Hacker News new | past | comments | ask | show | jobs | submit | more woile's comments login

Nice! I also ended up using nom, it was quite fun.

https://github.com/woile/adventofcode/blob/main/2023/day1/sr...


That's true, it's important to recognize the problems and start working on them.

It sucks that you had to quit. I was advising the same to my girlfriend because she couldn't bear with work anymore, until a friend told her that she should not quit and instead the company should pay the burnout because they put her in that situation. Luckily she didn't follow my advise and it's been in burnout leave for the last 6 months, with help from a therapist.


Could you explain a bit more how it would be a risk? Maybe for session tokens is understandable. But why leaking account created info is a problem?


Leaking a monotonic ID could allow outside observers to estimate e.g. number of accounts created or products sold over certain timeframe. Competitors (or traders, for a public company) could use this like a form of inside information on the company (e.g. sell the stock if the rate was falling).


This would really only be possible if you leaked a monotonic sequence; the monotonic clock only would potentially leak only event ordering or absolute time.

IMO it's not the job of the identifier itself to prevent information leakage vulnerabilities though; if thee is sensitivity to this, the solution should be explicit, such as employing a secondary key derived from the UUID using a secure KDF or similar.


UUIDv7 does not leak the allocation rate of UUIDs.


It is that. IIRC C and C++ are already compliant and they are used in certain industries because of that. The end goal would be to have rust there as well.


C and C++ have safety certified implementations available for certain platforms from proprietary vendors. The language itself isn't, and neither are Clang or GCC upstream versions. In addition to the compiler, writing safety certified C or C++ code requires external tooling for static analysis etc. And lots of paper work to show due diligence with tools, processes and testing.

I can tell from $WORK experience that writing safety certified C or C++ code is very expensive and not fun.

For my line of work (systems programming for automotive industry), using Rust would be a massive improvement over C or C++. The amount of undefined behavior pitfalls and footguns is a big hindrance to productivity.

Perhaps the most labour intensive part is dealing with integer overflows in a way that keeps static analysis tooling happy. Just the fact that Rust has well defined semantics for overflows would save so much time and money.

Alas, using Rust was not a viable option when the project(s) I work with were started.


> Alas, using Rust was not a viable option when the project(s) I work with were started.

We hope things will change. One of the nice things about Rust is that it can integrate into C in both directions - using C libraries is possible, as well as building components for C codebases. Quite a few of the people we talk to explore (re)writing critical components in rust.


> Just the fact that Rust has well defined semantics for overflows would save so much time and money

This is a compile-time option in GCC and clang (fwrapv).


The question is whether the certified version of them defines the behaviour of the flag sufficiently to be accepted as a means og achieving that outcome. It can be very difficult to do anything not endorsed by the standard, even if it's widely implemented.


C and C++ have standards, but certification applies to specific implementations only. Ferrocene aims to create a certified Rust implementation with minimal changes to the main compiler (rustc). To achieve certification, detailed documentation or specifications are needed. Ferrocene is doing that: their focus is on meticulous documentation, ensuring the implementation can be certified using standards like ISO 26262.


I think what's missing is an easy way to describe schemas, field types and documenting the meaning of the field (of course you can use json schemas with yamls, but it's an external file).

I know of a new bunch of new tools which all look interesting. I feel like most of the time, they miss an easy way to parse using your programming language of choice, and you end up having to convert from cue -> json -> load in python.

- nickel-lang

- cue-lang

- kcl-lang

- dhall-lang


CUE is adding a WASM runtime, so there will be an ability to write complex or custom functions in the language of your choice.

Not sure if this addresses the issue you describe. I'm certainly doing what you do to get CUE into Python, while Go has that native feel for CUE


Be aware, after living in the Netherlands every other "developed" city is horrible, at least in the west. There are still small towns which have not been "modernized" and are enjoyable. Cities could be designed so much better. I always wonder if the people who make decisions for the cities actually live in those cities, or they are just incompetent.

For example:

- Most european cities, with a coast, chose to place a BIG noisy avenue right in front of it, and let's not talk about the surf ghost towns with massive parking lots facing the beach. How can you allow that in the place where you live?

- Outside London's touristic center, there's barely space to walk, no sidewalks. In the few fancy places with sidewalks, every house receiving sunlight in the frontyard has a car completely taking over it. In the netherlands, you literally see people put a small table to have a drink or snack, even without a frontyard!

- So much noise comes from cars, Amsterdam it's a big city but it's so quiet, in the good sense. Of course if you like the noise, you can go to noisy areas with tourists or parties, but that's different.


? Virtually every street in London (and the UK in general) has a sidewalk – apart from motorways and big A-roads. Some may be a bit narrow, but they’re fine.


Netherlands!

Netherlands!

Netherlands!


Nice library!

I found myself struggling with this in python with asyncio, is there something similar in that space?

Every time I wish I was using rust


With asyncio you can run multiple servers/clients/whatever in the same event-loop/thread/process already. Although, I don't understand what this library does at all, I don't think in the asyncio case you would need anything special. I've written tests for multiple distributed applications by using the asyncio approach in a relatively straightforward manner.


That's right. But allergies are usually related to trees or insects. I think with warm weather trees are confused and they start pollination.


To me the problem should be modelled similar to what we have now: Some institutions (private or public) giving an ok or not ok on the keys. And platforms choosing which institutions to trust. At some point we may have platform choosing all governments+trustworthy institutions

You could make things like a "smart contract" returns your money (or triggers an investigation) if after 48 hours you report an issue with your account or transaction. Of course this would mean some change on the blockchains themselves


Looks nice, any plans to add variables and prompts?

I'd recommend adding at the very beginning of the README a short yaml sample. That's the first thing I wanted to look at, but I had to get some understanding and then I found the scaffolder-config repo.


Indeed. Updated the README.

Variables are an interesting idea. I will consider in that in the future.


Hey, variables are there now


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: