• 1 Post
  • 62 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle





  • When I was in highschool we toured the local EPA office. They had the most data I’ve ever seen accessible in person. Im going to guess how much.

    It was a dome with a robot arm that spun around and grabbed tapes. It was 2000 so I’m guessing 100gb per tape. But my memory on the shape of the tapes isn’t good.

    Looks like tapes were four inches tall. Let’s found up to six inches for housing and easier math. The dome was taller than me. Let’s go with 14 shelves.

    Let’s guess a six foot shelf diameter. So, like 20 feet circumference. Tapes were maybe .8 inches a pop. With space between for robot fingers and stuff, let’s guess 240 tapes per shelf.

    That comes out to about 300 terabytes. Oh. That isn’t that much these days. I mean, it’s a lot. But these days you could easily get that in spinning disks. No robot arm seek time. But with modern hardware it’d be 60 petabytes.

    I’m not sure how you’d transfer it these days. A truck, presumably. But you’d probably want to transfer a copy rather than disassemble it. That sounds slow too.




  • I work on a language for a living. It’s fun! It’s a job. But it’s fun.

    I’m not super involved with the traditional language parts. The design and parsing and optimization. I spent most of my time on the runtime. We’re embedded in another big system and there’s a lot of things to make it nice.

    I spent the day wiring up more profile information for the times the runtime has to go async. Then I’ll fix up some docs generation stuff. Eventually I’ll get back to fun shadowing edge case in the new syntax I’m building.





  • I think the technologies are pretty bubble based. We are 80/15/5 Mac/Linux/Windows and it’s been 15 years since I worked on a software team that’s thats mostly windows. But I talk to them from time to time. But if anything Mac feels underrepresented compared to my bubble.

    I admit I’m probably biased in favor of believing the survey is representative. I work on one of the databases.

    Speaking of databases, I don’t work on SQL Server but can see the appeal. It implements a huge array of features and it’s documentation is pretty good. Folks have told me it’s a lovely database to use.








  • I dunno about stdx as a solution. It’s just not a big enough list.

    At work we build a big java thing and we:

    • Manually import all dependencies, including transitive dependencies.
    • Bless them by committing their hash to our repo. I think the cargo lock file does something similar.
    • Audit the dependencies by hand. Sometimes that’s reading them all and sometimes thats less. Honestly, it’s often less. A few times it’s being members of the upstream community.
    • Don’t allow running as root
    • Drop all permissions we don’t need with seccomp including reading a bunch of stuff
    • Sandbox each thread based on what’s on the stack. Untrusted code can do less stuff.

    It’s still not enough. But it helps.

    Maybe a web of trust for audited dependencies would help. This version of this repo under this hash. I could see stdx stuff being covered by the rust core folks and I’m sure some folks would pay for bigger webs. We pay employees to audit dependencies. Sharing that cost via a trusted third party or foundation or something feels eminently corporate. Maybe even possible.