I'm at the Rust Paris meetup and Nadri is improvising a talk on variance in Rust 🤩. cc @imperio@toot.cat
Remote
Anisse
@Aissen@social.treehouse.systems
mastodon 4.6.7+glitch-thLinux dev. Android user. Security curious. Beginner rustacean. Casual hardcore gamer. — French native, english toots — Personal account — He/him.
Posts in CC-BY-ND for a month, then CC-BY-NC-ND, contact me for other arrangements.
Profile picture is a line drawing caricature of myself by french artist Frank Tizzoni; I have a french-style flat cap and a light beard.
794 Followers
441 Following
50 Posts
Joined January 09, 2023
website:
Message me on Signal:
Kernel Recipes 2026 liveblog:
Kernel Recipes 2025 liveblog:
Kernel Recipes 2024 liveblog:
Kernel Recipes 2023 liveblog:
Kernel Recipes 2022 liveblog:
Replying to
Replying to
"Maintenance is not just code. We are a community of contributors, not a code repository." Oli says.
#RustLang #RustInParis
Replying to
During the EII implementation, it needed a big attribute refactor in rustc. And the community stepped up and helped Jana and Mara on this project. Many were first time Compiler contributors, and some even became team members.
Which is a big reason Jana resents LLM PRs on the Rust project: it robs the opportunity for community-building, and learning in general, she says.
#RustInParis #RustLang
Anyone else still gets a bit of stress as they write a linux live image to /dev/sda, despite using NMVe system drives for many years?
@cnes@social.numerique.gouv.fr bon courage ! Opinion perso: continuez à poster (oui même les liens YouTube, ceux que ça n'intéresse pas peuvent ne pas cliquer), écoutez les commentaires constructifs, ignorez (mute) tous ceux agressifs (même celui-ci si c'est trop !), et ayez des objectifs réalistes en fonction de vos moyens!
I'm wondering if the biggest LLM trap is that they solve their own problems by LLM-ing more.
For example, people are seeing the influx of valid security issues being found and overflowing maintainers. Even the most anti-LLM people can't deny this fact.
But people are also complaining about the slop adding new security issues. So if you want don't want to ban slop wholesale, the fix is to use the same tools: pre-commit and mandatory LLM-based security review. Spend even more tokens.
So that means depending on LLMs just for managing the influx of LLM-assisted contributions. I understand how many people want to live in an LLM-free world.
I'm not sure how well that will work for security-critical Free Software.
I'll be at #RustWeek as well !
RE: @DavidJBianco@infosec.exchange
So it turns out the "agentic system" that hacked HuggingFace was a *benchmark* running at OpenAI that escaped its sandbox environment.
Oh, and the attacker (OpenAI) had no constraints because these were guardrails-free frontier models, the ones companies and govs pay $$$ OpenAI and Anthropic for "defending".
https://openai.com/index/hugging-face-model-evaluation-security-incident/
Fun issue: a performance regression between two Rust versions, only on dual socket Zen4c, and does not happen on dual socket Zen4, nor single socket socket Zen4c. https://github.com/rust-lang/rust/issues/154516
#RustLang #Bergamo #Genoa #Zen4 #AMD #NUMA #MicroArchitecture
Replying to
@HalvarFlake@mastodon.social very in line with what we measured, heavily follows rush hour per geographic area. Yet another advantage for on-prem.
That's it for me for #RustInParis! There were great talks, great people and nice discussions; it ends a bit early, but let's meet again next year!
Replying to
This presentation is also available in the form of blog post: https://donsz.nl/blog/externally-implementable-items/
#RustInParis
Replying to
@axboe@fosstodon.org @gregkh@social.kernel.org something @ljs@mastodonapp.uk would most likely agree with 🙂 cc @vbabka@mastodon.social
Replying to
After a survey among all 54 teams, Oli found that everyone is busy keeping the lights one, but no one has time to tackle the Complex problems #RustInParis
Replying to
In rustc, Oli had that as well, with many features being blocked on a complex refactor. Another example is the infamous Rust soundness bug that needs a completely new Trait solver. The project for this Next Trait solver exists, but does not necessarily have funding. (Edit: see reply, this is incorrect).
Oli says, this is not something we can rely on volunteers for that: they'll just end up burning-out, like others before them.
#RustInParis
RE: @Aissen@social.treehouse.systems
Did you know that lbzip2 implements a N:M task scheduler just so it can (de)compress faster? Basically the equivalent of what is provided by the Go runtime, or tokio (or your OS, etc.).
https://github.com/kjn/lbzip2/blob/724352c0495904ab16e33817fae85b262f319318/src/process.h#L23-L42
https://github.com/kjn/lbzip2/blob/724352c0495904ab16e33817fae85b262f319318/src/process.c#L37-L62
For border-explorer, I made a script to update it regularly against #Wikidata's dumps. Just in case, I put a check in the script to prevent updating if the dump size varied too much. It just triggered last week and blocked the update since a dump was ~71GB instead of ~100GB, preventing border-explorer to temporarily show incomplete information.
Replying to
For feature work, it's "easy" to get contracted for that. Similarly, in big companies, working for months on a feature is something the company can afford. But it adds to the review load, and it might get blocked on complex refactors.
#RustInParis
Replying to
@axboe@fosstodon.org @hyeyoo@social.kernel.org @ljs@mastodonapp.uk @vbabka@mastodon.social @gregkh@social.kernel.org That seems to be the plan on Jacub's side. https://github.com/linux-netdev/mod-orphan
Note: I'm not arguing against any removal, I'm not crazy enough to take on this type of maintenance. I was just commenting on the feeling.
Replying to
@hyeyoo@social.kernel.org @axboe@fosstodon.org @ljs@mastodonapp.uk @vbabka@mastodon.social @gregkh@social.kernel.org I was mostly commenting on the context of network drivers being removed. A modern distro kernel ships those old unmaintained drivers and would allow retro-computing with 3com 3c589 card. Maybe the term isn't well chosen, but Linux got the reputation of having so many drivers, maintained for so long. But every good thing must come to an end.
Replying to
@axboe@fosstodon.org @gregkh@social.kernel.org @ljs@mastodonapp.uk @vbabka@mastodon.social yes, I did read https://lwn.net/Articles/1068928/ ; it does seem bittersweet though.
@mattly@hachyderm.io Already reverted
Replying to
A few weeks later Jana and Mara implemented a fourth solution, which has no RFC. And realized that Rust already have Externally Implemented Items (EII). One of those is the Panic Handler.
When building, the core expects a function to be marked #[panic_handler]. With std there is one already provided.
The second one is the Allocator, which is a trait with four functions that also needs to be externally implemented.
#RustInParis
Replying to
For their implementations, Mara and Jana decided to have a core definition that is empty but shows the type. It has an attribute to be used to decorate the external implementation.
It allows separate implementation and name resolution.
#RustInParis
Replying to
After discussion with Miguel Ojeda from Rust for Linux, support for EII outside of cargo was also needed. But it turns out there is already a linker feature that can be used for that: weak symbols. It allows exactly what Rust does: having a default implementation (that is weak, and has less priority) that is a fallback in case no other implementation is found.
#RustInParis #RustForLinux
Replying to
After Code Maintenance, comes Community Maintenance. The project should make it easy for new contributors, and enjoyable for contributors and maintainers to contribute and review.
#RustInParis
Replying to
Within a crate, order is mostly independent (except macros), but the crate graph is definitely order-dependent. This leads to a very small crate (6 lines) in the rustc dependency graph, done only to prevent circular dependencies.
#RustInParis
Replying to
@monkeyninja@10base2.dev unfortunately this does not work, as has been said bye others. You'll get a worse TV for more money because the market is structured around Smart TVs and there's a lot of economies of scale. Just don't connect it, and refuse the EULAs, the effect is the same.
While working on Emoji Anki, I found a Chrome bug/limitation when using hardware acceleration: the CSS `text-shadow` will have a maximum size that depends on the emoji, font size/zoom level, and text-shadow blur radius (and probably the platform, too). Probably some limit somewhere deep within Skia.
It does not happen on Firefox or Chromium-based browsers that have hardware acceleration disabled.
Playground to repro: https://anisse.github.io/text-shadow-playground/
Replying to
@zhuowei@notnow.dev is this still working in browsers? Many ISP's DNS block RFC1918 address resolution. Firefox blocks them when using DoH by default. I wonder how that applies to local (127.*) addresses.
On a clean install of Fedora 44 (Asahi), plasma-login-manager does not honor the system locale. It's launched as a different user (plasmalogin) but it has a separate plasma locale rc in /var/lib/plasmalogin/.config. Editing it works around the issue. I might open a bug later, but if you want to, go ahead!
Edit: this seems to be a downstream bug.
#fedora #plasma #asahilinux
Replying to
@monkeyninja@10base2.dev Glad it works for you. One does not need the best deal to be happy.
Replying to
@djc this seems a bit disingenuous since it relies on aws-lc instead of being fully memory safe, and does not compare with a vanilla aws-lc stack either. What am I missing?
Replying to
@ariadne@social.treehouse.systems seems reasonable as a whole; your project, your contribution rules.
Wouldn't you ban Google's Project Zero with these guidelines?
In light of copyfail yesterday I had a quick look at the stable kernel changelogs, and almost half the patches look like they could have a security impact. Everyone should just regularly update regardless, even more nowadays with AI VCs financing vuln research in open source projects.
Replying to
Each module is declared in the monolith with a macro, which exposes the module API. Each module's API is checked at compile-time, and can be mocked for testing. And calls between modules stay in-process with an mpsc channel.
#RustInParis
Replying to
@adamw@fosstodon.org thinking a bit more, launching Calamares after copying the image might already be diverging quite a lot from what Fedora does.
Replying to
It's not only a technical talk, but it starts with a technical discussion order independent name resolution, which Rust has, but not C for example.
#RustInParis
Replying to
Not sure how we can do better though
A random idea, not sure how far it is from what you already do: Bump automation where packages from latest stable branches are built and available with no human intervention in specific repositories. Manual promotion for generic repos should be as effortless as possible.
Replying to
Of course, it's not always rosy: there might confilcts between contributors, or external brigading. This needs to be managed properly.
#RustInParis
Replying to
@janne@social.treehouse.systems I am not sure. The install script or the doc mention Calamares though.
Replying to
At RustNL 2024, the RFC on Externally Implementable Functions was discussed. It led to a few discussions, and then another RFC which changed the goal to externally implement static insteads, which has less safety impacts, but does not allow unsafe.
Then it led to a third RFC for externally implementable traits.
At the time, no one knew the best way forward, and no code had been implemented yet.
#RustInParis