Hacker Newsnew | past | comments | ask | show | jobs | submit | pastage's commentslogin

I recommend the zig library [1], it was a joy to use. Bloom filters was one of the first interesting algorithms I did in class back in university, we upgraded hardware during the lab making the use of bloom filters unnecessary in a lab ment to interactively show its usefulness. I have had this repeated since then, these filters are magic until hardware catches up, having smaller filter is lovely.

[1] https://github.com/hexops/fastfilter


What do you consider high quality? I would say they are one of the higher quality news papers of the world. Not everything, but overall yes.

I do not agree with their political views, but I can say the same about most papers. To a large degree this site is also beginning to be troublesome politically.


The thing about Wikipedia is that no one cares what you have done outside Wikipedia. It is like showing up at a new work place and saying something that is factually correct, it can go any way.

I have a fair amount of edits on Wikipedia and the wikis that preceded it. Whenever I read this sentiment here I never really understand what the problem is. I never have it myself. The only fight I have been involved in was if Wikipedia should have an article on Bitcoin. Which was not obvious in the beginning.

You could always link to the article and we can have a look. I have no clout on Wikipedia but I do understand why facts can be problematic in any text book. It once took me a week to correct an article about a Russian author.


It is quite easy todo 100 lines of Python, you can even send ip packets with faked source adress.

Networks are supposed to do egress filtering to prevent any packets with fake IPs from ever leaving the network. In practice it's not always so, but it mostly is. So you'd be limited to fake IP addresses in your own network, and doing so might raise alerts depending on the network infrastructure you live in.

Packets with fake source address can easily be spotted, and will raise an alert. In terms of using multiple interfaces for a single service it might be easy to hack together in a python script, but last time I checked the linux kernel support for bundling multiple interfaces is limited to redundancy and failover.

What I'd like to have is a single service dynamically using many network interfaces with randomized packet timings and randomized packet scheduling (5 packets on first interface, pause on 2nd, some on third interface, sometimes send traffic simultaneously).


If you want to hide you need to be in a place where you can do these kinds of stuff. Getting a peering without source filtering is possible, but even getting the simple version might be too hard for most.

This sounds like a culture issue in the development process, I have seen this prevented many times. Sure I did have to roll back a feature I did not sign off just before new years. So as you say it happens.


Both are illegal, if you just hoard you will never know if what you have is useful. Only way to judge that is by letting people use it.


I have not read the sofa problem I am not qualified to even talk about it.

Given a rectangle tunnel, twist it so the walls become the ceiling, and also turn it in the same time. Seems like the same problem..

What is solved here is maximum shape, it feels like moving a object like this in 3D is basically a robot planning thing which in it self obviously magic for me. Finding a continuous path in a configuration space is the easy part, but then you have to understand how that changes when your shape changes.


One process per sandbox will get you far, if all you want is to execute something. I would go as far as say it is pretty easy.


I want to execute untrusted code. This makes it very difficult indeed.


What's wrong with V8?

You could also look at GraalJS. It's shipped as part of the Oracle Database, there's a security team, patching process etc. It's used in production by Amazon amongst others. It's got flexible sandbox features too.

https://www.graalvm.org/latest/reference-manual/embed-langua...

The way it's written is good for security as well:

https://medium.com/graalvm/writing-truly-memory-safe-jit-com...

Disclosure: I sit next to the GraalVM team.


The challenge with V8 is finding a wrapper for it that doesn't come with a big warning NOT to use it as a sandbox for untrusted code - here's the workerd one https://github.com/cloudflare/workerd?tab=readme-ov-file#war... and here's the PyMiniRacer section: https://bpcreech.com/PyMiniRacer/architecture/#security-goal...

I looked at GraalVM but was put off by the licensing situation: https://www.graalvm.org/22.3/reference-manual/embed-language...

> GraalVM Enterprise provides the experimental Sandbox Resource Limits feature that allows for the limiting of resources used by guest applications. These resource limits are not available in the Community Edition of GraalVM.

Part of my requirements for a sandbox are strong guarantees against memory or CPU exhaustion from poorly written or malicious code.


Licensing has changed since that release. You can use the EE for free, both for personal and commercial use cases:

https://www.graalvm.org/latest/introduction/#licensing-and-s...

> Oracle GraalVM is licensed under GraalVM Free Terms and Conditions (GFTC) including License for Early Adopter Versions. Subject to the conditions in the license, including the License for Early Adopter Versions, the GFTC is intended to permit use by any user including commercial and production use.

It has all the sandboxing features you might want. I don't know if the disclaimers on the other engines changes much, open source software always disclaims all liability. Nobody will stand behind something security sensitive unless it's commercial because otherwise there's no way to pay for the security team it requires.


Now run the "Which programming language is fastest?" Benchmark on all of them.

https://benchmarksgame-team.pages.debian.net/benchmarksgame/...


You can use this docker image with all the pre-built binaries as a starting point: https://hub.docker.com/r/ivankra/javascript-zoo

Just keep benchmark code limited to standard ECMAScript, don't expect any browser or Node APIs besides console.log() or print().


Having spent only a week triaging Mozilla bug reports I do not see how a different ticketing system makes it easier. It is just hard work.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: