The Rust language itself went 1.0 in 2015. And yet, almost 5 years later, at least in my anecdotal assessment talking to and reading things written by current or potential users, there is still a sense that the language is still in some way unfinished and a bit rough around the edges. I sympathize with these concerns. There are various language-level issues which are partly to blame for this. The…
A post by Stephen Diehl about Facebook Libra is making the rounds this morning. It makes a number of claims about flaws in the software. Many of these claims are factually inaccurate. I consider it to be a gish gallop that bombards you with a bunch of negative claims, many of which are false or at best, specious. For context, I am a contributor to OpenLibra , a group independent of Facebook (or…
I’ve been a day-to-day Rust user for nearly 5 years now. In that time I’ve perpetually felt like Rust is “the language that will be awesome tomorrow”. Rust has always felt like it had so much promise and potential, but if you actually sat down and tried to use it, the result was akin to trying to assemble a complex mechanism but you were always missing a few pieces. I managed to suffer through it…
NOTE: For more background including a brief introduction to Tether itself, see part 1 of this series: The Tether Conundrum: A Quick Backstory . This post will largely assume you have read that first, or are at least familiar with the material it covers. Also thanks to Bitfinex'ed for surfacing much of the material covered in this post. There have been plenty of developments surrounding Tether in…
NOTE: This post is fourth in a series I’ve written about Bitcoin, including The Death of Bitcoin , On the dangers of a blockchain monoculture , and A tale of two cryptocurrencies: Ethereum and Bitcoin’s ongoing challenges . I am a former HODLer , present nocoiner , and perpetual Bitcoin bear, so take that for what you will. Well, the nocoiner part is a bit of a lie: I have a JPCoin . Figure 1: If…
It seems there is some drama in the Rust community regarding Ashley Williams’ recent appointment to the Rust Community Team. Did Ashley violate the Node.js Code of Conduct, and is there an active censorship effort underway by the Rust Core Team to silence any dissenting voices and appoint Ashley as evil demon goddess overlord for life? It’s a Rust Conspiracy! The accusers are applauding those who…
For the past several months I have been hacking on not just one, but five encryption libraries in five different languages (Go, Python, Ruby, Rust, and TypeScript). Tall order, I know. And worse, these libraries implement what I believe is a novel cryptographic construction. Are you terrified yet? Yes, I’m implementing novel cryptography, in several languages at that, but I’d like to convince you…
Memory safety won’t fix shell escaping bugs. Memory safety won’t fix logic bugs. Memory safety will not prevent an attacker who has obtained your HMAC key from forging a malicious credential that, when deserialized, can call arbitrary Ruby methods (yes, this was a real vulnerability in older versions of Rails). Memory safety will not prevent a federated identity system which uses XML-based…
WhatsApp was the subject of a recent Guardian article making claims of a “backdoor” stemming from a “bug” in the way WhatsApp handles key rotations for users. The problem? WhatsApp will automatically transmit messages after the recipient’s key has changed without first asking the sender to confirm the new key is genuine. Far from being a “bug” or “backdoor” (a claim so wrong I am sure hoping the…
Wouldn’t it be nice if your password manager didn’t need a database? Instead of synchronizing a password vault between your devices, you could use the magic of cryptography to magically transform a master password into a unique password for each site. There have been a numerous and ever growing implementations of this idea . Much of the marketing material for these tools talks about how using a…