Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Rune Programming Language

github.com

Post reply on HN
Print view View original

41–50 of 203 posts

Re: The Rune Programming Language

#41

Post by jstx1 »

What's up with having two different new experimental languages from Google on the front page https://news.ycombinator.com/item?id=33756800 - did Google just happen to release them at the same time?

I think when Carbon came out people's reaction was stronger than deserved (like saying that Google don't believe in Rust, or that Go has been a failure because it hasn't replaced C++ etc.) while in reality all of this is very experimental and very early in its development. I kind of expect similar reactions to Rune and Mangle with some people trying to make a big deal out of nothing.

Re: The Rune Programming Language

#42

Post by csmpltn »

WhiteBlueSkies wrote: post #13

Can someone explain how this works: "Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MA…

So-far, all comments on this thread are about the general concept of timing attacks...

You're asking a different question, though. You're asking about precision.

The answer here is that in many cases timing attacks pose a theoretical risk, but they can't be exploited in practice due to a low signal-to-noise ratio.

It really depends on the attack vector.

Measuring the latency of a network call (TCP) from across the other side of the world, as an example, is going to be too noisy (in many cases). Especially if the attacker wants to remain covert.

Re: The Rune Programming Language

#45

Post by vbezhenar »

First example seems weak. Any language can use separate data type for secrets and corresponding operator for constant-time comparison.

Second example is very neat. Actually I thought about using sqlite with tmpfs database for application state. That could be useful for some kinds of applications. That said, using functional API over traditional data structures seems like a traditional and widely accepted approach. Interesting to see where that experiment will go.

Re: The Rune Programming Language

#46

Post by zelphirkalt »

csande17 wrote: post #20
IshKebab wrote: post #5

Earlier quoted context omitted.

The code is owned by Google because it was written by a Google employee on the job.

Or off the job -- Google claims ownership either way. https://news.ycombinator.com/item?id=1969979

That would be one more huge reason not to work for them.

Re: The Rune Programming Language

#47

Post by dvirsky »

jstx1 wrote: post #41

What's up with having two different new experimental languages from Google on the front page https://news.ycombinator.com/item?id=33756800 - did Google just happen to release them at the same time? I think when Carbon came out people's reaction was stronger than deserved (like saying that Google don't believe in Rust, or that Go has been a failure because it hasn't replaced C++ etc.) while in reality all of this is v…

This isn't an official Google project, the contributions seem mostly from one person, so probably someone doing this as a 20% project. Carbon OTOH has a team working on it AFAIK.

Re: The Rune Programming Language

#49

Post by kevingadd »

I'm perfectly fine seeing nullable references in a new systems programming language, but it's disappointing that nullable is the default. If you care about both performance and memory safety, being able to compile-time guarantee that you don't need a null check in a specific location can be big!
Post reply on HN