Hacker Newsnew | past | comments | ask | show | jobs | submit | maxloh's commentslogin

I don't find it really viable. There are so many ways to express the same question, and context does matter: the same prompt becomes irrelevant if the previous prompts or LLM responses differ.

With the cache limited to the same organization, the chances of it actually being reused would be extremely low.


In a chat setting you hit the cache every time you add a new prompt: all historical question/answer pairs are part of the context and don’t need to be prefilled again.

On the API side imagine you are doing document processing and have a 50k token instruction prompt that you reuse for every document.

It’s extremely viable and used all the time.


I’m shocked that this hasn’t been a thing from the start. That seems like table stakes for automating repetitive tasks.

It has been a thing. In a single request, this same cache is reused for each forward pass.

It took a while for companies to start metering it and charging accordingly.

Also companies invested in hierarchical caches that allow longer term and cross cluster caching.


It gets used massively in a conversation, also anything that has a lot of explain actions in the system prompt means you have a large matching prefix.

Think of it as a very useful prefix match. If all of your threads start with the same system prompt, you will reap benefits from prompt caching.

Frankly, I don't understand why someone would even try to crawl Hacker News.

There is an official dump which doesn't even require parsing HTML at all: https://console.cloud.google.com/marketplace/details/y-combi...


These are not, er, experienced crawlers.

https://www.youtube.com/watch?v=Sbpl3ywNlpA#t=56s


How conformant is this, compared to e.g. mypy?

It's not great, but in this very thread there's a person from the conformance team that says that it shouldn't sway your choice too much.

https://htmlpreview.github.io/?https://github.com/SimonSchic...



From Allen AI's Discord:

*Introducing Molmo 2* : State-of-the-art video understanding, pointing, and tracking

Last year, Molmo helped push image understanding forward with pointing—grounded answers you can verify. Now, *Molmo 2 *brings those capabilities to video—so the model doesn’t just answer questions, it can show you where & when something is happening.

On major industry benchmarks, Molmo 2 *surpasses most open multimodal models* and even *rivals closed peers* like Gemini 3 Pro and Claude Sonnet 4.5.

Molmo 2 returns pixel coordinates + timestamps over videos and coordinates over images, enabling: *◘ Video + image QA ◘ Counting-by-pointing ◘ Dense captioning ◘ Artifact detection ◘ Subtitle-aware analysis …and more!*

Three variants depending on your needs: *Molmo 2 (8B)*: Qwen 3 backbone, best overall performance *Molmo 2 (4B)*: Qwen 3 backbone, fast + efficient *Molmo 2-O (7B)*: Olmo backbone, fully open model flow

Demos: *Counting objects & actions* (“How many times does the ball hit the ground?”)—returns the count plus space–time pointers for each event: https://www.youtube.com/watch?v=fvYfPTTTZ_w *Ask-it-anything long-video QA* (“Why does the player change strategy here?”)—points to the moments supporting the answer: https://www.youtube.com/watch?v=Ej3Hb3kRiac *Object tracking* (“Follow the red race car.”)—tracks it across frames with coordinates over time: https://www.youtube.com/watch?v=uot140v_h08

We’ve also *significantly upgraded the Ai2 Playground* You can now upload a video or multiple images to try summarization, tracking, and counting—while seeing exactly where the model is looking.

Try it and learn more: ▶ Playground: https://playground.allenai.org/ ⬇ Models: https://huggingface.co/collections/allenai/molmo2 Blog: https://allenai.org/blog/molmo2 Report: https://allenai.org/papers/molmo2 API coming soon


The Taiwanese support for pro-independence actually skyrocketed in 2019. I don't think anything bad happening to Hong Kong activists would be a good look for China.

https://esc.nccu.edu.tw/upload/44/doc/6963/Tondu202506.png


Yes in 2019, look what's happening to TW politics now, green fatigue, DPP anti PRC rhetoric secured a couple elections but now the island new gen is increasingly jaded and post political because they realize the DPP Anti PRC card isn't improving their QoL. VS a few years post getting crushed, HKers also post political who realized they can simply live much better lives by embracing mainland (SZ) and not be such nativist/supremecist. Reality is democratic and shitlib politics is structurally failling everywhere, if the authoritarian gives you a priveledged deal, many TWer might eventually take it. Just look at HK reaction to recent fire, HKers lamenting how much more SZ and mainland tier1s have their shit together. The vibe is changing. PRC needs carrot and stick for TW, like how it's always been. Let's be real, in a post TW crisis there will be winners and losers, TWers need to see how winners are treated (tier1 affordtable life style) and how losers are treated (Gaza). Nevermind DPP just banned XHS because they realize they're losing culture war to mainland.

The bubble is strong with this one...

[flagged]


This comment broke my brain. I have no idea what you are trying to say. It could be sarcasm, but that concept is now obsolete, so I have no idea.

Care to explain?


When look past liberal world order propaganda, aka the libtard bubble, a lot of geopolitical reality seem to bias toward PRC, not because PRC is extra prescient or competent (even though they kind of are) but because libtard delude themselves into false models of how world works.

Pertaining to topic, current reality is HK isn't going to be rebellious stain on 1C2S like LIO types wanted, it's thoroughly cowed and new gen of HKers are going to be patriotic as fuck. For the simple reason that patriotic education / indoctorination actually works really well as statecraft tool. TW democratic disallusionment is growing YoY, and eventually they're going to have to reckon between being privledged cowed like HKers or becoming Gaza - it wasn't Israel begging for ceasefire and Israel has less autonomy over Gaza than PRC over TW in a cross strait scenario.


Wow. That's a lot of modern keywords you have there. Now I am curious about your brain/point of view.

1. When you say "libtards," do you mean non-authoritarian democracy believers? If not, then what does that mean exactly?

2. How do you see Taiwan's sovereignty in the next few years? Will the CCP kill many, and put the rest into re-education camps, or will that be entirely unnecessary?


Liberal world order / zombie democracy gud types. My brain / pov is just boring realism and recognizing a lot of strategic trendlines is going in PRC favor.

TW fine until mid 2030s, tldr is that is around crossing point where current baked in procurement / strategic investments will give PRC potentially unassailable geostrategic advantages vs US+co. If shit hits fan it will likely be around then.

CCP / at least Xi will be magnanmous because he's just a dove / nice boy. But war is war, no one really controls escalation, gaza is not first choice (especially for softie like Xi) but when ability to do a TW gaza, it is on the table and sometimes inevitable result from escalation dynamics.

How postwar TW gets treated depends on nature of capitulation, i.e. hearts and minds vs pacfication, if PRC paid high price in blood then domestic audience will want blood. But most of effort is patriotic education, i.e. school curriculum pro PRC material and next gen sentiment will automatically shift. Mass reeducation wasn't neccessary in HK who was broken relatively bloodlessly, and now new gen of kids shaped from PRC textbooks are going to have different brains than those shaped by British whose position is going to continue getting clowned on in public messaging until it becomes new norm. But would the extra intransient elements be whisked to mainland for re3ducation, probably - explicitly endorsed by PRC french ambassador at one point.

Ultimately how TW seperatist gets treated is matter of petty PRC bloodlust and local TW bloodlust. As with political jockeying during upheaval, anticipate a lot of pro seperatist TWers simply getting bumped off by local internicine factional violence for getting TW into shitfest in first place. The amount of organized crime influence in TW is too damn high, and all of them know they can instantly transform from gangster to legitimate political power post occupation by getting on Beijings good side, and some are actively being groomed for the role via United Front, see triad leading Chinese Unification Promotion Party (CUPP). They're going to be bashing skulls on behalf of Beijing.


Thanks for the reply. Very interesting reading.

If I may ask, what type of global order would you like to see in your lifetime, now that Pax Americana has ended?


TBH whatever comes, comes. What I want to see in context to what I think is coming: IMO US/PRC bipolarity. The most favourable result for the world is to have 2 alternative, comprehensive tech stacks to develop from instead of depending on whims of single hegemon who controls entire tech tree. PRC/US/developed west will be fine, as in they can collapse/decline so far, but not to subsistent developing country levels due to capita accumulation. They can continue to jockey for podium positions. All the poors need to buy cheap Chinese renewables and capital equipment and up their development game which has never been more accessible. For the big players, peaceful transition / handover of regional hegemony / spheres of influence but that's a tall ask.

My issue is that we have nukes... a lot of countries have nukes. We are just a swiss cheese model alignment from the end of all that we love.

If Trump traded 1/3 of Ukraine for RU and USA disarming, then even I would happily hand him the Peace Prize.

That is the opposite of what happened. I am curious what the future archeologists will see when they dig through the ashes.


If say China failed to “Gaza” Taiwan - because, well, China has never successfully launched a maritime invasion in its long history - would your world-view change? Or are you a ride-or-die Central Committee man, every other thought is impossible, the province of us “liberal retards”?

Person A claims US overmatch can Gaza Havana.

Person B claims Bay of pigs failed / maritime invasion hard.

Person B argument retarded because US doesn't need to invade to Gaza Cuba.

Person B is admitting they lack 101 subject matter knowledge, to even bring up maritime invasion (because that's the context PRC/TW scenario is presented in lay news) is kind of so stupid it's not even wrong when talking about razing TW into Gaza.

TLDR PRC doesn't need to invade TW to Gaza it. They can now do it trivially from mainland fires. That's the current military reality. There doesn't need to be single foot on the ground to starve island with 90% energy and calorie import needs, and there's functionally nothing US+co can do about it, at least not for next 10+ years where procurement is locked in, and assuming PRC MIC somehow regress. So when I say PRC can Gaza TW, I mean statistically, with the currently correlation of forces across the strait, PRC can conventionally level TW like Gaza, without any amphib effort, just like US can simply glass Havanna from CONUS. That should not be controversial statement if you understand the actual #s involved. I mean delulu libtards are free to think delulu impossible thoughts, but some of them are, in fact functionally in the realm of impossible.


What you are stating is exactly the viewpoint of the CCP (or any other authoritarian governments).

Everyone who advocates for basic human rights, as written in the UN's basic human rights charter, is considered a traitor, a threat to national "security", or a terrorist. They want absolutely obedient people who don't know about their own rights.


No, literally no soverign country would allow a region to operate without national security umbrella for decades, PRC was retardly patient, magnanoumous so to let HK fuck around for so long. The fact is nativist HKers tried to carve a NSL state of exception and they correctly got their shit kicked in once PRC ran out of patience. Human rights > national security is frankly absurdly unserious position to take. It's historically more normal to throw HK into the torment nexus than to have it exist without NSL coverage, that's level of security vacuum is functionally fail state behavior.

UN particapation is indeed varying level of compardour behavior, but also frequently not since you know even independant raprateurs go through filtering process frequently supported to host country to represent their geopolitical interests.

What is obviously traitorous, is shaking hands with ex head of CIA, we lie we cheat we steal Pompeo, during ongoing Sino-US geopolitical cold war, while advocating for sanctions on your own people. That's not obedience, that's treason. Like even fucking obedient people know having the right to commit treason, which Lai did, is retarded. A position an unforutnate amount of retarded HKers took to heart and frankly need to be reeducated out of.


I can't tell if this is an advocate for Chinese dictatorship or simply a terminally online foreign policy expert hobbyist. The grammar is signature pol/ncd.

Can't I be both. This just primarily PRC geopolitics shitpost account (because ppl get wierdly stalkery if I talk PRC geopolitics on main account) along with some lifting. The lack of grammar and care is because talking about geopolitics online doesn't warrant higher effort.

Regardess above comment isn't even about PRC system. It's about how HKers and their supporters who thinks it's reasonable for city of 7m to have no NSL coverage while serving as intelligence hub for PRC geopolitical adversaries is delulu and unserious position. Anyone rubbing 2 brain cells together should understand how anomlous and not sustainable that arrangement was, and indeed it was never suppose to be that way if not for sheer HK arrogance to skirt NSL implementation requirements and PRC patience.


> No, literally no soverign country would allow a region to operate without national security umbrella for decades...

In other "normal" sovereign countries, the "national security umbrella" is defined by representatives voted by the people. Suspected violators are prosecuted by a fair court, with a jury determining the validity of the charges. I don't think either of those is the case for Hong Kong.

> Human rights > national security is frankly absurdly unserious position to take.

Again, in any state with decent democracy, the law states otherwise. A nation is formed to protect the rights of its people, not to take those rights away.

> What is obviously traitorous, is shaking hands with ex head of CIA, we lie we cheat we steal Pompeo, during ongoing Sino-US geopolitical cold war, while advocating for sanctions on your own people. That's not obedience, that's treason.

That is rarely considered a national security case in any decent democratic country. He was actually exercising his freedom of speech, as defined in the UN's basic human rights charter I mentioned earlier. Limiting which political viewpoints are "allowed" is a classical, textbook example of authoritarianism.


List one normal decent democracy without NSL law. You will find the answer is none. There's a jury in some HK NSL law (for low level protestor), people got off for light greviances in the past despite Beijing protest. Lai gettign 3 judge speedrun because he's simply an obvious comprador traitor.

And let's not forget this NSL dalying was an failure of HK making, i.e. basically failed state behavior that HK incompetence generated. Frankly that's demonstration HK isn't ready for democracy at all.

And no a national is formed to sustain the nation, eitherway you can't protect people without NSL... and btw that's what PRC did, protect 1400m people from HK traitors by closing their treason lifehack loophole. It's basic statecraft.

Yes and trading secrets and espionage with geopolitical adversary is muh freedom of speech and not espionage. Again unserious, exactly why HK needs to be reeducated. You're conflating disset (speech) with collusion (treason), Lai colluded, which is unprotected speech anywhere.


> List one normal decent democracy without NSL law. You will find the answer is none.

The problem is not about the law itself. It is about how the law is defined, and moreover, the system of checks and balances. In a decent democracy, the national security law does not override the people's rights written in the constitution. The government is bound by the law to uphold due process and to respect people's basic rights, even if the suspect may have broken a law. While in authoritarian states, the constitution is basically just a joke. Don't you know China's absurd history of human rights violations?

> Lai gettign 3 judge speedrun because he's simply an obvious comprador traitor.

A quick search states otherwise. He was prosecuted by three government-picked judges, and there was no jury, which violates the standards of a fair trial.

https://www.japantimes.co.jp/news/2025/12/15/asia-pacific/po...

> And let's not forget this NSL dalying was an failure of HK making, i.e. basically failed state behavior that HK incompetence generated. Frankly that's demonstration HK isn't ready for democracy at all.

Democracy means the people are in power, not the dictator. If the Hong Kong people can only vote for someone that Beijing favors, then that is not democracy. It is not possible to have a democratic system that a dictator has control over, by definition.

> ...that's what PRC did, protect 1400m people from HK traitors...

If they really wanted to protect their people, they would create a true democratic system for the city. There is no reason any western country would put sanctions on a democratic entity. And don't forget the fact that they fought really hard to gain control of the city, only to later claim it is a "huge risk to national security".

> You're conflating disset (speech) with collusion (treason), Lai colluded, which is unprotected speech anywhere.

There are no normal countries that would put people into jail for mere political speech as "treason." Such laws are only applied to acts like espionage or leaking classified information, and even those cases are bound by checks and balances.


No the problem is not process but sheer absence of NSL law and ineptitude or indifference of HKers to implement one for 20 years despite being their 1C2S obligation. If they couldn't pass NSL law in 20 years they don't deserve full democracy full stop, which btw they didn't functionally have. Also BTW know PRC killed less HKers than British did in HK during past protests. Now HK simply getting the less lethal more benevolent boot. PRC human rights in HK > UK.

> A quick search states otherwise

That's literally what I said, a 3 judge speed run. As for jury requirement, tell that to authoritarian Netherland.

> no reason any western country would put sanctions on a democratic entity

I'm just going to leave this trivially disproven quote here for posterity. It's 2025, you can trivially ask an LLM for a list, and we're not talking about western countries, we're talking about US dollar system access which US has been sanction happy with.

> mere political speech

Again, I literally distinguished between collusion vs speech. Lai working with Pompeo to sanction HK legistlators is collusion beyond speech. Which he called for publically. Plenty of cases of people thrown in jail for just speech not even in realmn of treason in west. Anyway, this is my last response, seperate libtard fantasy with libtard reality. Reality is HK is finally a normal jurisdiction with NSL coverage, which regardless of butmuhdemocracy in execution is still more accepted normal than not.


‘There is no reason any western country would put sanctions on a democratic entity.’

Bollocks, there is a very good chance that the USA is going to do exactly that to the Republic of South Africa.


I think I saw this template before. What software did you use to create the book?

Pragmatic has an inhouse book compiler. Most authors write in markdown and there's some special XML features you can use as well for it. Of course code linking is a first class feature.

It's a pretty nice system, actually.


Exactly. I wrote in (flavored) Markdown with occasional XML inserts.

They test Rust coreutils against the GNU coreutils test suite, with 87.75% of the test cases passing.

https://uutils.github.io/coreutils/docs/test_coverage.html


> The new runtime/secret package lets you run a function in secret mode. After the function finishes, it immediately erases (zeroes out) the registers and stack it used.

I don't understand. Why do you need it in a garbage-collected language?

My impression was that you are not able to access any register in these language. It is handled by the compiler instead.


This is about minimizing attack surface. Not only could secrets be leaked by hacking the OS process somehow to perform arbitrary reads on the memory space and send keys somewhere, they could also be leaked with root access to the machine running the process, root access to the virtualization layer, via other things like rowhammering potentially from an untrusted process in an entirely different virtual context running on the same machine, and at the really high end, attacks where the government agents siezing your machine physically freeze your RAM (that is, reduce the physical temperature of your RAM to very low temperatures) when they confiscate your machine and read it out later. (I don't know if that is still possible with modern RAM, but even if it isn't I wouldn't care to bet much on the proposition that they don't have some other way to read RAM contents out if they really, really want to.) This isn't even intended as a complete list of the possibilities, just more than enough to justify the idea that in very high security environments there's a variety of threats that come from leaving things in RAM longer than you absolutely need to. You can't avoid having things in RAM to operate on them but you can ensure they are as transient as possible to minimize the attack window.

If you are concerned about secrets being zeroed out in almost any language, you need some sort of support for it. Non-GC'd languages are prone to optimize away zeroing out of memory before deallocation, because under normal circumstances a write to a value just before deallocation that is never effectfully read can be dropped without visible consequence to the rest of the program. And as compilers get smarter it can be harder to fool them with code, like, simply reading afterwards with no further visible effect might have been enough to fool 20th century compilers but nowadays I wouldn't count on my compiler being that stupid.

There are also plenty of languages where you may want to use values that are immutable within the context of the language, so there isn't even a way to express "let's zero out this RAM".

Basically, if you don't build this in as a language feature, you have a whole lot of pressures constantly pushing you in the other direction, because why wouldn't you want to avoid the cost of zeroing memory if you can? All kinds of reasons to try to avoid that.


In theory it prevents failures of the allocator that would allow reading uninitialized memory, which isn't really a thing in Go.

In practice it provides a straightforward path to complying with government crypto certification requirements like FIPS 140 that were written with languages in mind where this is an issue.


Go has both assembly language and unsafe pointer operations available. While any uses of these more advanced techniques should be vetted before going to production, they are obviously able to break out of any sandboxing that you might otherwise think a garbage collector provides.

And any language which can call C code that is resident in the same virtual memory space can have its own restrictions bypassed by said C code. This even applies to more restrictive runtimes like the JVM or Python.


That's kind of the point of making it (relatively easily) accessibly... in order to ensure that secrets are wiped from memory as quickly as reasonable. This reduces a lot of potential surface area for potential attack.

I used to not really see the need for this level of detail on things... then you see useful (IE in the wild exploits) for even complex factors like CPU branch prediction (for a while now), and the need starts to become much more clear.


The Go runtime may not be the only thing reading your process’ memory.

This would potentially protect against other process reading memory via some system compromise - they would be able to get new secrets but not old ones.

Go is not a memory safe language. Even in memory safe languages, memory safety vulnerabilities can exist. Such vulnerabilities can be used to hijack your process into running untrusted code. Or as others point out sibling processes could attack yours. This underlying principle is defense in depth - you make add another layer of protection that has to be bypassed to achieve an exploit. All the chains combined raise the expense of hacking a system.

Respectfully, this has become a message board canard. Go is absolutely a memory safe language. The problem is that "memory safe", in its most common usage, is a term of art, meaning "resilient against memory corruption exploits stemming from bounds checking, pointer provenance, uninitialized variables, type confusion and memory lifecycle issues". To say that Go isn't memory safe under that definition is a "big if true" claim, as it implies that many other mainstream languages commonly regarded as memory safe aren't.

Since "safety" is an encompassing term, it's easy to find more rigorous definitions of the term that Go would flunk; for instance, it relies on explicit synchronization for shared memory variables. People aren't wrong for calling out that other languages have stronger correctness stories, especially regarding concurrency. But they are wrong for extending those claims to "Go isn't memory safe".

https://www.memorysafety.org/docs/memory-safety/


I’m not aware of any definition of memory safety that allows for segfaults- by definition those are an indication of not being memory safe.

It is true that go is only memory unsafe in a specific scenario, but such things aren’t possible in true memory safe languages like c# or Java. That it only occurs in multithreaded scenarios matters little especially since concurrency is a huge selling point of the language and baked in.

Java can have data races, but those data races cannot be directly exploited into memory safety issues like you can with Go. I’m tired of Go fans treating memory safety as some continuum just because there are many specific classes of how memory safety can be violated and Go protecting against most is somehow the same as protecting against all (which is what being a memory safe language means whether you like it or not).

I’m not aware of any other major language claiming memory safety that is susceptible to segfaults.

https://www.ralfj.de/blog/2025/07/24/memory-safety.html


Safety is a continuum. It's a simple fact. Feel free to use a term other than memory safety to describe what you're talking about, but so long as you use safety, there's going to be a continuum.

Also, by your definition, e.g. Rust is not memory safe. And "It is true that Rust is only memory unsafe in a specific scenario, but [...]". I hope you agree.


Another canard, unfortunately. "Segfault" is simply Go's reporting convention for things like nil pointer hits. "Segfaults" are not, in fact, part of the definition for memory safety or a threshold condition for it. All due respect to Ralf's Ramblings, but I'm going to rest my case with the Prossimo page on memorysafety.org that I just posted. This isn't a real debate.

> Segfault" is simply Go's reporting convention for things like nil pointer hits.

Blatantly false. From Ralf’s post:

> panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x2a pc=0x468863]

The panic address is 42, a value being mutated, not a nil pointer. You could easily imagine this address pointing to a legal but unintended memory address resulting in a read or write of unintended memory.


No, you can't, and the reason you know you can't is that it's never happened. That looks like a struct offset dereference from a nil pointer, for what it's worth.

https://go.dev/play/p/0fUzmP0cLEa


You’d be wrong. I recommend you reread the blog post and grok what’s happening in the example.

> When that happens, we will run the Ptr version of get, which will dereference the Int’s val field as a pointer – and hence the program accesses address 42, and crashes.

If you don’t see an exploit gadget there based on a violation of memory safety I don’t know how to have a productive conversation.


Please do explain the exploit gadget you're talking about.

> That looks like a struct offset dereference from a nil pointer, for what it's worth.

The 42 is an explicit value in the example code. From what I understand the code repeatedly changes the value assigned to an interface variable from an object containing a pointer to an object containing an integer. Since interface variables store the type of the assigned value, but do not update both type and value atomically a different thread can interpret whatever integer you put into it as a valid pointer. Putting a large enough value into the integer should avoid the protected memory page around 0 and allow for some old fashioned memory corruption.


Rust is susceptible to segfaults when overflowing the stack. Is Rust not memory safe then?

Of course, Go allows more than that, with data races it's possible to reach use after free or other kinds of memory unsafety, but just segfaults don't mark a language memory unsafe.


Go is most emphatically NOT memory-safe. It's trivially easy to corrupt memory in Go when using gorotuines. You don't even have to try hard.

This stems from the fact that Go uses fat pointers for interfaces, so they can't be atomically assigned. Built-in maps and slices are also not corruption-safe.

In contrast, Java does provide this guarantee. You can mutate structures across threads, and you will NOT get data corruption. It can result in null pointer exceptions, infinite loops, but not in corruption.


This is just wrong. Not that you can't blow up from a data race; you certainly can. Simply that any of these properties admit to exploitable vulnerabilities, which is the point of the term as it is used today. When you expand the definition the way you are here, you impair the utility of the term.

Serious systems built in memory-unsafe languages yield continual streams of exploitable vulnerabilities; that remains true even when those systems are maintained by the best-resourced security teams in the world. Functionally no Go projects have this property. The empirics are hard to get around.


There were CVEs caused by concurrent map access. Definitely denials of service, and I'm pretty sure it can be used for exploitation.

> Serious systems built in memory-unsafe languages yield continual streams of exploitable vulnerabilities

I'm not saying that Go is as unsafe as C. But it definitely is NOT completely safe. I've seen memory corruptions from improper data sync in my own code.


Go ahead, talk through how this would be used for exploitation.

I would try to cause the map reallocation at the same moment I'm writing to it. Leading to corrupted memory allocator structures.

Go ahead and demonstrate it. Obviously, I'm saying this because nobody has managed to do this in a real Go program. You can contrive vulnerabilities in any language.

It's not like this is a small track record. There is a lot of Go code, a fair bit of it important, and memory corruption exploits in non-FFI Go code is... not a thing. Like at all.


Go is rarely used in contexts where an attacker can groom the heap before doing the attack. The closest one is probably a breakout from an exposed container on a host with a Docker runtime.

I triggered SSM agent crashes while developing my https://github.com/Cyberax/gimlet by doing concurrent requests.

I'm certain that they could have been used to do code execution, but it just makes no real sense given the context.


If you're certain, demonstrate it. It'll be the first time it's been demonstrated. Message board arguments like this are literally the only place this claim is taken seriously.

Yeah, I can hardly disagree with that sentiment myself.

There are many things that are missing with SVG. For example, putting all the pages in a single file, encryption, forms, etc.

Also note that different browsers might render and print the same SVG differently, which is not ideal for a print-oriented format.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: