const-eval
home for proposals in and around compile-time function evaluation (by rust-lang)
Our great sponsors
| bad_actor_poc | const-eval | |
|---|---|---|
| 12 | 6 | |
| 322 | 99 | |
| - | - | |
| 0.0 | 3.8 | |
| almost 3 years ago | 9 months ago | |
| Rust | CSS | |
| MIT License | Apache License 2.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
bad_actor_poc
Posts with mentions or reviews of bad_actor_poc.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-07-06.
-
Why is `const fn` different from other “const” things?
I'm not suggesting people in this thread are wrong, but working for a security company gives a slightly different perspective. For example, there's really nothing stopping a rogue crate from exporting your private keys, just by using VS code. I wasn't thinking about this when I helped write that proposal, though.
- Did somebody play around with macros yet?
-
todo-or-die!
Having less tools that can do things like https://github.com/lucky/bad_actor_poc is a relief.
-
Workspace Trust in VS Code
Code execution that may not be so obvious could be the preLaunchTask that runs before starting the app and can run a build that has an extra task executing arbitrary code unrelated to the build. What about the npm module that steals your crypto wallet private keys? Make a simple edit and a malicious linter is loaded from the node_modules folder, instead of the one that is installed globally. Even reading the code can be deceptive, attackers can use Unicode hacks to hide malicious code in plain sight. Heck, you don't even have to open any source code to be owned.
- lucky/bad_actor_poc - Stealing secrets with Rust Macros proof-of-concept via VSCode: This shows a trivial example of exfiltrating secrets just by the developer opening up the source
- Visual Studio Code May 2021
-
Carnet: A Tool for Sandboxing Cargo and Buildscripts
https://github.com/lucky/bad_actor_poc is one example
-
Fixated on end-user security, FOSS developers neglect their own...
It turns out that because Rust can execute code at compile time, simply opening a Rust source file in an editor with code completion support can cause a virus to be installed on my computer. Apparently I can't trust anything but basic text editors anymore...
- Using Rust Macros to exfiltrate secrets
const-eval
Posts with mentions or reviews of const-eval.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-03-30.
-
After years of work and discussion, `once_cell` has been merged into `std` and stabilized
Here's the issue: https://github.com/rust-lang/const-eval/issues/20
-
Are there examples of programming language compilers that evaluate the side-effect free parts of the program at compile-time?
A similar idea is proposed here for Rust
-
Why is `const fn` different from other “const” things?
See also the const-eval project
-
Question: reference str in array and Vec
This is explained in more detail here: https://github.com/rust-lang/const-eval/blob/master/promotion.md
-
Hey Rustaceans! Got a question? Ask here! (23/2022)!
This is due to const-promotion. The compiler recognizes the array expression can be a constant and so treats it like one.
- Who owns the struct of instantiated reference?
What are some alternatives?
When comparing bad_actor_poc and const-eval you can also consider the following projects:
language - Design of the Dart language
metrics
carnet - A Tool for Sandboxing Cargo and Buildscripts
ledger-filecoin-rs
Visual Studio Code - Visual Studio Code
tokio - A runtime for writing reliable asynchronous applications with Rust. Provides I/O, networking, scheduling, timers, ...
macro_prototype - A very basic prototype of macros using build_runner
The-Spiral-Language - Functional language with intensional polymorphism and first-class staging.
code-it-later-rs - Filter crumbs you left in comments of code to remind where you were
maud - :pencil: Compile-time HTML templates for Rust
security - Embargoed security issues that will be made public after a fix is made available. Use https://github.com/nim-lang/security/security
rust - Empowering everyone to build reliable and efficient software.
bad_actor_poc vs language
const-eval vs metrics
bad_actor_poc vs carnet
const-eval vs ledger-filecoin-rs
bad_actor_poc vs Visual Studio Code
const-eval vs tokio
bad_actor_poc vs macro_prototype
const-eval vs The-Spiral-Language
bad_actor_poc vs code-it-later-rs
const-eval vs maud
bad_actor_poc vs security
const-eval vs rust