> "WhatsApp provides default end-to-end encryption for over 3 billion people". Wasn't there news lately that they can still read your messages somehow?
Rust at Scale: An Added Layer of Security for WhatsApp
51–60 of 151 posts
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#52I think that crown currently goes to https://github.com/googlefonts/fontations which is included in Chromium, not sure if it's on all platforms yet. Moreover, the translative dependencies of Fontations (click through https://crates.io/crates/fontations/0.3.0/dependencies) should have an even (slightly) larger install-base.
EDIT: from the quote you can also gather that they don't use https://github.com/signalapp/libsignal
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#53Earlier quoted context omitted.
Every encryption is end to end if you're not picky about the ends, or metadata. Do you trust facebook (excuse me, meta) to not snoop on your messages, and to not share them with the "intelligence" agencies ?
This is not true. The IETF draft is explicit that E2EE means that the message cannot be read by any party other than the sender and the intended receiver. When companies like Meta claim they support E2EE, this is what they claim. There are no tricky semantics or legalese at play here.
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#54Earlier quoted context omitted.
Like our gym devices that have a full tablet to run a basic application to control weights, talk about wasting money.
It doesn't make sense for that device alone, but the vendor probably supplies all the different equipment in the gym. Using a tablet simplifies their supply chain, deployment, debugging/repair, app update process and simply supports more features. There are probably some connectivity features on the device, for example. When you look at all of that together, it's hard to argue it's wasting money. It's like complainin…
Even worse was an article some months back about Android tablets hooked to heating & cooling systems expected to last 20 years. There's no way those things are making it at scale.
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#55> We believe that this is the largest rollout globally of any library written in Rust. I think that crown currently goes to https://github.com/googlefonts/fontations which is included in Chromium, not sure if it's on all platforms yet. Moreover, the translative dependencies of Fontations (click through https://crates.io/crates/fontations/0.3.0/dependencies ) should have an even (slightly) larger install-base. EDIT: f…
- https://github.com/image-rs/image-png
- https://github.com/webmproject/CrabbyAvif
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#56Just like Google’s Rust-in-Android blogs this reads like a PR piece (and in the case of facebook also recruitment piece) with some technical words sprinkled in for effect. The overall communication quality is that of a random startup’s “look what we did” posts. The interesting aspects, such as how they protect against supply-chain attacks from the dependency-happy rust toolchain or how they integrated the C++ code wi…
There are standard techniques to help manage this that apply across languages, there's no reason to reinvent that wheel.
> My hope’s that AI gets really good at Rust so one doesn’t have to directly interact with the unergonomic syntax.
"Unergonomic syntax" is the battle cry of many people resisting learning a new language. AIs have progressed far enough that they can help you in that learning process, though.
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#57Earlier quoted context omitted.
It doesn't make sense for that device alone, but the vendor probably supplies all the different equipment in the gym. Using a tablet simplifies their supply chain, deployment, debugging/repair, app update process and simply supports more features. There are probably some connectivity features on the device, for example. When you look at all of that together, it's hard to argue it's wasting money. It's like complainin…
The major problem with sticking an Android tablet on to exercise equipment is the difference in life spans. Android tablets are generally going to last you 4-5 years. Weight equipment should be able to last decades. There is some simple & cheap hardware that can last decades, but it is legitimately harder to program. Even worse was an article some months back about Android tablets hooked to heating & cooling systems…
"should" or "actually can"? Do you have references to show that's the actual lifespan of the equipment, mechanically?
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#58On binary size, static linking with LTO should handle most of the bloat without needing custom stdlib builds.
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#59Earlier quoted context omitted.
Every encryption is end to end if you're not picky about the ends, or metadata. Do you trust facebook (excuse me, meta) to not snoop on your messages, and to not share them with the "intelligence" agencies ?
This is not true. The IETF draft is explicit that E2EE means that the message cannot be read by any party other than the sender and the intended receiver. When companies like Meta claim they support E2EE, this is what they claim. There are no tricky semantics or legalese at play here.
Re: Rust at Scale: An Added Layer of Security for WhatsApp
#60Earlier quoted context omitted.
And then you get to a cardio unit where you want a completely different set of features and have to start over. Going lean on hardware only makes sense when you push out a very high number of units, when you have to deal with battery constraints or when you just have a lot of intertia, the combination of existing codebase and developer filter skillset.
Except all the machines have the same feature set I mentioned. Agree that wanting to hire cheap developers is why they did it that way, the current interface is so laggy that I would bet it is Web based, on top of running Android for nothing.
Personally, I'm a bit of an aficionado of close to the metal sports electronics. When I stare at gym screens I immediately notice updates that are supposed to come in once a second to get randomly delayed by what must be hundreds of millis. But I can totally see why they went that route. It's a market where feature quantity is big as a success metric and using a maintenance-friendly platform is even bigger. Wether Android actually checks that box might be debatable, but a bad embedded implementation could easily be worse, no doubt about that.
In the old days, those screens would have randomly dropped into some Windows desktop failing to operate in some kiosk mode fantasy.