Hacker Newsnew | past | comments | ask | show | jobs | submit | mkj's commentslogin

Intriguing work! Does it panic on any bad inputs? That's better than memory unsafety of libxml2, but still a DoS concern for some servers.

No it's not, it's 6pm!


> For example, std::time::Instant is implemented on the GPU using a device timer

The code is running on the gpu there. It looks like remote calls are only for "IO", the compiled stdlib is generally running on gpu. (Going just from the post, haven't looked at any details)


Which is a generally valid implementation of IO. For instance on the Nintendo Wii, the support processor ran its own little microkernel OS and exposed an IO API that looked like a remote filesystem (including plan 9 esque network sockets as filesystem devices).


I'm surprised this article doesn't provide a bigger list of calls that run on the gpu and further examples of what needs some cpu interop.


Flip on the pedantic switch. We have std::fs, std::time, some of std::io, and std::net(!). While the `libc` calls go to the host, all the `std` code in-between runs on the GPU.


It looks like it is only applied for PTY sessions, which most computer-computer connections wouldn't be using.

https://github.com/openssh/openssh-portable/blob/d7950aca8ea...


Fs.com are a well regarded company. The OP should contact them and see if there's a recall on those cables or something. Sounds similar to what happened with some mains power cables sold by a hardware store in Australia.


I don't regard them very well personally... I bought a bunch of DAC cables from them, only to have them start emailing me under the guise of assigning me a "account manager"... I blocked their domain from my mail server and told them to never contact me again.


They offer to provide you with personalized service and you block them? What do you do when you walk into a high end watch or clothing store?

FS provides account managers and they are very useful if you are working on a project as they can guide you and help you.


Is it too much to ask to just be able to buy things without being chased around by someone?

I have a Newegg business account (and maybe a few more for other pc stores, I'd have to check), but I literally never have them trying to get me to buy things. /shrug


fs.com sells primarily b2b. Account managers are normal and customary.

Just decline politely. They are not a bad company in that regard.

I have my issues with FS product itself, as it can be spotty sometimes in terms of compatibility and repeatability (e.g. getting the same optics firmware every time over the course of a couple years) but they typically handle exceptions and problems quite well. Via your account manager contact.

Weird reason to hate a company, imo. Would be far different if they continued to spam you with phone calls/e-mails after you declined the request.

Sounds like both parties dodged a bullet.


Right, but sometimes your account manager's job is to manage a giant RMA as a result of their manufacturing department f'ing up. So while I am greatful she did a good job, I would have preferred to not need an account manager at all...


People in the industry would know that QNX has been around since the 90s (or 80s?) as a very solid embedded GUI platform. They're a company that doesn't need to prove their credentials.

I'd agree using qnx.software rather than qnx.com is kinda dumb though.


Sure, it's been around 40 years, but it's not like old companies haven't changed owners many times. So, for instance, QNX is now part of Harman which is part of Samsung.


I thought that QNX was acquired by / is still developed by BlackBerry?


Seems you are right. See how complicated it is? :)


Indeed. And it has happened before that well-known brands change owners and suddenly push new products with certain risks attached for the user. That's all I wanted to point out, and for QNX it would be a very easy way to build trust by having this kind of information (or imprint) on their website.


So it's an elaborate front by South Korea instead.


You're joking but the north korea intrusions are factually established and an ongoing security risk.


That seems worth suggesting to the acme working group mailing list, if it hasn't already been discussed there.


You'd get those benefits from traditional dependencies if you copy them in and never update. Is an AI dependency going to have the equivalent of "upstream fixes"?


Probably? LLMs will train on fixes, then if you run the code through the LLM again to fix it.


AWS customers have to pay for outbound traffic. Is there a way to get them to send you (or cloudflare) huge volumes of traffic?


yeah, could use a free worker


free workers only get 100k reqs per day or something


A KB zip file can expand to giga / petabytes through recursive nesting - though it depends on their implementation.


thats traffic in the other direction


The main joy of a zip bomb is that it doesn't consume much bandwidth - the transferred compressed file is relatively small, and it only becomes huge when the client tries to decompress it in memory afterwards


It's still going in the wrong direction.


It doesn't matter either way. OP was thinking about ways to consume someone's bandwidth. A zip bomb doesn't consume bandwidth, it consumes computing resources of its recipient when they try to unpack it.


i wouldnt assume someone sending 700 req per minute or so to a single domain repeatedly (likely to the same resources) will bother opening zip files.

the bot in the article is likely being tested (as author noted), or its a very bad 'stresser'.

if it was looking for content grabbing it will access differently. (grab resources once and be on its way).

its not bad to host zip bombs tho, for the content grabbers :D nomnom.

saw an article about a guy on here who generated arbitrary pngs or so. also classy haha.

if u have a friendly vps provider who gives unlimited bandwidth these options can be fun. u can make a dashboard which bot has consumed the most junk.


This is using the builtin compression in http:

  Transfer-Encoding: gzip


nearly every http response is gzipped. unpacking automatically is a default feature of every http client.


Accept-Encoding i think would be logical on scrapers these days but maybe its not helpful idk. server should adhere to what client requests afaik.


I know. I was pointing out that it doesn't matter what it consumes if it's going the wrong way to begin with.


With Rust there are ways to do that on embedded (no heap). A wrapper StaticCell holds the allocation, then when you are ready you intialise it with the inner value. From then on work with a mut reference to the inner value. Being a bit verbose is the main downside AFAIK.

https://github.com/embassy-rs/static-cell


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: