede commented on Claude Code: Now in Beta in Zed   zed.dev/blog/claude-code-... · Posted by u/meetpateltech
skhameneh · 3 months ago
I'll take another look but from what I perceived all attempts to start a thread included tool calling in the payload.

I couldn't seem to get any message through without tool calling instructions in the payload. What you're describing sounds exactly like what I attempted.

I tried something like over 6 different variations of model configs with restarts of Zed in-between. The documentation and what Zed tries to configure are different as well. The fields don't match up with the built in type checking. I tried "openai" with the endpoint configured, "openai_compatible", and even "openrouter" hoping the REST signatures would be match well enough. Each configured with various fields to turn tool calling off and every single request that hit the REST server had tool calling.

deredede · 3 months ago
You should have a drop-down for selecting a tool profile next to the drop-down for model selection. Select "Minimal" for no tools.

"New text thread" should also have no tools I believe.

https://zed.dev/docs/ai/agent-panel#profiles

deredede commented on We shouldn't have needed lockfiles   tonsky.me/blog/lockfiles/... · Posted by u/tobr
shadowgovt · 4 months ago
This points to a software best-practice: "Don't leak types from your dependencies." If your package depends on A, never emit one of A's structs.

Good luck finding a project of any complexity that manages to adhere to that kind of design sensibility religiously.

(I think the only language I've ever used that provided top-level support for recognizing that complexity was SML/NJ, and it's been so long that I don't remember exactly how it was done... Modules could take parameters so at the top level you could pass to each module what submodule it would be using, and only then could the module emit types originating from the submodule because the passing-in "app code" had visibility on the submodule to comprehend those types. It was... Exactly as un-ergonomic as you think. A real nightmare. "Turn your brain around backwards" kind of software architecting.)

deredede · 4 months ago
I can think of plenty situations where you really want to use the dependency's types though. For instance the dependency provides some sort of data structure and you have one library that produces said data structure and a separate library that consumes it.

What you're describing with SML functors is essentially dependency injection I think; it's a good thing to have in the toolbox but not a universal solution either. (I do like functors for dependency injection, much more than the inscrutable goo it tends to be in OOP languages anyways)

deredede commented on We shouldn't have needed lockfiles   tonsky.me/blog/lockfiles/... · Posted by u/tobr
tonsky · 4 months ago
One of the versions will be picked up. If that version doesn’t work, you can try another one. The process is exactly the same
deredede · 4 months ago
Alternative answer: both versions will be picked up.

It's not always the correct solution, but sometimes it is. If I have a dependency that uses libUtil 2.0 and another that uses libUtil 3.0 but neither exposes types from libUtil externally, or I don't use functions that expose libUtil types, I shouldn't have to care about the conflict.

deredede commented on We shouldn't have needed lockfiles   tonsky.me/blog/lockfiles/... · Posted by u/tobr
Joker_vD · 4 months ago
> If that version doesn’t work, you can try another one.

And how will this look like, if your app doesn't have library C mentioned in its dependencies, only libraries A and B? You are prohibited from answering "well, just specify all the transitive dependencies manually" because it's precisely what a lockfile is/does.

deredede · 4 months ago
It's not "all the transitive dependencies". It's only the transitive dependencies you need to explicitly specify a version for because the one that was specified by your direct dependency is not appropriate for X reason.
deredede commented on We shouldn't have needed lockfiles   tonsky.me/blog/lockfiles/... · Posted by u/tobr
zahlman · 4 months ago
So you... manually re-lock the parts you need to?
deredede · 4 months ago
Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?
deredede commented on We shouldn't have needed lockfiles   tonsky.me/blog/lockfiles/... · Posted by u/tobr
trjordan · 4 months ago
There is absolutely a good reason for version ranges: security updates.

When I, the owner of an application, choose a library (libuseful 2.1.1), I think it's fine that the library author uses other libraries (libinsecure 0.2.0).

But in 3 months, libinsecure is discovered (surprise!) to be insecure. So they release libinsecure 0.2.1, because they're good at semver. The libuseful library authors, meanwhile, are on vacation because it's August.

I would like to update. Turns out libinsecure's vulnerability is kind of a big deal. And with fully hardcoded dependencies, I cannot, without some horrible annoying work like forking/building/repackaging libuseful. I'd much rather libuseful depend on libinsecure 0.2.*, even if libinsecure isn't terribly good at semver.

I would love software to be deterministically built. But as long as we have security bugs, the current state is a reasonable compromise.

deredede · 4 months ago
What if libinsecure 0.2.1 is the version that introduces the vulnerability, do you still want your application to pick up the update?

I think the better model is that your package manager let you do exactly what you want -- override libuseful's dependency on libinsecure when building your app.

u/deredede

KarmaCake day491November 5, 2021View Original