• 0 Posts
  • 34 Comments
Joined 1 year ago
cake
Cake day: September 2nd, 2023

help-circle










  • Instead of checking if debug assertions are disabled, you should use debug assertions, it would make the code much neater.

    If you wanna eliminate the borrow checker this way, I guess you could use raw pointers instead of references, and have debug assertions to check if those pointers are null. At that point you’d have a mix of C and Rust. The memory would be completely unsafe (you’d have to allocate mostly on the heap, and drop it manually), but you’d have rusts’s type system. You’d also lose a lot of ergonomics though.

    EDIT: just to be clear. I think completely disabling the borrow checker this way is absolutely nuts. Maybe you could have some raw pointers in troublesome locations (where RC/RefCell would have too big of a performance impact for a 144fps game). But most of the code should be borrow checked, since the borrow checker only gets in your way sometimes. It’s not like lifetimes go away with the borrow checker, you still have to think about lifetimes if you manually manage your memory.


  • Hardware doesn’t need to be too weird. Back when I bought my laptop, it was a kinda recent model so most of its features didn’t work in Ubuntu (I say Ubuntu because it’s the distro that worked best. Tried many others and they had even worse support). After a year or so it worked mostly, except some things.

    To this day, 4 years later, the display brightness control still doesn’t work correctly.

    I don’t think hiding the problems do any good. The Linux desktop/laptop experience is not good, specially for non-programmers. It’s usable, but not good.






  • Java I don’t know enough of to say. I never use dependencies in java because I can’t be bothered to learn Gradle/maven/eclipse/whatever.

    Python I completely disagree. First, I believe all (non-python) libraries are distributed as binaries, no local compilation at all. Which makes the issue of the content not matching GitHub even worse.

    Secondly, python is used as a glue language. Most of the time, it’s just a way to interact with bindings to a C library. There’s no big project that uses only the standard library.

    Lastly, in python, whatever you want to import doesn’t always match the pip install command. In your code you might say “import MyAwesome69”, but the command to install it is “pip install awesome lib”. Any malicious actor would just need to publish a python library called “myawesome69” and it would get many people trying to install “awesomelib”. You have to know the magic words to install each library. And projects rarely tell you how to install dependencies. Requirements.txt is a joke (if you want to automatically create it, it puts every single installed library on your machine/venv, not just the ones used in your project), but you’ll be grateful if the project you want to run provides one. Also, nobody distributes python programs as executables, which means everyone who wants to run it must know the magic words, not just the developers. Moreover, not all dependencies are available through pip. The install instructions might say “install awesomelib”, but when you “pip install awesomelib” you pull a malicious library instead of installing the actual awesomelib available via “sudo apt install awesomelib”

    I don’t usually use libraries in my python scripts, but that’s because I use it as a scripting language, they rarely reach 300 loc. If you want to use tl make an actual program. You’re gonna pull a lot of dependencies.

    C++, like java, I can’t speak of, because installing a library was such a pain in windows without Visual Studio that I was never able to. Might explain why they don’t use many libraries.


  • It is true that having many dependencies is supply chain attack. However, this is the result of combining the following:

    • The UNIX mantra of “do one thing, and do it well”
    • The more things a program does, the more intuitive and useful it is.

    If you want to keep the 2, you’re gonna need a lot of dependencies. To significantly decrease the amount of dependencies you’re gonna need to drop one of those, there’s no other way around it.

    If you wanna know what happens when you drop the UNIX mantra look at any discussion about systemd.

    If you drop the second one, everybody would have to bring their own glue. Making computers only accessible to Linux gurus that master the “|” operator and study CLI program arguments in their spare time.

    I don’t know why this article focuses on rust specifically. Every language has this problem. And cargo itself has many ways to mitigate this.

    • Lockfiles & caches: prevents unwanted version updates.
    • Custom registries: You don’t have to use crates.io, that’s just the default. Set up your own registry with only whitelisted crates.
    • Use GitHub instead of a registry: cargo has great support for this. If you want your dependencies to always match their GitHub repos, just download from GitHub and compile your own.


  • The definition of “operating systems” is not really clear. Some say the operating system is what is called the “kernel”. In the case of Linux operating systems, that kernel is called “Linux”. Most people, however, say that the operating system is the whole thing you install. That is, the kernel + a bunch of other apps.

    For example, in windows: notepad, internet explorer (now edge), paint, and all those apps are part of the operating system, that’s what people mean when they say “windows”. It’s the whole package. Other less obvious parts are drivers for example.

    In the case of Linux, most distributions ship with a bunch of GNU programs.

    “Akschually people” argue that the GNU parts are as important (if not more) as Linux itself for the operating system, so they feel like all the hard work of the GNU developers is shadowed by the people that say “Linux”.