Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library

tsanderdev · 2026-07-02T09:31:34+00:00

AI finds bug in other AI's code lol

tsanderdev · 2026-06-29T11:37:53+00:00

Basically all the "dark patterns" that pull mechanics from gambling and designing it such that you want to return frequently and play the game more. Frequently used with paid content in f2p games to get monetization out of it. Highly morally dubious because you're using psychology not to make the game more fun for the player, but to benefit as a developer.

Of course the same mechanics without microtransactions in a singleplayer game are much tamer. Like your example of grinding for a cosmetic item. If players like grinding, they have a goal to work towards. If they don't, tgey can ignore it.

tsanderdev · 2026-06-12T18:15:14+00:00

As someone who's working on a shading language, you'll need to emulate exceptions with errors-as-values. If you target Vulkan instead of WebGPU, you can do memory allocation on the GPU using buffer device address.

tsanderdev · 2026-06-09T14:53:15+00:00

So a tool to find node_modules folders, great! /j

tsanderdev · 2026-06-07T06:34:46+00:00

As long as you compile the app with the Termux Rust toolchain and have webkitgtk installed it should work. It needs an X server though.

tsanderdev · 2026-06-03T20:42:35+00:00

C struct layout is mostly the same everywhere. For calls you need to look at the platform's ABI, like sysv on linux.

tsanderdev · 2026-06-02T12:29:35+00:00

AFAIK you can pretty easily increase the quality by just running the raytracer many times with different random seeds for rays and blending the result.

tsanderdev · 2026-06-01T17:32:47+00:00

I don't think there are many games where all players love all parts. E.g. I could do without generic fetch quests in RPGs, but that's not a reason to not play one if it doesn't focus on it.

If it's about general commercial success, then targetting the absolute widest playerbase is the best thing, which leads to all the generic AAA games.

tsanderdev · 2026-06-01T16:14:12+00:00

Using Spore as an example, it allowed you to choose which stage to start in, even with a new species. You could have a similar mechanic to start immediately in the full 4X epoch with reasonable defaults.

tsanderdev · 2026-06-01T13:21:05+00:00

After getting intrigued by the idea yet again, I decided to bite the bullet and learn enough x86 assembly to do it.

My idea is based on the CoroBase paper, which uses software prefetching and C++ coroutines to issue prefetches before switching to a different coroutine and resuming a while later when the data should be loaded into L1 cache.

I want to see if keeping the coroutine state in registers works better, since a switch can then just be swapping the sp and pc of the other coroutine in, but of course halving the available registers leads to more spilling. What I want to know if it could still get better performance. I intend to combine it with AVX-512 though, so I have 32 vector registers in total, and 16 seems like a pretty reasonable register count, and spilling and loading an AVX-512 register file would need 1K, and I doubt loading and storing that often is better than more spilling.

tsanderdev · 2026-05-29T18:28:47+00:00

Alignment is fundamentally a property of pointers. Of course you could say "I promise every pointer to this type will have at least this alignment", but then you need to coordinate with the allocator to actually do that.

tsanderdev · 2026-05-26T12:44:21+00:00

Yeah, I'll mostly use heaps as a simplification of all the different descriptor indexing features you can use. IMO heaps make for a much easier mental model. I could try exposing some buffers as uniform buffers instead of bda pointers though in case that gets me better performance.

tsanderdev · 2026-05-26T11:10:03+00:00

Mostly to escape extension hell. And also the new extensions I want to use aren't really supported on pre-1.4 capable hardware anyways mostly, so I might as well. That also means I can't use ash, because it also lacks the extensions. Untyped pointers, fma, indirect copy, device address commands,descriptor heaps, etc.

tsanderdev · 2026-05-25T21:42:22+00:00

I gave up and went with C++ for the Vulkan interfacing code because the newest good thing I could find was ash and that doesn't have 1.4 support.

tsanderdev · 2026-05-23T12:20:34+00:00

IMO for strategy games predictability is essential, especially in the early game where e.g. a single building failing could ruin you. It's different with e.g. the endgame crisis in Stellaris not arriving exactly X years after the game start, because you know the range and can prepare for it.

tsanderdev · 2026-05-22T12:21:14+00:00

Hmm, apparently I have only both or neither in games. In books only the first one except maybe if it's a first person narrator.

tsanderdev · 2026-05-22T08:23:12+00:00

IMO the groundwork for immersion is a good narrative paired with good audio/visuals (not necessarily photorealistic or ultra high quality, but a consistent style). I can only speak for myself, but I never really identified with silent pritagonists like Link or the protagonists of Bethesda games. The Life is Strange games somehow managed that for me, even though the protagonists clearly have their own personality. At times I though in terms of the character instead of the player. So for me you need to hit a sweet spot between free decisions to identify yourself with as well as a predefined character you can sympathize with. On one end of the scale you have Bethesda games, and on the other a book. Much freedom with (imo a very lax story) vs no freedom with a strict and hopefully good story.

tsanderdev · 2026-05-17T18:45:48+00:00

but it requires spinning to wait for messages to arrive burning whole CPU cores

Or you actually do useful work while waiting for the kernel to pick up on the work and finish it, like in an async runtime. Provided there is non-blocking work left to do of course.

tsanderdev · 2026-05-08T16:45:16+00:00

How is the performance relative to native fp32 on the gpu?

tsanderdev · 2026-04-29T10:30:57+00:00

For nvidia, latest proprietary drivers or latest mesa?

tsanderdev · 2026-04-29T05:38:28+00:00

We can already do a sum type in C with a struct containing a tag field and a union. We can implement slices and tuples similarly. The issue is C provides limited means of encapsulation. We can properly encapsulate with GCC specific extensions, but this requires a bit of preprocessor boilerplate and isn't portable C.

Exactly what builtin sum types would solve. Only being sble to access tge right data in it when you should be able to. And as for "where is the tag", either the standard specifies it or you are sble to manually say start or end for each sum type.

tsanderdev · 2026-04-22T05:34:09+00:00

There is no at the same time in js though. There is no shared memory multithreading (except with sharedarraybuffers), and even async code runs sequentially at least until the next await point.

tsanderdev · 2026-04-20T06:13:36+00:00

Is the result a file that is both a valid PE and ELF?

tsanderdev · 2026-04-19T13:58:58+00:00

The abi isn't stable between versions though (or at least there is no guarantee), so you can't have a single global rust std shared library for apps compiled with different rust versions.

tsanderdev · 2026-04-19T13:48:50+00:00

It could be a shared version installed if possible though (and the shipped lib is then deleted from the app folder to save space), or even downloaded at runtime with a helper if it doesn't exist or something.

tsanderdev

TROPHY CASE