• 0 Posts
  • 13 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle


  • If it were that easy, this would have been solved everywhere already. A day or two is almost certainly not enough, you also have to do adjacent apartments (whose inhabitants probably aren't going to be very happy, especially if they have to leave for the fifth time), your map can show that it affects like every other building (especially when it's a large apartment block), the temporary housing is at risk of becoming infested too, which will make people fear being there, etc.

    It actually sounds a lot like zero covid - simple on paper, you try it, you find out it doesn't really work, and then you're left with the choice to either change strategy or try to go harder and cram it through regardless.




  • realharo@lemm.eetoRust@programming.devThe ???? operator
    ·
    edit-2
    1 year ago

    I think the issue with this is that the code (https://docs.rs/nix/0.27.1/src/nix/lib.rs.html#297) allocates a fixed-size buffer on the stack in order to add a terminating zero to the end of the path copied into it. So it just gives you a reference into that buffer, which can't outlive the function call.

    They do also have a with_nix_path_allocating function (https://docs.rs/nix/0.27.1/src/nix/lib.rs.html#332) that just gives you a CString that owns its buffer on the heap, so there must be some reason why they went this design. Maybe premature optimization? Maybe it actually makes a difference? 🤔

    They could have just returned the buffer via some wrapper that owns it and has the as_cstr function on it, but that would have resulted in a copy, so I'm not sure if it would have still achieved what they are trying to achieve here. I wonder if they ran some benchmarks on all this stuff, or they're just writing what they think will be fast.




  • Clickbait title.

    The packages were collectively downloaded 963 times before they were removed. The rogue packages include names like "noblox.js-vps," "noblox.js-ssh," and "noblox.js-secure," and they were distributed across specific version ranges

    Is there any indication that anyone actually installed these, other than some bots that auto download all packages and such?

    You would have to really go out of your way to get infected by stuff like this.

    That being said, there are things npm could do to try to auto-detect "risky" packages (new, similar name to existing projects, few downloads, etc.) and require an additional layer of confirmation, or something like that.