Lua

Typing this on similar spec P16s that was around 2.6k or so. So if you call anything under 3k simply 2k, then it was 2k.

Thats in Germany, from a corporate supplier.

> statically linked

I'm not sure where you got this idea. The binary you distribute is dynamically linked:

> fresh: ELF 64-bit LSB pie executable, x86-64, [...], dynamically linked, [...]

and it links with libc, libm, and libgcc_s, which means the distro will matter, because GLIBC is not compatible that way.

How did you, after building this entire app, come to the conclusion that its statically linked? Rust apps typically aren't, by default.

> to some extent

so many commits authored by `claude` with 100+ lines each, that extent is not "some".

Did you review Claude's code? If so, how much experience do you have with programming and reviewing? For example:

extract_config_structs in build.rs (https://github.com/sinelaw/fresh/commit/a9f2fbc74b86840fe441...) does not, in fact, do what the comment says.

> any company with an inexperienced development team and thoughtless security posture

Point out one (1) "AI product" company that isn't described accurately by that sentence

FYI as of just now, the author has (correctly) added a disclaimer that this poc doesnt quite work.

This is only really fine as long as you have extremely clearly, well defined actions. You need to verify that the request is sane, well-formed, and makes sense for the current context, at the very least.

You would probably need to do the same if you were writing back-end in Go or something. I don't see how that is conceptually different.

As I understand it, RSC is locating the code to run by name, where the name is supplied by the client.

JS/Node can do this via import() or require().

C, C++, Go, etc can dynamically load plugins, and I would hope that people are careful when doing this when client-supplied data. There is a long history of vulnerabilities when dlopen and dlfcn are used unwisely, and Windows’s LoadLibrary has historical design errors that made it almost impossible to use safely.

Java finds code by name when deserializing objects, and Android has been pwned over and over as a result. Apple did the same thing in ObjC with similar results.

The moral is simple: NEVER use a language’s native module loader to load a module or call a function when the module name or function name comes from an untrusted source, regardless of how well you think you’ve sanitized it. ALWAYS use an explicit configuration that maps client inputs to code that it is permissible to load and call. The actual thing that is dynamically loaded should be a string literal or similar.

I have a boring Python server I’ve maintained for years. It routes requests to modules, and the core is an extremely boring map from route name to the module that gets loaded and the function that gets called.

Russian bots, as opposed to American bots, the latter of which are, of course, the good guys /s

I think you are bit outdated now. Those are same bots.

This sort of thing: https://www.dw.com/en/russian-disinformation-aims-to-manipul...

There does not appear to be a comparable operation by the US to plant entirely fake stores. Unless you count Truth Social, I suppose.