iiinova — where your digital self keeps evolving

Brian Smith @briansmith.bsky.social · 28/04/2026

Display doesn’t make sense at all when you consider most users don’t read/write the same language as the developer and it isn’t localizable.

040

Brian Smith @briansmith.bsky.social · 28/02/2026

Most people I know do seem to “need” one, to pretend to be in a different place so they can watch geo-restricted videos.

110

Brian Smith @briansmith.bsky.social · 01/10/2025

little reason for it in most FFI either since the stronger types can be used in FFI.

110

Brian Smith @briansmith.bsky.social · 11/08/2025

I don’t remember. I thought it did. But even if not, f(…).into()? Isn’t much worse than f(…)?.

030

Brian Smith @briansmith.bsky.social · 11/08/2025

When your FFI functions return a c_int status, you can instead have them return #[repr(transparent)] struct Res(c_int); and then impl From<Res> for Result<(), Error>. This works in stable Rust today.

120

Reposted by Brian Smith

Marc-André Moreau @awakecoding.com · 29/07/2025

New blog post! 📰 I tried "vibe coding" in VSCode using GitHub Copilot (Claude Sonnet) to build an MCP proxy tool in Rust — I didn't touch a line of code, just pure agent mode magic 🧙‍♂️ 🚀👇 awakecoding.com/posts/vibe-c...

awakecoding.com

Vibe coding a Rust MCP proxy in VSCode with GitHub Copilot

A hands-off experiment building a Rust-based Model Context Protocol (MCP) proxy tool using only GitHub Copilot agent mode. Covers setup, multi-transport support, and lessons learned from letting Copil...

012

Brian Smith @briansmith.bsky.social · 11/07/2025

In NIST DRBGs, the potentially-attacker-controlled “m” is the “additional info” (sp? from memory). Look at how they do it. There seem to be optimized ways of doing it, mostly by using simpler keyed constructs (HMAC, HKDF). And some do other ways, also involving a random component.

100

Brian Smith @briansmith.bsky.social · 11/07/2025

This sketch of rejection sampling seems like a strawman with the overly simplistic H(ctr||M) construct. Many implementations do rejection sampling without the leakage you mention, by using more sophisticated constructs. The wording misleadingly, dangerously, implies the bad one is the only one. HTH.

120

Brian Smith @briansmith.bsky.social · 26/06/2025

It won’t stop all new lints from firing though, just the ones where the suggestions require newer features. if you don’t want CI to fail on the day a new stable Rust is released, more work is needed.

230

Brian Smith @briansmith.bsky.social · 26/06/2025

clippy.toml gives you a way to set the MSRV for clippy lints separately from the MSRV of your crate, right?

110

Brian Smith @briansmith.bsky.social · 19/06/2025

Make sure your forum wasn’t hacked to serve different content to people who aren’t logged in and/or who aren’t admins and/or from different IPs than what admins typically use.

010

Brian Smith @briansmith.bsky.social · 17/06/2025

Your issuance numbers probably should be adjusted for lifetime. three consecutive 90-day certificates are equivalent to one 270-day certificate, for example.

010

Reposted by Brian Smith

Jonathan Protzenko @protz.bsky.social · 10/06/2025

This is what I've been driving for the past year! It's an exciting time, with Rust making its way into one of the most critical pieces of software: the core crypto library used in Azure and Windows. With Rust, formal verification becomes easier, and so far, no blockers to Rust adoption.

66514

Brian Smith @briansmith.bsky.social · 10/06/2025

If you refuse to give permission to Parallels to abuse the accessibility features to automate the installation of the update, it will fail to install it (stating the obvious?). But if you go to the macOS developer downloads page, download that system update, and install it manually, it works.

100

Brian Smith @briansmith.bsky.social · 10/06/2025

Tried macOS 26 beta in a VM. I like the glass effect. The default icons in dark mode are like the ones on iPhone, but the clear icons look good. It seems like a stepping stone toward touchscreen Macs. Lots of big UI elements & more of an emphasis on interactivity. Needs refinement of the layering.

130

Brian Smith @briansmith.bsky.social · 05/06/2025

As a software developer, I find many aspects of the app’s design to be amazing. It’s actually one the best-designed apps I’ve ever used, especially in sports. Some clunky parts, but overall it is really impressive. It’s been working extremely reliably for me, which is amazing on its own.

100

Reposted by Brian Smith

ePrint Updates @eprint.ing.bot · 02/06/2025

Formal Security and Functional Verification of Cryptographic Protocol Implementations in Rust (Karthikeyan Bhargavan, Lasse Letager Hansen, Franziskus Kiefer, Jonas Schneider-Bensch, Bas Spitters) ia.cr/2025/980

Abstract. We present an effective methodology for the formal verification of practical cryptographic protocol implementations written in Rust. Within a single proof framework, we show how to develop machine-checked proofs of diverse properties like runtime safety, parsing correctness, and cryptographic protocol security. All analysis tasks are driven by the software developer who writes annotations in the Rust source code and chooses a backend prover for each task, ranging from a generic proof assistant like F⋆ to dedicated crypto-oriented provers like ProVerif and SSProve Our main contribution is a demonstration of this methodology on Bert13, a portable, post-quantum implementation of TLS 1.3 written in Rust and verified both for security and functional correctness. To our knowledge, this is the first security verification result for a protocol implementation written in Rust, and the first verified post-quantum TLS 1.3 library.

1106

Brian Smith @briansmith.bsky.social · 29/05/2025

I am watching a lot of baseball. Too much.

010

Brian Smith @briansmith.bsky.social · 10/05/2025

@watchmarquee.bsky.social @mlb.com Would love to get the Cubs games in 5.1 audio through MLB.TV.

000

Brian Smith @briansmith.bsky.social · 28/03/2025

It seems to be required by the design of core::atomics, like you point out. Presumably it could be upstreamed into libcore proper as well, though I suspect there are some knobs to tweak it that libcore wouldn’t like to expose. Definitely not an easy situation to deal with.

020

Brian Smith @briansmith.bsky.social · 28/03/2025

I mean, this needs a new target spec with a new implementation of core sync atomic, right?

110

Brian Smith @briansmith.bsky.social · 28/03/2025

Can’t you implement atomics by checking the address of the atomic and using a lock stored in coherent memory that guards some kind of (expensive, slow) coherence protocol built on top of the lock?

110

Brian Smith @briansmith.bsky.social · 27/03/2025

Doesn’t that mean that malloc must avoid allocating from PSRAM, or the target much claim no atomics?

110

Brian Smith @briansmith.bsky.social · 26/03/2025

It would have been exactly the same as Chrome, except slower to market. That was the problem, and still is the problem with Firefox today.

030

Brian Smith @briansmith.bsky.social · 26/03/2025

I wasn’t involved in the decision making. I did seem to be the one who informed decision makers for the first time that the sandbox would still be needed. I remember that very clearly because the surprised—and, it seemed, doomed—look on people’s faces surprised me.

030

Brian Smith @briansmith.bsky.social · 26/03/2025

Very early on I think memory safety was seen as a lighter-weight substitute for sandboxing. This was before we realized Servo would have so much legacy code in it, and it was before Spectre/Meltdown made it clear it was impossible even without legacy code. (Not sure what the plan was for the JIT.)

130

Brian Smith @briansmith.bsky.social · 20/03/2025

I simply disable the cancel button so I don’t have to worry about it.

000

Brian Smith @briansmith.bsky.social · 17/03/2025

It seems like you could make it fail to link in non-text scenarios by having tests link to a library that provides a symbol that it depends on.

000

Brian Smith @briansmith.bsky.social · 06/03/2025

It’s the time of year where we re-read ComodoHacker’s pastebin. Props to pastebin.com for keeping this up for all these years. pastebin.com/u/ComodoHacker

pastebin.com

ComodoHacker's Pastebin - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

011

Brian Smith @briansmith.bsky.social · 27/02/2025

Probably for 90%+ it could be like that, regardless of AI. But there’s no way to tell how long the rest will take to get it “perfect enough,” nor to exactly meet the customer’s unknown expectations. Just like we’d expect a decision about programming language syntax to go.

010

Brian Smith @briansmith.bsky.social · 24/02/2025

It would be awesome to have neon there. It is a target feature, but only on nightly, for 32-bit.

110

Brian Smith @briansmith.bsky.social · 23/02/2025

Also, my brother swears by Stronglifts 5x5 with a way-too-slow progression from way-too-easy.

020

Brian Smith @briansmith.bsky.social · 23/02/2025

The best thing to do is just get to the gym and do a ridiculously easy workout while you think about the plan. I do the same thing with my running; I go out and run 1k first run of the year. And each year I do the same with weights.

150

Brian Smith @briansmith.bsky.social · 15/02/2025

A good way to do it is to use a scriptable refactoring tool to describe the change to make. Create an idiom for embedding these scripts in commit messages. Create CI/review to recognize the embedded scripts and verify the commit is the result of running the script.

010

Brian Smith @briansmith.bsky.social · 14/02/2025

Oh, yeah…all artificial target arch limitations have been removed. If your C compiler uses normal mechanisms for indicating endianness and 64-bit/32-bit data model (like Clang and GCC) then the code should build and run, so you can experiment with pretty much any target.

030

Brian Smith @briansmith.bsky.social · 14/02/2025

Released *ring* 0.17.9. X25519 is about 20% faster for GCC users (clang got it in 0.17.8). AES-GCM is slightly faster. Auditing the code for memory safety and panic-freeness should be easier now. Expect 100% compat with 0.17.8, but MSRV was raised from 1.61 to 1.63; still Debian-Stable-friendly.

1101

Brian Smith @briansmith.bsky.social · 13/02/2025

Social media seems to be in a death spiral. It’s embarrassing, discouraging, disheartening for people to post and get so little engagement. Then they engage less (esp. repost less, I’m guessing) which just further discourages the people they follow. And nobody even tries to make a joke anymore.

000

Reposted by Brian Smith

Casper Kessels @casperkessels.com · 11/02/2025

New study on the effect of driver aids on crash risk: - Lane keep assist: -19% - Driver monitoring systems: -14% - Automatic emergency braking: -10.7% - Adaptive Cruise Control: +8% - Cruise Control: +12% No data on speed limit alerts though. www.sciencedirect.com/science/arti...

sciencedirect.com

Rethinking Advanced Driver Assistance System taxonomies: A framework and inventory of real-world safety performance

In this review, we assess the real-world effectiveness of ADAS! (ADAS!) in preventing vehicle crashes. We propose a new, data-driven framework of safe…

2193

Brian Smith @briansmith.bsky.social · 07/02/2025

Sometimes we can’t cancel out a poor choice with a great choice, unfortunately.

110

Brian Smith @briansmith.bsky.social · 07/02/2025

Sometimes we just get lucky.

100

Brian Smith @briansmith.bsky.social · 07/02/2025

I wish I wasn’t the kind of person to question whether a language’s mutex implementation guarantees acquire/release semantics.

031

Reposted by Brian Smith

Clive "Max" Maxfield @magnificent-max.bsky.social · 30/01/2025

Rust Rules! (Programming Language-Wise) www.eejournal.com/article/rust... Ferrous Systems has carved out a leadership role with respect to Rust solutions for safety-critical systems. Its flagship tool chain, Ferrocene, has achieved IEC 62304 Class C qualification for medical device software.

Metal sheet covered in rust with blue, green cyan, yellow, orange, and red hues

14110

Reposted by Brian Smith

Ben Adida @benadida.com · 28/01/2025

It's a big week for voting technology. We're launching VotingWorks, the voting system we've been hard at work on for six years. Transparent, secure, and easy to use. So every American can trust their ballots are counted correctly. voting.works/machines

voting.works

Voting Machines

The only open-source voting machines used in United States elections. Designed to VVSG 2.0.

1195

Brian Smith @briansmith.bsky.social · 21/01/2025

Locking down the system is about protecting the kids, not the system. To some extent we restrict what they can do so they don’t harm themselves. And of course it depends on the specifics of the kid.

010

Brian Smith @briansmith.bsky.social · 18/01/2025

Family members are no different than anybody else except more likely to be used as a conduit for any targeted attack. Even my own “play” is done on separate hardware. Work PCs are on an isolated/firewalled work network from rest of home and rest of network is treated as Beijing airport Starbucks.

100

Reposted by Brian Smith

Johnathan Nightingale @johnathan.bsky.social · 18/01/2025

Step N+1: the person with the keys will tell you that having the option to disable specific integration points is an enterprise-only feature, but that they can add it to your account if you confirm that's what you want. A few minutes later, it's active. Ours now looks like this.

Updated screenshot of google admin panel for "Gemini for Google Workspace" -- the panel now has a panel labelled "Feature Access" with the ability to toggle gemini in Drive and Docs, Gmail, Chat, and Meet. They are all toggled to Off.

141

Reposted by Brian Smith

Litbowl @litbowl.bsky.social · 17/01/2025

I want to share my experience today with Google support, trying to get Gemini (their AI/plagiarism machine) turned off in my Google workspace account. That account is where I personally do all my work communication—I am an editor, and most of my work contracts explicitly ban any use of Generative AI

7728431415