• 1 Post
  • 677 Comments
Joined 2 years ago
cake
Cake day: September 24th, 2023

help-circle


  • modern C++ facilities do make a difference to prevalence of bugs.

    This is true, but just saying “write modern C++!” doesn’t actually work in practice. First, there are a ton of footguns that even best-practice C++ doesn’t avoid. Using std::shared_ptr? Great, you’re probably going to avoid memory leaks. Null pointer dereference? Not so much. What’s the modern C++ way to avoid integer overflow?

    Second, it’s pretty much impossible to completely avoid raw pointers etc. even if you’re trying, and good luck getting your colleagues to actually try. I can’t even get mine to write proper commit messages. You need a machine forcing them to do it properly. Something they can’t opt out of (or at least where opting out isn’t the easy lazy option).

    So yeah it’s better to use modern C++ and it is an improvement, but not enough the change the conclusion that you should just use Rust instead.








  • Not the great rebuttal you think it is… AI isn’t really about writing code that I couldn’t write. Unless you’re a beginner it is absolutely not at that level yet. It’s about saving time.

    Which it definitely can do. Especially for one-off tasks. For vibe coding projects my experience has been mixed. AI seems pretty good for getting things going, especially in areas you aren’t familiar with (e.g. I wrote a simple Chrome extension with it; never written a Chrome extension before). But after a certain point they seem to get stuck in a muddle and you basically have to stop using AI, fix all the code it wrote badly and continue yourself.

    But overall it can still be significantly faster than being prideful and doing it all by hand.


  • The connection column indicates the connection used. USB FS stands for the usb full speed protocol, which allows up to 1000Hz polling, a feature commonly advertised by high-end keyboards. USB is the usb low speed protocol, which is the protocol most keyboards use.

    USB Low Speed allows 1kHz polling too. I don’t think you gain anything at all from High Speed. Keyboards probably only use it incidentally because the chip they are using happens to support it anyway.


  • Huh I was under the impression that you could limit it to specific applications and dbus would tell kwallet the path of the application making the request (which could be done at least vaguely securely). But upon further investigation it just uses the “appid” that the app reports which it can apparently set to anything it wants. It’s difficult to find information about this stuff though. D-bus is not very well documented at all.


  • Interesting how do you do that exactly?

    I was thinking you can just start the app that has permission to read the wallet, attach a debugger and then inject code to dump the wallet. It’s definitely more complicated than reading a plain text file but not fundamentally less possible.

    But really if you have that level of access it’s game over anyway and you just MitM sudo and get root access, or use one of the many local privilege escalation vulnerabilities and get root immediately.


  • They should be keeping them in something like kwallet. But in practice they don’t because a) there isn’t really a single standard for that on Linux (yeay, I have to support gnome-keyring too!), b) it’s a lot more work than using a plain text file, c) the UX is considerably worse, and d) the security benefits are marginal at best (especially if you have full disk encryption).

    Plain text is the most sensible option.