Hacker News: heinrich5991

The unreasonable effectiveness of LLMs for auditing Rust code

heinrich5991 — Sun, 21 Jun 2026 10:06:31 +0000

Article URL: https://shnatsel.medium.com/the-unreasonable-effectiveness-of-llms-for-auditing-rust-code-d4df8bf0afd3

Comments URL: https://news.ycombinator.com/item?id=48617385

Points: 2

# Comments: 0

New comment by heinrich5991 in "Twenty One Zero-Days in FFmpeg"

heinrich5991 — Sat, 13 Jun 2026 12:06:25 +0000

Rust enables overflow checking in debug mode, you can (and I do) enable it in release mode as well.

Rust's default integer overflow in release mode is defined as well, it'll just wrap around. This makes it less likely to result in a vulnerability (unless you start writing unsafe Rust).

New comment by heinrich5991 in "Stop MitM on the first SSH connection, on any VPS or cloud provider"

heinrich5991 — Mon, 11 May 2026 08:04:34 +0000

Example of a nation state attacker that risked discovery and got discovered: https://notes.valdikss.org.ru/jabber.ru-mitm/.

New comment by heinrich5991 in "France moves to break encrypted messaging"

heinrich5991 — Sat, 09 May 2026 23:10:43 +0000

This article incorrectly implies that Telegram is end-to-end encrypted, by putting it in the same line as WhatsApp and Signal.

Telegram doesn't even try to be end-to-end-encrypted by default. WhatsApp claims to be end-to-end-encrypted, but it's not open-source, Signal is end-to-end-encrypted.

New comment by heinrich5991 in "Migrating to the EU"

heinrich5991 — Mon, 23 Mar 2026 11:20:55 +0000

I've used https://migadu.com/ before. Not EU, but EEA (Switzerland).

New comment by heinrich5991 in "US plans online portal to bypass content bans in Europe and elsewhere"

heinrich5991 — Fri, 20 Feb 2026 09:41:35 +0000

Works for me.

New comment by heinrich5991 in "SocketAddrV6 is not roundtrip serializable"

heinrich5991 — Sun, 16 Nov 2025 22:32:51 +0000

Doesn't work on my Arch Linux. Neither does pinging ::ffff:127.0.0.1. Pinging 127.0.0.1 and ::1 works.

New comment by heinrich5991 in "The International Criminal Court wants to become independent of USA technology"

heinrich5991 — Thu, 30 Oct 2025 14:26:24 +0000

https://archive.today/8BuB9

New comment by heinrich5991 in "Matrix Conference 2025 Highlights"

heinrich5991 — Tue, 21 Oct 2025 07:03:30 +0000

The good thing is that verifying the other contact is invisible to the server in Signal. This means that it's stochastically sufficient that a few people do check their contacts in order to see whether there is any widespread MITMing going on.

New comment by heinrich5991 in "Matrix Conference 2025 Highlights"

heinrich5991 — Tue, 21 Oct 2025 07:01:20 +0000

Telegram isn't end-to-end encrypted btw, so when law enforcement asks for data, Telegram actually has it.

New comment by heinrich5991 in "Matrix Conference 2025 Highlights"

heinrich5991 — Mon, 20 Oct 2025 13:50:02 +0000

It's less encrypted. E.g. you'd think that emoji reactions are end-to-end-encrypted (as they are in Signal). But they aren't[1]. I expect similar implementation issues wrt. the encryption in Matrix.

[1]: https://github.com/matrix-org/matrix-spec/issues/660

New comment by heinrich5991 in "Most users cannot identify AI bias, even in training data"

heinrich5991 — Sun, 19 Oct 2025 06:49:22 +0000

Can you give me an example? Works for me on https://chatgpt.com/.

New comment by heinrich5991 in "DDoS Botnet Aisuru Blankets US ISPs in Record DDoS"

heinrich5991 — Tue, 14 Oct 2025 08:35:41 +0000

Same happens to our online game: https://news.ycombinator.com/item?id=28675094. Not sure what it is about online games that attracts DDoSes.

New comment by heinrich5991 in "A macOS terminal command that tells you if your USB-C cable is bad"

heinrich5991 — Wed, 08 Oct 2025 09:34:02 +0000

Not what OP meant, but there's a project doing what you ask for: https://justine.lol/cosmopolitan/. It's quite interesting. :)

New comment by heinrich5991 in "How the AI bubble ate Y Combinator"

heinrich5991 — Tue, 30 Sep 2025 15:11:22 +0000

https://archive.is/lMpbi

New comment by heinrich5991 in "F-Droid and Google’s developer registration decree"

heinrich5991 — Mon, 29 Sep 2025 14:46:20 +0000

No, your private non-commercial web page doesn't need an Impressum AFAIK. Once you add ads to generate (small) income, it becomes commercial, though.

New comment by heinrich5991 in "Mirror Ball Emoji Proposal (2018) [pdf]"

heinrich5991 — Thu, 21 Aug 2025 06:26:22 +0000

U+1FAA9

New comment by heinrich5991 in "Consider using Zstandard and/or LZ4 instead of Deflate"

heinrich5991 — Tue, 05 Aug 2025 20:08:23 +0000

Most of the comments on that issue are from this year.

New comment by heinrich5991 in "Rsync's defaults are not always enough"

heinrich5991 — Tue, 03 Jun 2025 12:35:35 +0000

Working link: https://github.com/openzfs/zfs/issues/14536.

New comment by heinrich5991 in "A thought on JavaScript "proof of work" anti-scraper systems"

heinrich5991 — Wed, 28 May 2025 08:48:24 +0000

> I'm a bit confused. Is anyone's website currently being DDOS'd by scrapers for LLMs or is this a hypothetical?

Yes, there are sites being DDoSed by scrapers for LLMs.

> If you can't handle the traffic of one request per page per week or month, I think there are bigger problems to solve.

This isn't about one request per week or per month. There were reports from many sites that they're being hit by scrapers that request from many different IP addresses, one request each.