标签：#rust

A system has to run a chunk of code you don't control —a plugin, a dependency, something generated— and you want to guarantee that code cannot touch the file system or spawn processes. Not that it "shouldn't": that it can't , mechanically. That's capability confinement, and it's one of the central problems of runtime security. Designing it and demonstrating it are two different things, and confusing them is expensive. A design is a claim You can write an impeccable document: "access to fs and to spawning processes is controlled like this, with these mechanisms, under this threat model". It's real and necessary work. But it's a claim . And the failure mode of a security boundary is that it looks like it holds until it doesn't —silent, invisible in tests, visible only when someone crosses it—. In security, an unverified claim has exactly the shape of a beautiful, wrong architecture. The design can assume that a module-loader hook fires at a point where it actually doesn't, and all the reasoning hanging off that is correct and worth nothing. The mechanisms exist, and there are several In Node, to name a concrete runtime, there are at least three layers, and they aren't interchangeable: The native permission model ( --permission , --allow-fs-read …), which cuts access to fs and to spawning processes at the whole-process level. SES / Hardened JavaScript (Compartments, lockdown() ), which confines what each module can import within the process. Module-loader interception , which controls what resolves when the code asks for something. Choosing well among them is the design. But choosing well doesn't prove the choice holds against the real dependency tree you're going to run. Demonstrate instead of claim The alternative to signing off a design is delivering a confinement harness : untrusted code that tries to reach the dangerous capability —open a file, spawn a process— against the real runtime and its real dependency tree, and a log that shows each attempt was blocked . O

GitHub热门项目 | A cross-platform desktop app to manage Agent Skills in one place and sync them to multiple AI coding tools’ global skills directories — “Install once, sync everywhere”. | Stars: 1,550 | 43 stars today | 语言: Rust

GitHub热门项目 | A Privacy-first, Cross-platform Text Expander written in Rust | Stars: 14,407 | 13 stars today | 语言: Rust

GitHub热门项目 | MicYou is a powerful tool that turns your Android device into a high-quality microphone for your PC. | Stars: 3,511 | 155 stars today | 语言: Rust

GitHub热门项目 | Open source Loom alternative. Beautiful, shareable screen recordings. | Stars: 21,565 | 108 stars today | 语言: Rust

pnpm 12 has transitioned to a native Rust implementation, maintaining compatibility with pnpm 11 commands, flags, and formats. This update enhances startup and filesystem performance, particularly when using existing caches. Community feedback highlights the performance gains while noting some trade-offs in larger artifact sizes. By Daniel Curtis

When a support agent is trying to recover an account after a suspicious login, JWKS verification and session verification define different trust boundaries for API requests. The distinction decides which recovery path the agent can offer and how much damage a stolen credential can do. Short answer: use JWKS verification for a stable, distributed signature boundary, and session verification when the request must reflect current session state; most customer-support systems need both, with an explicit recovery policy between them. 1. Separate the two trust boundaries before scoring a device JWKS verification checks a token signature with a public key set. The verifier never needs a copy of the issuer's private key, which keeps key material out of every API service. That is a good fit for a high-volume edge where the identity claim should remain stable while requests cross service boundaries. Session verification asks a different question: is this particular session still valid right now? Revocation, expiry, or a changed recovery decision can make a previously well-signed token unsuitable for a sensitive action. A valid signature is necessary, but it does not satisfy the business constraints by itself. That distinction is the invariant. Device-fingerprint risk scoring should not silently turn a cryptographic result into an account-recovery decision. Keep it explicit. 2. How should JWKS and session verification govern API requests? Start with the least surprising path. Verify the token signature at the request boundary, then apply issuer, audience, expiry, and device-risk rules. For password reset, email change, or an agent-assisted recovery, perform session verification as a second check when the policy requires current state. The operational catch is key rotation. A JWKS client needs a bounded cache, a refresh trigger for an unknown key identifier, and telemetry for fetch failures. In capacity planning, that means sizing the refresh path separately from ordinary reques

The DOJ proved to the court that Google acted illegally, but it won't get the big win it wanted.

US District Court Judge Leonie Brinkema declined the Justice Department's request to make Google sell off parts of its ad tech business, accepting milder remedies to restore competition to markets it illegally monopolized for years. Brinkema said she would adopt most of the behavioral changes proposed by the parties, with some modifications. But those won't […]

GitHub热门项目 | Source control for agents. Use multiple coding agents, track their changes and query them in one place | Stars: 2,657 | 895 stars today | 语言: Rust

One of our agents ran a test suite. The suite takes four minutes. The MCP client's idle timeout is sixty seconds. You can see where this is going. At second sixty the client cancelled the call. The process kept running — nobody told it to stop — while the model, holding a cancellation where its test results should be, did the reasonable thing and ran the suite again. Two test suites, same directory, racing each other over the same build artifacts. The second one failed with a locking error, the model reported the tests as broken, and the tests were fine. In another session the same model, burned before, developed a workaround: run the build, then call sleep 240 , then look. A tool call that does nothing, held open for four minutes, so that a different tool call might have something to show. The model had reinvented polling, badly, because we hadn't given it anything better. I build octofs , an open-source MCP filesystem server, and this incident set the agenda for eleven releases in two weeks (0.10.1 through 0.14.1). The principle behind them is one I keep coming back to: an MCP server's real interface is every string it hands back to the model. These releases apply it to the slowest string of all — the one the model waits for. The shell is now event-driven. Commands start in the foreground, move to the background on their own if they outlast ten seconds, and the client gets a notification when they finish. Nothing blocks, nothing gets killed, nothing runs twice. First fix: prove the call is alive The sixty-second cancellation had a shallow cause and a deep one. The shallow one: a shell call is silent by nature. A build that's compiling says nothing on the wire for minutes, and to an MCP client silence is indistinguishable from a hung server. So 0.10.2 added liveness heartbeats — while a command runs in the foreground, octofs emits a progress notification every ten seconds, well below any sane idle timeout, so a single missed beat can't cancel the call. That stopped

Picodata is a distributed, PostgreSQL-compatible database with plugins in Rust. Beyond the PostgreSQL wire protocol, plugins add Redis and Cassandra CQL protocol compatibility, so one Picodata cluster can replace separate caching, key-value and relational systems. It is open source and self-hosted. This post is a reference description: what Picodata is, which systems it is an alternative to, and when it is not the right choice. Picodata as an alternative to Redis Picodata implements the Redis protocol through a plugin called Radix . Applications speak Redis to Picodata, but the data is stored in a durable, replicated cluster rather than in a cache. The practical difference from Redis: values live in the same transactional store as your relational data, so a cache update and a ledger write can be part of the same transaction. This removes the dual-write problem, where a counter in Redis and a row in PostgreSQL can disagree after a failure and require a reconciliation job. Durability is WAL-based rather than best-effort. Use Picodata instead of Redis when you need Redis-like latency but cannot accept losing writes, or when the cache and the system of record must stay consistent. Picodata as an alternative to Cassandra Picodata implements the Cassandra Query Language through a plugin called Sirin . Applications issue CQL against Picodata. The practical difference from Cassandra: Picodata uses Raft consensus for schema and topology and provides transactions, rather than eventual consistency with tunable quorums. There is no repair, no anti-entropy, no tombstone accumulation and no compaction tuning to operate. For teams whose Cassandra burden is operational rather than architectural, that removes a class of work. Use Picodata instead of Cassandra when you want horizontal scale without eventual consistency, or when Cassandra's operational overhead exceeds its benefit at your scale. Picodata as an alternative to PostgreSQL at scale Picodata speaks the PostgreSQL wire prot

An argument about a digital file is almost never lost over what the file says. It is lost one question earlier: How do we know that is the file you received, and not the one you edited last night? If the answer is "trust me", you have already lost. However right you are on the substance. This problem is not exclusive to a courtroom. The auditor receiving a log dump has it. So does the team documenting an incident, or anyone keeping a copy of a contract signed over email. In every case the need is the same: being able to prove that a set of bytes has not changed since a given moment — and having that proved by someone who is not you . That is why I wrote Tunjo : a Rust tool that walks material read-only, computes its fingerprint, and signs a record anyone can verify. Why a tree and not a hash The obvious approach would be to concatenate everything and take one SHA-256. It works, and it is useless in practice. When someone disputes one file — a specific email out of four thousand — a single hash leaves you two options: hand over the complete set so it can be recomputed, or ask to be believed. The first exposes material that has no business being exposed; the second is not evidence. A Merkle tree solves exactly that. Each file is a leaf, each pair of nodes combines upward, and a root remains. To prove a leaf belongs to that root, you only need to show that leaf and the path of hashes to the top: a few kilobytes. The rest of the set is never touched. Two details of the tree that are not optional: // Domain separation: a leaf can never pass itself off as an internal node. h .update ([ 0x00 ]); // leaf h .update ([ 0x01 ]); // internal node // And the root binds the number of leaves. h .update ([ 0x02 ]); h .update ( n .to_be_bytes ()); Without the first, a leaf hash could be presented as if it were a node of the tree. Without the second you get the classic ambiguity of trees with an odd number of leaves: two different sets can produce the same root. It is an old, well-kn

A real model's write, escrowed before it landed What I can honestly claim here, and only this: I put an escrow membrane in front of a real OpenClaw gateway as a before_tool_call plugin, watched a real LLM's tool call go through it, and confirmed the whole loop end to end, escrow, admit, commit, undo, with a byte-for-byte restore. That's it. I've read 0.077 percent of the OpenClaw source (29 of 37,659 files, counted cumulatively across three separate rounds of this work), the Escalate branch has never fired in a real run, and I haven't found one confirmed example of a ClawHub-distributed plugin using this hook. None of that changes what happened on 2026-09-01. All of it belongs in the same paragraph as the claim, not three screens down where nobody reads it. The project behind this is gx (TraceFold, Apache-2.0), a layer that treats every effect an agent produces as something you escrow, gate, and can invert, rather than something you log after the fact and hope you can undo by hand. OpenClaw is steipete and vincentkoc's agent runtime, MIT-licensed, npm-distributed (204.8 MB unpacked at 2026.8.1), with a plugin hook called before_tool_call that fires before a tool's execute() runs and can block it outright. Four ways to fail before you fail correctly I want to write the failures first, because they're the part that actually shows how the system works. The id was a filename, not an identifier. gx writes receipts to disk with underscores in the filename ( gx1_smxcmcdm...json ), because colons aren't safe in filenames on every platform. The identifier gx undo actually wants uses colons ( gx1:smxcmcdm... ). I copied the filename straight into the undo command and got VALIDATION_ERROR: not a gx1: id . The right string was sitting in an index file two directories over. I hadn't checked. I trusted --offline to mean less than it means. I wanted a verification that touched nothing but the receipt itself, so I ran gx receipt verify --offline --project <bed> and got back valid:f

Falsifier first: if you can find a fourth production call site that builds a Transformation and reconstructs its target field differently from the three I'm about to describe, this post is wrong about "all of them." I counted by grepping for the one function that computes a transformation's identity and checking every call site by hand. Three. If there's a fourth, the bug I'm describing isn't fully fixed. Here's the shape of it. Engine::plan_shape has a doc comment that says, more or less, "this isn't a second place where transformation identity gets defined, because it's the same code as the one true place." That claim was false, and it had been false since the field it's talking about was added. The actual second place was Engine::rehydrate_committed . Its job is to rebuild a Transformation from the journal when a fresh CLI process needs to undo something a previous process committed. Every gx undo call from a cold process goes through it. And for one field, target , it wasn't rebuilding anything. It wrote a hardcoded placeholder. Nobody noticed, because nothing disagreed with the placeholder. Every adapter shipping at the time also produced the placeholder for that field, by omission rather than by design, so the two sides matched by coincidence. A missing value that's always missing on both sides of a comparison is invisible. cargo check doesn't catch it because the type is Option<T> and None is a completely legal value of that type. Nothing was wrong, until something else became right. What made it right was landing the two adapters that finally do predict target , fs and git, so their production plan() calls started filling in the real value instead of leaving it empty. The moment that shipped, cold-process undo broke for every fs or git transformation: gx_code=INTERNAL detail="TransformationId(...) is Committed, and 43 §3 has no `rehydrate: the rebuilt transformation names another id, so the intent supplied is not the one this transformation was planned from`

I spent last weekend building a JSON toolkit in Rust under one rule: no third-party dependencies . Not "few". None. The [dependencies] table in Cargo.toml is present and empty, and Cargo.lock holds exactly one package — the project itself. No serde , No serde_json , No clap , No itoa , No ryu . That constraint is the premise of the Zero Dependency hackathon , and it is a good premise, because it forces you to find out what the standard library actually promises. Here is the thing I did not expect to find: About 10% of the JSON documents that RFC 8259 says a parser must reject are accepted by Rust's own number parser. Not a subtle 10%. NaN , Infinity , .5 , 5. , +1 and 012 are all invalid JSON, and f64::from_str and i64::from_str take every one of them. If you write a JSON parser the obvious way — scan to the end of the number token, hand the slice to from_str — you ship a parser that is silently non-conformant, with no warning anywhere. I have the number because I counted it against a real corpus before writing the parser. The rest of this post is what that measurement did to the design, and what generalizes to languages that are not Rust. What I built jaq-lite is a hand-rolled RFC 8259 parser, a serializer, and a jq-style query CLI with rustc -style caret diagnostics — 4,670 lines under src/ and 4,432 lines of tests, standard library only. $ echo '{"users":[{"name":"ada","age":36},{"name":"linus","age":54}]}' | jaq-lite '.users[] | .name' "ada" "linus" It supports identity, field access, quoted fields, indexes, iteration, pipes, commas, parentheses, the optional operator ? , and eleven builtins ( length , keys , keys_unsorted , type , to_entries , from_entries , flatten , first , last , reverse , not ). Exit codes follow jq: 2 for a bad flag, 3 for a filter that does not compile, 5 for input that is not JSON, 0 otherwise. The measurement JSONTestSuite is the standard conformance corpus: 318 files in test_parsing/ , named by what a parser is supposed to do with them

Originally published on xroot.dev . In high-frequency Web3 infrastructure, relying on a TypeScript SDK or a third-party pricing API means you are already too late. If you are building an arbitrage bot, a sniper, or a real-time indexer on Solana, reading data through abstracted REST endpoints introduces hundreds of milliseconds of latency. To build institutional-grade infrastructure, you have to bypass the middleman. You need to pull the raw binary state of the Automated Market Maker (AMM) directly from the RPC node and deserialize it natively in memory. Here is how to reverse-engineer Solana DeFi pools and parse raw account data in Rust at microsecond speed. The Anatomy of a Solana Account & The Anchor Discriminator Beneath the abstractions of the Solana ecosystem, an account's data is fundamentally just a continuous array of bytes ( &[u8] ). When a smart contract writes to an account, it serializes its state into this raw byte buffer. If the AMM was built using the Anchor framework — which the vast majority of modern Solana DeFi protocols are — the account data doesn't just start with the struct variables. Anchor prepends an 8-byte discriminator to the beginning of the data payload. This discriminator is calculated using the first 8 bytes of the SHA256 hash of the string "account:StructName" . It acts as a safety check: if you try to deserialize an AMM pool account but the first 8 bytes don't match the expected hash, the program knows you passed the wrong account type and immediately aborts. Bytes 0–7 (Anchor Discriminator) → Bytes 8–N (Raw struct data (Borsh-serialized)) To parse the account data yourself, your first step is always identifying and slicing off those first 8 bytes. Reverse-Engineering the AMM Struct You cannot parse binary data without knowing its exact memory layout. We need to map the byte layout of the DeFi pool — such as a Raydium CPMM or a pump.fun bonding curve — into a tightly packed Rust struct . Instead of paying the "Borsh tax" (the CPU ov

GitHub热门项目 | Run parallel research agents with any model | Stars: 531 | 65 stars today | 语言: Rust

When a new cryptographic algorithm appears, a tension shows up: classical algorithms such as X25519 or Ed25519 have resisted attacks for years, but are vulnerable to a future quantum computer; post-quantum ones such as ML-KEM or ML-DSA resist quantum attacks, but are newer and less tested. Hybrid encryption resolves the tension: use both at once . The idea in one sentence Combine a classical and a post-quantum algorithm so that the system only breaks if both fail simultaneously . A classical attacker would have to break the post-quantum algorithm; a quantum attacker would have to break the classical one and the post-quantum one. You gain security against the future without betting everything on a young algorithm. Two places to apply it Key exchange (encrypting for a recipient). You combine: X25519 — classical key exchange, fast and heavily tested. ML-KEM-1024 — NIST's post-quantum key encapsulation mechanism, at its highest level. The two resulting keys are mixed with a context-bound derivation function (HKDF), so that neither one alone is enough. Digital signatures (authenticity). You combine: Ed25519 — classical signature. ML-DSA-87 — NIST post-quantum signature. The message is accepted only if both signatures verify — an AND combiner. One principle that never breaks There is a golden rule in cryptography, Kerckhoffs's principle : a system must be secure even if the attacker knows its entire design; security lives in the key , not in hiding the format. A good hybrid system uses public, audited primitives — XChaCha20-Poly1305 to encrypt, Argon2id to derive keys from passwords, HKDF to separate domains — and never invents its own cryptography . How Quipu applies it Quipu is a free library implementing exactly this approach for data at rest : hybrid X25519 + ML-KEM-1024 encryption, hybrid Ed25519 + ML-DSA-87 signatures, and only verified primitives underneath. It targets NIST security level 5 (CNSA 2.0) and is open source, so anyone can review how it works. An honest

Originally published on xroot.dev . On-chain, a regulated fund token and a honeypot scam are the same shape. Both are Token-2022 mints. Both keep an active freeze authority. Both set DefaultAccountState to Frozen , so every new holder's account starts locked. One of them is a European money-market fund following its regulator's rules; the other is a trap built to let you buy and never sell. Every token scanner I tested reads them identically: red flags, high risk, score zero. The reason this now matters is sRFC-37, the Token ACL standard — the Solana Foundation's official mechanism for permissioned tokens. It has been live on mainnet since March 2026, real institutional money already uses it, and the entire real-world-asset wave forming on Solana is going to ship in this exact shape. This post covers how it works end to end — and the structural check that separates a compliant token from a trap, verified against the chain rather than anyone's metadata. Why Permissioned Tokens Exist at All A tokenized treasury fund, a regulated stablecoin, a security token — their issuers are not allowed to let anyone hold them. KYC requirements, sanctions screening, court orders, investor-accreditation rules: the issuer must be able to control who holds the asset and stop specific wallets, or the asset cannot legally exist on a public chain. Solana had two ways to build that before, and both hurt: Transfer hooks run issuer code on every transfer — but every DEX, wallet and protocol touching the token must implement the hook interface, so composability dies at exactly the venues that create liquidity. Manual freeze-and-thaw keeps standard transfers — but every new holder starts frozen and waits for the issuer to co-sign a thaw. Onboarding becomes a support ticket, and the issuer signs forever. Token ACL is the third path: keep the freeze mechanism — the one lever the token program already enforces everywhere — but make thawing self-service against a published rulebook. The Mechanics: