Spyke

Replies

rust

Comment on

When URL parsers disagree (CVE-2023-38633)

Reply in thread

The very same type of mistakes happens in file systems even without URIs being involved. Directory traversal checks look simple but sooner or later need hard-to-understand symlink following rules. Enforcing processor policy has terrible portability there (it even only became practical on Linux with landlock), but nonetheless I think it's preferable.
Not mixing URI parsers is a good advice for when processor policies are unavailable – but let's try to make them available more often.

Comment on

*Permanently Deleted*

Reply in thread

Coroutines are one means of implementing async; the way they are implemented in Rust is more like building a state machine out of the async function. It can still be mapped to coroutines, and there are probably crates that use async and macros to make coroutines usable on stable, but the effort to have a stable language feature is still ongoing, with https://lang-team.rust-lang.org/design_notes/general_coroutines.html giving the overview.

meta

Comment on

How can we federate with the #rust hashtag?

Reply in thread

I know painfully little of ActivityPub, but from a protocol design PoV, Lemmy altering its behavior when it sees Mastodon doesn't sound desirable. I'd rather put metadata in the toots that allow better decisions, or even have two entities (linked by metadata) for channel-top-posts and channel-everything, if the latter is needed at all.

rust

Comment on

When URL parsers disagree (CVE-2023-38633)

@snaggen I think the better lesson than "don't mix URI parses" here is "don't LBYL, rely on EAFP". Many "Look before you leap" (LBYL) schemes are subject to variations of time-of-check/time-of-use errors. It's preferable to not sanitize input, but tell the processor what the policy on processing is; when it comes to a violation, it's easier to ask forgiving (i.e. report the error) than permission (EAFP).

Comment on

Proj Crate

@Kaiser If you run into trouble with something-sys, you should check whether that crate requires libsomething headers to be installed. (cargo will take care of dependencies, but only within Rust, it can't install arbitrary C libraries). On Ubuntu, you'll need to run sudo apt install libproj-dev (maybe also libtiff-dev) to get these headers.

You reached the end