Vincent sgherzi
LightNews LightNews
banner
vincents.dev
Vincent sgherzi
@vincents.dev
57 followers 150 following 140 posts
https://vincents.dev

Everyone appreciates simplicity until you have to build a rocket ship out of toothpicks and glue
Posts Replies Media Videos
Reposted by Vincent sgherzi
without.boats
In more than decade of writing Rust, I have never once in my life needed back pointers for anything.
November 24, 2025 at 12:45 AM
Reposted by Vincent sgherzi
eikopf.com
*cowering in the fetal position* rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fi
November 19, 2025 at 9:24 AM
Reposted by Vincent sgherzi
mara.bsky.social
#rustlang hot take: We should rename .unwrap() to .or_panic(). (And .expect() to .or_panic_with().) "Unwrap" is a terrible name for the panicking function, especially since we also have things like .unwrap_or() and .unwrap_or_default() which never panic.
November 19, 2025 at 7:32 AM
vincents.dev
blog.cloudflare.com/18-november-...

Why does the cloudflare codebase allow for .unwrap() Ideally it should be banned via clippy lints. The entire point of errors as values is that this sort of thing can be handled. They could've just used a match on the result.

#rust #rustlang #cloudflare
November 19, 2025 at 12:08 AM
Reposted by Vincent sgherzi
without.boats
Britain continuing their long history of leadership in ruining the world
November 15, 2025 at 9:02 PM
Reposted by Vincent sgherzi
steveklabnik.com
“We adopted #rustlang for its security and are seeing a 1000x reduction in memory safety vulnerability density ... with Rust changes having a 4x lower rollback rate and spending 25% less time in code review, the safer path is now also the faster one.”

security.googleblog.com/2025/11/rust...
Rust in Android: move fast and fix things
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in ...
security.googleblog.com
November 13, 2025 at 7:52 PM
vincents.dev
me: "Software owes it to its users to be secure"
HN: "there is no such obligation"

We owe it to the craft to product correct and performant software. We are meant to understand and mitigate risk so others don't have to.

This is the social contract of being a software engineer.

#rustlang
November 12, 2025 at 2:40 AM
Reposted by Vincent sgherzi
bcantrill.bsky.social
Forgive me, for I have broken my vow to not tweet.
A screenshot of a quote tweet from Sequoia partner Shaun Maguire quoting Silicon Valley legends (including Don Valentine, Pierre Lamond, and Mike Moritz) explaining that he has "Sequoia-sized shoes to fill". The quote tweet is an image of Lloyd Bentsen in the 1988 VP debate, immediately before telling Dan Quayle that he is "no Jack Kennedy."
November 6, 2025 at 4:16 AM
Reposted by Vincent sgherzi
ahl.bsky.social
Does async rust cause autism? I’m just asking questions.
November 1, 2025 at 2:23 AM
Reposted by Vincent sgherzi
ncameron.org
I've done a 180 on supply chain security - I used to think it was mostly a theoretical problem: between communities of mostly good actors, many eyes to review, good policies for announcing vulns and removing crates, and basic due diligence, issues would be found and addressed before doing damage
October 30, 2025 at 8:36 PM
Reposted by Vincent sgherzi
djc.ochtman.nl
edera.dev/stories/tarm...
TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware | Edera Blog
Edera uncovers TARmageddon (CVE-2025-62518), a Rust async-tar RCE flaw exposing the real dangers of open-source abandonware and supply chain security.
edera.dev
October 22, 2025 at 6:18 AM
vincents.dev
Impressed that crates io didn’t go down with the whole aws outage. The optimist in my wants to think that it’s redundant across multiple regions

#rustlang
October 20, 2025 at 7:15 PM
Reposted by Vincent sgherzi
sunshowers.io
Why I like and keep working on Rust
Thank you for the kind words and the thoughtful response. I'm deeply sympathetic to your viewpoint, and some days I certainly feel like Rust is creaking under its own weight. Why does your typical backend web service need all this complexity with borrows and lifetimes and manual memory management? But allow me to present the other side of the argument. My background is in systems-level developer tools, and Rust has a combination of things that no other programming environment has: * & and &mut, which enforce a rigorous separation between mutable and immutable state. I think this is the single most important feature of Rust, and the closest analog to this in other environments is purely functional languages like Haskell * enums with data + exhaustive pattern matching; the latter is something even Haskell lacks * high-level idiomatic code that performs like low-level code (e.g. iterators): Rust achieves this through an extraordinary combination of monomorphizing and inlining * working in memory-constrained environments: tracing GC tends to have significant memory overhead, and I've worked in server environments where a big limiting factor was the amount of DRAM being produced globally * good polymorphism: I think OOP is a suboptimal paradigm that breaks under day-to-day development stress. I've written about it at https://news.ycombinator.com/item?id=42512629 * fast startup times: this is a requirement for command-line tools people use hundreds of times a day—I spent many years working on Mercurial where Python's slow startup time was a very common complaint * first-class support for using native OS calls directly; many higher-level languages like Java abstract away the details, so things like signal handling are hard to hook into * first-class Windows support: again, non-negotiable for many developer tools, since the plurality of developers are on Windows (cont) * and last but not least, a great dependency ecosystem, which ties into all of the above points: & and &mut mean that some transitive dependency three levels down won't suddenly alter the list you pass in, idiomatic performance means that perf regressions are rare, first-class Windows support means most dependencies just work on Windows, and so on Is it possible to have an application-level/GCd/managed language that meets most or all of these requirements? Certainly. Does such an application-level language exist today? No, and there's nothing on the horizon either (Haskell has its heart in the right place, but is missing many of the more practical features here). Rust isn't a great application-level language, but it's the best application-level language. And given how high the barrier tends to be for a new language to reach adoption, I'll probably be retired long before something like that shows up. And yeah, async really is quite confusing in so many ways, and it's really unfortunate that this situation has seen no improvements in so many years. And yet, through its characteristics combined with the other things listed here, it enables developers to solve real problems that are completely infeasible in any other language. So I keep trying to make Rust better :)
October 16, 2025 at 11:52 PM
Reposted by Vincent sgherzi
aapoalas.trynova.dev
Went and did a quick data collection on the relative frequency of GitHub issues mentioning "crash" or "sefault"/"segmentation fault" in #Rustlang, #Ziglang, #C++, and #C. Selected 10 most starred repositories that use GH issues. Not the most scientific data selection, but it was fun!
Relative crash and segmentation fault reporting frequency in OpenSource projects across four systems programming languages
docs.google.com
October 12, 2025 at 2:52 PM
Reposted by Vincent sgherzi
nyurik.bsky.social
#Ubuntu 25.10 released, switching all basic commands like `ls`, `sudo`, `cd`, `cat`, ... to pure #Rustlang implementations. canonical.com/blog/canonic...
Canonical releases Ubuntu 25.10 Questing Quokka | Canonical
The latest interim release of Ubuntu comes with compatibility enhancements at the silicon level, accessibility upgrades and a robust security posture that sets the stage for the next LTS. October 9, 2...
canonical.com
October 10, 2025 at 2:27 AM
Reposted by Vincent sgherzi
halideapp.bsky.social
New: @sandofsky.com reviews the iPhone Air camera in “Requiem for a Rangefinder".

All shots taken on iPhone with Halide Mark III or shot on film. www.lux.camera/requiem-ipho...
Requiem for the Rangefinder: An iPhone Air Review
Last week I set out to write a few thousand words on the iPhone Air, but it turns out I only need three: the lesser iPhone. Compared to the Pro and baseline models, it has fewer cameras and a smaller ...
www.lux.camera
October 2, 2025 at 4:14 PM
vincents.dev
Does anyone know if there’s a way to detect if your current core is a p core or e core on Mac systems in rust? I’m assuming there’s a sys call for this but I can’t really find anything…

#macos #rust #apple #mac #rustlang
September 29, 2025 at 7:19 PM
vincents.dev
In light of the recent npm attack, does rust do better? Fundamentally the same could always happen.

Do we have anything in place, if not could we?

#rust #rustlang #npm #nodejs
September 9, 2025 at 1:11 PM
vincents.dev
Rust finally uses lld on Linux!

#rust #rustlang

blog.rust-lang.org/2025/09/01/r...
Faster linking times with 1.90.0 stable on Linux using the LLD linker | Rust Blog
Empowering everyone to build reliable and efficient software.
blog.rust-lang.org
September 2, 2025 at 8:47 AM
Reposted by Vincent sgherzi
mmasnick.bsky.social
Surely, that will work.
jsrailton.bsky.social John Scott-Railton @jsrailton.bsky.social · Aug 21
UK government asks everybody to stop using VPNs.

"everybody who's out there thinking of using VPNs...verifying your age keeps a child safe...So let's just not try and find a way around. Just prove your age."

- UK government
August 21, 2025 at 3:37 PM
Reposted by Vincent sgherzi
zkat.tech
Software should be fast, it should run well on older hardware, it should be secure, and it should be sustainable

We have the languages and tools *today* to make this a reality. Several orders of magnitude of perf difference just because you think Python is "prettier" is basically willful negligence
August 12, 2025 at 6:23 PM
vincents.dev
Are we for fucking real? Surely deleting things will make an impact…
August 12, 2025 at 5:49 PM
Reposted by Vincent sgherzi
gabrielesvelto.mas.to.ap.brid.gy
Two phrases about so-called AI that keep being repeated over and over are that "it's here to stay" and "you have to use it if you don't want to be left behind".

Now think about it for a sec, if they were true, why would they need to be repeated so often?
August 11, 2025 at 2:15 PM
Reposted by Vincent sgherzi
tangled.org
yeah well, they’re cooked. come to tangled!
tomwarren.co.uk Tom Warren @tomwarren.co.uk · Aug 11
GitHub is no longer independent at Microsoft, as CEO Thomas Dohmke resigns. GitHub is now moving to Microsoft's AI engineering team, CoreAI, with a new structure for GitHub's leadership team. Details 👇 www.theverge.com/news/757461/...
GitHub is no longer independent at Microsoft after CEO resignation
GitHub will be part of Microsoft’s AI engineering team
www.theverge.com
August 11, 2025 at 4:17 PM
vincents.dev
@bcantrill.bsky.social so … another intel oxide and friends episode incoming given the news?
August 9, 2025 at 1:44 AM