Thomas Karpiniec
@octet-stream.net
Tasmanian programmer often writing networking-related Rust. Likes music but mostly posts opinions about computers. Also known as thombles and VK7XT.
TIL Spotify makes heavy use of Ogg Vorbis. Clearly things have changed since the old times when only Very FOSS People were distributing them.
December 22, 2025 at 8:33 AM
TIL Spotify makes heavy use of Ogg Vorbis. Clearly things have changed since the old times when only Very FOSS People were distributing them.
I learnt recently that the PDS oauth flow doesn’t yet support scoping/restricting record access between different appviews (github.com/bluesky-soci...) so I guess be careful about throwing your Bluesky login into sketchy or experimental apps if you care about it a lot.
Proposal: OAuth Scopes · bluesky-social atproto · Discussion #3655
Note: a more complete proposal was published in July 2025: https://github.com/bluesky-social/proposals/tree/main/0011-auth-scopes We’re continuing work on rolling OAuth out to the atproto network. ...
github.com
December 20, 2025 at 7:30 AM
I learnt recently that the PDS oauth flow doesn’t yet support scoping/restricting record access between different appviews (github.com/bluesky-soci...) so I guess be careful about throwing your Bluesky login into sketchy or experimental apps if you care about it a lot.
More things I didn't know about C. I kind of like it. lobste.rs/c/lqlcle
![Screenshot of a forum comment. "The way to write a non-NULL pointer argument in C is"
int t(int a[static 1]) {
return *a;
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:txurc6ueald5d7462bpvzdby/bafkreifl2w2rthkae6xr4wxteow2hosym7rclsrboh76icbbegtarqw2lq@jpeg)
December 19, 2025 at 2:07 AM
More things I didn't know about C. I kind of like it. lobste.rs/c/lqlcle
Tired: Function as a Service
Wired: inetd
Wired: inetd
December 19, 2025 at 12:47 AM
Tired: Function as a Service
Wired: inetd
Wired: inetd
Reposted by Thomas Karpiniec
Rust GCC backend: Why and How - A detailed Article by Guillaume Gomez @imperioworld.bsky.social #Rust #Compilers blog.guillaume-gomez.fr/articles/202...
Rust GCC backend: Why and how
Blog of Guillaume Gomez (Rust GCC backend: Why and how)
blog.guillaume-gomez.fr
December 18, 2025 at 8:05 AM
Rust GCC backend: Why and How - A detailed Article by Guillaume Gomez @imperioworld.bsky.social #Rust #Compilers blog.guillaume-gomez.fr/articles/202...
I grew tired of needing to power cycle my modem by myself so I made a Raspberry Pi do it: tangled.org/octet-stream...
Thanks @leofebey.bsky.social for the assistance finding a suitable relay!
Thanks @leofebey.bsky.social for the assistance finding a suitable relay!
December 18, 2025 at 9:53 AM
I grew tired of needing to power cycle my modem by myself so I made a Raspberry Pi do it: tangled.org/octet-stream...
Thanks @leofebey.bsky.social for the assistance finding a suitable relay!
Thanks @leofebey.bsky.social for the assistance finding a suitable relay!
TIL I've been using git tags wrong since forever, lightweight only
> Annotated tags are meant for release while lightweight tags are meant for private or temporary object labels.
git-scm.com/docs/git-tag
> Annotated tags are meant for release while lightweight tags are meant for private or temporary object labels.
git-scm.com/docs/git-tag
December 18, 2025 at 4:50 AM
TIL I've been using git tags wrong since forever, lightweight only
> Annotated tags are meant for release while lightweight tags are meant for private or temporary object labels.
git-scm.com/docs/git-tag
> Annotated tags are meant for release while lightweight tags are meant for private or temporary object labels.
git-scm.com/docs/git-tag
Reposted by Thomas Karpiniec
If you’re a cryptographer and you got one of these, send me an email.
December 18, 2025 at 1:49 AM
If you’re a cryptographer and you got one of these, send me an email.
Dubious product as it was, Microsoft Recall never had any feature for sending screenshots to a cloud, let alone for AI training. Surprisingly, there are still people who claim otherwise and expect us to take their commentary seriously.
December 17, 2025 at 8:54 AM
Dubious product as it was, Microsoft Recall never had any feature for sending screenshots to a cloud, let alone for AI training. Surprisingly, there are still people who claim otherwise and expect us to take their commentary seriously.
GitHub: *doing its thing*
Fossil users: if y'all ran your test suite before committing you wouldn't be in this situation would you now
Fossil users: if y'all ran your test suite before committing you wouldn't be in this situation would you now
December 17, 2025 at 2:03 AM
GitHub: *doing its thing*
Fossil users: if y'all ran your test suite before committing you wouldn't be in this situation would you now
Fossil users: if y'all ran your test suite before committing you wouldn't be in this situation would you now
Reposted by Thomas Karpiniec
Accord Transactions has been merged to trunk.
This is years of work and research, trillions of test runs.
Strict Serializability isolation across a globally distributed database, for transactions spanning multiple tables and keys, using commodity clocks.
github.com/apache/cassa...
This is years of work and research, trillions of test runs.
Strict Serializability isolation across a globally distributed database, for transactions spanning multiple tables and keys, using commodity clocks.
github.com/apache/cassa...
April 22, 2025 at 11:28 AM
Accord Transactions has been merged to trunk.
This is years of work and research, trillions of test runs.
Strict Serializability isolation across a globally distributed database, for transactions spanning multiple tables and keys, using commodity clocks.
github.com/apache/cassa...
This is years of work and research, trillions of test runs.
Strict Serializability isolation across a globally distributed database, for transactions spanning multiple tables and keys, using commodity clocks.
github.com/apache/cassa...
I realise user agent strings are more lies than truth but it's still funny to me that Safari on Apple Silicon with Tahoe still reports itself as "Macintosh; Intel Mac OS X 10_15_7"
December 16, 2025 at 9:52 PM
I realise user agent strings are more lies than truth but it's still funny to me that Safari on Apple Silicon with Tahoe still reports itself as "Macintosh; Intel Mac OS X 10_15_7"
Blog: Experiments with Memory Integrity Enforcement
octet-stream.net/b/scb/2025-1...
TL;DR this thing is awesome
octet-stream.net/b/scb/2025-1...
TL;DR this thing is awesome
![Screenshot of Xcode showing a debugger stack trace on the left and some Objective C code on the right. One line is highlighted in red, ret[i] = 0; which has the debugger annotation "Thread 1: Heap buffer overflow by 1 bytes". It is showing that it's detected this assignment outside the range of the heap allocation returned by an earlier malloc().](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:txurc6ueald5d7462bpvzdby/bafkreifumpr3hvprj6zbfj7oeeqdgnshydfboa2gn7zqcogi7n62ju2jge@jpeg)
December 16, 2025 at 4:24 AM
Blog: Experiments with Memory Integrity Enforcement
octet-stream.net/b/scb/2025-1...
TL;DR this thing is awesome
octet-stream.net/b/scb/2025-1...
TL;DR this thing is awesome
Dear lazyweb, does anyone know of a switchable smart power outlet that is controllable either by straight BLE or LAN API without complex auth or cloud stuff? Trying to avoid going to a full-on PDU as it’s a small job.
December 14, 2025 at 9:17 PM
Dear lazyweb, does anyone know of a switchable smart power outlet that is controllable either by straight BLE or LAN API without complex auth or cloud stuff? Trying to avoid going to a full-on PDU as it’s a small job.
Reposted by Thomas Karpiniec
December 13, 2025 at 4:59 AM
Reposted by Thomas Karpiniec
Arc<MuTeX>
(pronounced mu-tech)
(pronounced mu-tech)
December 12, 2025 at 12:52 PM
Arc<MuTeX>
(pronounced mu-tech)
(pronounced mu-tech)
Well that will be interesting - 5 years of social media accounts, 10 years of email addresses used, details of family members to enter the US www.abc.net.au/news/2025-12...
Privacy concerns over US proposing travellers reveal social media history
Australians travelling to the United States could soon face an unprecedented invasion of privacy, an international law expert has warned.
www.abc.net.au
December 11, 2025 at 6:10 AM
Well that will be interesting - 5 years of social media accounts, 10 years of email addresses used, details of family members to enter the US www.abc.net.au/news/2025-12...
Kids literature is wild these days
December 10, 2025 at 8:52 AM
Kids literature is wild these days
Hot take: maintaining a GUI layer of anything (iOS, Android, Mac, GTK, Qt, whatever Windows is doing this year) is a cursed treadmill that is fundamentally unkind to expect open source maintainers to do for free. We should normalise open source core software and data formats with proprietary GUIs.
December 9, 2025 at 11:01 AM
Hot take: maintaining a GUI layer of anything (iOS, Android, Mac, GTK, Qt, whatever Windows is doing this year) is a cursed treadmill that is fundamentally unkind to expect open source maintainers to do for free. We should normalise open source core software and data formats with proprietary GUIs.
Reposted by Thomas Karpiniec
New blog post! ✨ I argue that AI will make formal verification go mainstream. martin.kleppmann.com/2025/12/08/a...
Three reasons for this:
1. LLMs are getting increasingly good at writing proofs using proof assistants. This will make formal verification vastly cheaper than it's been to date.
Three reasons for this:
1. LLMs are getting increasingly good at writing proofs using proof assistants. This will make formal verification vastly cheaper than it's been to date.
Prediction: AI will make formal verification go mainstream — Martin Kleppmann’s blog
martin.kleppmann.com
December 8, 2025 at 10:48 PM
New blog post! ✨ I argue that AI will make formal verification go mainstream. martin.kleppmann.com/2025/12/08/a...
Three reasons for this:
1. LLMs are getting increasingly good at writing proofs using proof assistants. This will make formal verification vastly cheaper than it's been to date.
Three reasons for this:
1. LLMs are getting increasingly good at writing proofs using proof assistants. This will make formal verification vastly cheaper than it's been to date.
This AI stuff is getting out of hand
December 6, 2025 at 8:06 AM
This AI stuff is getting out of hand
I like to hope that the team which designed the Thinkpad X220 feels a lot of professional satisfaction these days
December 6, 2025 at 3:09 AM
I like to hope that the team which designed the Thinkpad X220 feels a lot of professional satisfaction these days
Rust: the compiler will be very mad if you try to read and write a HashMap on two threads
Go: try not to read and write a map on two threads
Java: heeey relax we got ConcurrentHashMap, life is goood
Go: try not to read and write a map on two threads
Java: heeey relax we got ConcurrentHashMap, life is goood
December 5, 2025 at 6:24 AM
Rust: the compiler will be very mad if you try to read and write a HashMap on two threads
Go: try not to read and write a map on two threads
Java: heeey relax we got ConcurrentHashMap, life is goood
Go: try not to read and write a map on two threads
Java: heeey relax we got ConcurrentHashMap, life is goood
Is it just me or are GitHub PR pages _especially_ slow to render/update in Safari?
December 4, 2025 at 6:09 AM
Is it just me or are GitHub PR pages _especially_ slow to render/update in Safari?
Reposted by Thomas Karpiniec
🚨 New Socket Threat Research: We found a malicious Rust crate disguised as an EVM version helper that downloads & silently executes OS-specific payloads, likely for crypto theft. The crate was live for 8 months and was swiftly removed after we reported it.
socket.dev/blog/malicio... #Rustlang
socket.dev/blog/malicio... #Rustlang
Malicious Rust Crate evm-units Serves Cross-Platform Payload...
Malicious Rust crate evm-units disguised as an EVM version helper downloads and silently executes OS-specific payloads likely aimed at crypto theft.
socket.dev
December 2, 2025 at 10:59 PM
🚨 New Socket Threat Research: We found a malicious Rust crate disguised as an EVM version helper that downloads & silently executes OS-specific payloads, likely for crypto theft. The crate was live for 8 months and was swiftly removed after we reported it.
socket.dev/blog/malicio... #Rustlang
socket.dev/blog/malicio... #Rustlang