randomint64

Espressif is on fire! And the CPU even has SIMD instructions!

RISC-V cores is a big deal for embedded systems because now compiling for SoCs is only a matter of `rustup target add riscv32imac-unknown-none-elf` instead of downloading half-broken proprietary toolchains and SDKs.

Take a look at https://kerkour.com/introduction-to-embedded-development-wit... and https://kerkour.com/rust-esp32-pentest to get started with modern (Rust ;) embedded development.

The attack would be like: attacker has read/write access to the database but not to the code of the backend service. Attacker swaps the hash of a targeted API key with the hash of their own API key. Attacker has now access to the resources of the targeted organization when using their own API key.

While it's true that API keys are basically prefix + base32Encode(ID + secret), you will want a few more things to make secure API keys: at least versioning and hashing metadata to avoid confused deputy attacks.

Here is a detailed write-up on how to implement production API keys: https://kerkour.com/api-keys

Sherlock Holmes liked to say "When you have eliminated the impossible whatever remains, however improbable, must be the truth".

The same is true for programming languages. When you have eliminated all the others for their fatal flaws, only Rust remains, so it's not "just a tool", it's the best tool (or less worse, depending on how you like the syntax).

You can read more about the technical reasons here: https://kerkour.com/rust-software-engineering-reliability

That's right, Signal (https://kerkour.com/signal-app-rust), Proton (https://kerkour.com/proton-apps-rust), Matrix, Wire and many more are using a share, cross-platform Rust core and a platform-dependent UI layer.

But it's not only the security-critical paths, but also most of the business logic (see the 2 posts above).

For those who want to get started with SIMD programming in Rust, here is a great resource: https://kerkour.com/introduction-rust-simd

Indeed, Rust's supply chains story is an absolute horror, and there are countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx)

TL;DR: ditch crates.io and copy Go with decentralized packages based directly on and an extended standard library.

Centralized package managers only add a layer of obfuscation that attackers can use to their advantage.

On the other hand, C / C++ style dependency management is even worse than Rust's... Both in terms of development velocity and dependencies that never get updated.

WebAuthn may be one of the most important security technology of the decade. It's a revolution in key management, which may be the hardest part of applied cryptography.

Passkeys enable phishing-resistant and 1-click authentication.

The PRF extension discussed here enables end-to-end encryption of data (with envelope encryption). Think about secure chat backups, double factor disk encryption (password + security key) and much more.

Soon we will be able to sign apps bundle (APKs, IPAs) with hardware security keys.

Great times are ahead for those who care about securing their users' data.

Rust is a serious contender is this space, and closing the gap quickly.

The language is moving too fast!

Too many features are added and seeing proposal like [0] don't make me confident about its future. Is it a general purpose programming language, or is it a research project?

[0]https://blog.rust-lang.org/inside-rust/2023/02/23/keyword-ge...

As an avid reader, I'm disappointed by Amazon's decision to discontinue individual newspaper and magazine subscriptions in favor of Kindle Unlimited. This change reduces my ability to support specific publications I value, potentially leading to less variety in the market.

It diminishes my sense of ownership, as content becomes more ephemeral within a subscription service.

I really can't wait for competitors to shake down this predatory monopoly.