• 0 Posts
  • 24 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle



  • I would say this very issue is at the core of the current CVE discussions that leads more and more projects to become their own CNAs.

    Security people and corporate downstream consumers of security feeds want to invest the minimum of effort while pushing as much of the evaluation what is and isn’t a vulnerability on the authors of library authors as possible. However, this does not work. A vulnerability can only ever truly be evaluated by investing significant amounts of effort in the abstract way that is required to do it in an upstream project. On the other hand, at point of use it is often trivial to discard the possibility of an exploit because the potentially vulnerable code is not even used by the project using the library that contains the code.


  • No, I actually meant it as in the traditional meaning of literally. As in

    [lints.clippy]
    unwrap_used = "warn"
    expect_used = "warn"
    

    along with a pre-commit hook that does

    cargo clippy -D warnings

    (deny warnings).

    There are always better ways to write an unwrap, usually via pattern matching and handling the error cases properly, at the very least logging them.















  • I would like to see something that is less focussed on social media and more on building something together like Wikipedia. One thing that comes to mind would be mapping out all political statements along with arguments and evidence to support or falsify them and the relationships between them (e.g. “if you believe x is a big problem in society and you believe y is the perfect form of government then you must believe y solves x”).

    A lot of our political discussions seem quite repetitive and go in circles because each argument is presented in a very shallow way. Something to counteract that would be welcome and I think it could work quite well in a federated way since people with different political views would probably want to contribute the supporting and that falsifying sides for each statement.