Viewing profile — exyi

You know that prompt injection is a thing, right? Giving opencode access to bash and malicious input is not very far from piping it right into bash.

Exactly. Although if you do >> 8 while working with uint8, it will be the fastest :)

It's 3 cycles for float multiplication (and 1 for shift right): https://uops.info/table.html?search=mulss&cb_lat=on&cb_tp=on... https://uops.info/table.html?search=shr&cb_lat=on&cb…

Then you also have to auto-update the containers, if it's a public facing service. Either you'll have to build containers yourself or hope the developer pushes a new update wheneve…

VSCode extensions often contain binary blobs, so it won't catch basically anything. It would also be a bit expensive.

At least my password won't leak as often with yubikey, but the attacker can still hack my shell to execute fake sudo. Even if I type /bin/sudo explicitly, there is ptrace, LD_PRELO…

Ok, so the malware runs a keylogger / clipboard logger, gets the password and runs sudo on it's own. Or replaces your shell by putting exec ~/hackedbash into your bashrc Password o…

Whitelisting also quite likely doesn't work ("of course I will allow my agent to run find, that can do no harm")

Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. Also hash matching is so easily bypassed you can be sure t…

and cross-platform UI

Do you know if there is override this specifically when I want to install a security patch? UV just claims that package doesn't exist if I ask for new version

Except that LiteLLM probably got pwned because they used Trivy in CI. If Trivy ran in a proper sandbox, the compromised job could not publish a compromised package. (Yes, they shou…

If you change this you break a common optimization: https://github.com/python/cpython/blob/3.14/Lib/json/encoder... Default value is evaluated once, and accessing parameter is much…

Every sane approach to security relies on checking you are doing permitted actions on the server, not locking down the client.

Python does not need that, as it has built-in type annotation support. The annotation is any expression, so you can in theory express anything a custom type-only language would all…

... or they teached GPT to use em-dashes, because of their love for em-dashes :)

Ok, run the same prompt on a legitimate bug report. The LLM will pretty much always agree with you

Local would imply the date is in the current machine timezone, while PlainDateTime is zoneless. It may be in the server timezone, or anything else. The main difference is that it d…

Only until you work with a type array (Int32Array, Float64Array, etc), then it becomes 10x slower: https://jsperf.app/doyeka/11

Usually yes, but it's still a neat trick to be aware of. For interpreted scripting languages, parsing can actually be a significant slowdown. Even more so when we start going into …

The point is that a good library usually exists for some language, which is not necessarily the one you are currently using. IMHO, we don't lack good libraries in XY, we are lackin…

C# portable SIMD is very nice indeed, but it's also not usable without unsafety. On the other hand, Rust compiler (LLVM) has a fairly competent autovectorizer, so you may be able t…

The protocol must support it somehow already, as some bridges can send custom emojis from other platforms

Everyone I know of will try to click "reject all unnecessary cookies", and you don't need the dialog for the necessary ones. You can therefore simply remove the dialog and the trac…

I know about netcoredbg, but I did not have much success using it. If we count this as the C# debugger, then the tooling quality is not comparable to other mainstream languages lik…