InsanityBit

Just updated rust deps. Ran `cargo-vet`, got lots of unaudited updates. Spawn an agent for each one with a prompt to review for unsafe or actively malicious dependencies. This took 11 minutes. Perfect? No. But imo a huge win.

I vibe coded a cargo replacement that sandboxes build scripts with wasm, adds a Manifest.toml with cap policies + lockfile so you have to ack changes to dependency sandbox policies, and forces you to ack proc macros (since they can't be sandboxed without rustc help). It pretty much "just works".

I'm not saying this is production worthy, but I think this proves the point pretty well. Package managers can solve a lot of our supply chain issues.

I vibe coded a cargo replacement that sandboxes build scripts with wasm, adds a Manifest.toml with cap policies + lockfile so you have to ack changes to dependency sandbox policies, and forces you to ack proc macros (since they can't be sandboxed without rustc help). It pretty much "just works".

I'd never have the patience for this normally, but I've had claude move basically all of my dynamic content into sandboxed iframes with strict CSPs that have to RPC back to the main page to do anything other than render content. Null origins, no networking, etc.

It's such an aggressive move that I'd normally never be willing to pay the price for, but claude makes it trivial since it's just bespoke boilerplate every time I want to do it. XSS in the sandbox? Don't care.

A very silly but insanely significant advantage to maintaining a Rust codebase is how significantly less likely you are to get "hey please patch this completely stupid CVE" requests every day for CVEs that aren't even valid.

Part of this is just that the Rust ecosystem is pretty solid, but the silly part is a lot of it comes down to the Rust ecosystem just not having a ton of people issuing CVEs for it. Regardless, you benefit massively on ops overhead for a rust codebase.

Decades later and Linux security is still a fucking joke; www.kroah.com/log/blog/202...

Absolutely insane what kind of performance opportunities there are when you replace strings with integers. Especially 32bit integers.

Literally 1000s of times faster for so many operations, with 10x space savings easily, and even better if you can shave a few bits off.

lwn.net/SubscriberLi... "When Git was released, SHA-1 was considered to be a secure hash function" ahahaha. Wow. Revisionist history is really something else. Thankfully it's trivial to verify that this is nonsense. Linus chose the unsafe option out of hubris and ignorance.

> It requires a lot of compute, about 110 years worth of single-GPU computations This is not that much compute

Someone add Linus's face to the to and idk Claude or whatever to the bottom

I don't get why I would bother with this lol gist.github.com/MostAwesomeD... Maybe someone who's in a more "influencer" space might. But "I am tired of hearing the fallacious claim that [...] those same chatbots are able to develop any software whatsoever." is obviously true to me so who cares?

Inability to trivially mock in Rust is a real problem. Similarly, inability to assert things like "a method was called N times" etc. This would be invaluable for formally verifying some aspects of my algorithms (ie: optimizations that ensure O(N) etc) via properties of tests.

In general the Rust community says that mocking is just bad, that these test patterns are bad, etc. I think it's just totally wrong. I've caught bugs in other languages because I could trivially mock.