cryptography
zig
Our great sponsors
cryptography | zig | |
---|---|---|
70 | 812 | |
6,264 | 30,161 | |
2.2% | 3.7% | |
9.9 | 10.0 | |
6 days ago | 7 days ago | |
Python | Zig | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cryptography
-
We build X.509 chains so you don't have to
Congratulations to the authors, this was a feature that was dearly missing from pyca/cryptography. It took a long time to get right.
For the history: https://github.com/pyca/cryptography/issues/2381
-
“Our paying customers need X, when will you fix it?”
Some context:
- The cryptography dependency used by the current release of mitmproxy has a CVE related to an OpenSSL vulnerability (https://github.com/pyca/cryptography/security/advisories/GHS...)
- The main branch of mitmproxy has already upgraded to the latest version of the cryptography package
- The author of the package does not believe the CVE impacts users of mitmproxy so a release including this commit has not been made
-
Microservice memory profiling
first, I did see a correlation between an endpoint being heavily hit in a given time window, and an increase of memory usage that didn't went down afterwards. The endpoint didn't do much so I went through every instruction - is a global variable appended indefinitely ? Is a cache decorator growing without a limit set ? Do I use a 3rd party that has a known issue ? Turns out, it was using cryptography, so I looked up known issues. Saw an issue about a leak when using load_pem_x509_certificate https://github.com/pyca/cryptography/issues/4833 - which I used ! I could fortunately just upgrade the library
-
I love building a startup in Rust. I wouldn't pick it again
> A big problem with Rust, long-term, is that the kind of programs that really need it are somewhat out of today's mainstream. It's not that useful for webcrap. It's not that useful for phone apps. The AI people use Jupyter notebooks and Python to drive code on GPUs.
One thing this is missing is that Rust is useful for libraries callable by many different languages. You may or may not want to use it to build an actual Web app (I personally think it's a solid choice, but reasonable people can disagree). But for building, say, the Python cryptography library [1], which is used as a part of "webcrap" and Jupyter notebooks, Rust is clearly an excellent option. Nobody is going to build core Python infrastructure in Go or Node, and there will always be a need for plumbing libraries.
-
Azure CTO: “It's time to halt starting any new projects in C/C++ ”
> I am curious. Could you give some more context?
Probably talking about this: https://github.com/pyca/cryptography/issues/5771
- Zig, the Small Language
-
Using a src directory for a Python package
As for an example, cryptography is the general example I recommend here: https://github.com/pyca/cryptography
-
Difference between ruby 2 and ruby 3?
Wasn't entirely serious, just this crap https://github.com/pyca/cryptography/issues/5771
-
OpenSSL Security Advisory [5 July 2022]
The modes of operation aren't the main reason people use OpenSSL; it's the support for all the gnarly (and less gnarly) protocols and wire formats that show up when doing applied cryptography.
Progress is being made on replacing OpenSSL in a lot of contexts (specifically, the RustCrypto[1] folks are doing excellent work and so is cryptography[2]), but there are still plenty of areas where OpenSSL is needed to compose the mostly algebraic cryptography with the right wire format.
-
Help with basic steps in an application design
2) Which cryptographic library would be recommended for this purpose? I've seen people using PyCrypto (https://github.com/pycrypto/pycrypto) which seems simple enough, but that one seems not maintained anymore. I've also seen keyring.cryptfile (https://github.com/frispete/keyrings.cryptfile) and pyca/cryptography (https://github.com/pyca/cryptography) but I'm not really sure if any of those should actually be used for my purpose?
zig
-
Bun - The One Tool for All Your JavaScript/Typescript Project's Needs?
NodeJS is by no means a slow runtime, it wouldn’t be so popular if it was. But compared to Bun, it’s slow. Bun was built from the ground up with speed in mind, using both JavascriptCore and Zig. The Bun team spent an enormous amount of time and energy trying to make Bun fast, including lots of profiling, benchmarking, and optimizations.
-
Bun 1.1
I was quite curious about the .bunx file format. I think this could be a quite a useful thing, a universal binary format. Some tech companies have internal implementations of this sort of system. Then I see the shim DLL:
https://github.com/oven-sh/bun/blob/801e475c72b3573a91e0fb4c...
Even before this past week's XZ backdoor revelation, checking binaries into source control rather than building from source seems quite questionable. In fairness to the Bun developer's, they have a comment in their build.zig file acknowledging that this shim should be built more normally rather than being checked in.
Then I look into the source for it:
https://github.com/oven-sh/bun/blob/801e475c72b3573a91e0fb4c...
For no discernible reason, it is using a bunch of undocumented Windows APIs. The source cites this Zig issue as one reason for why they think it is OK to use undocumented APIs:
https://github.com/ziglang/zig/issues/1840
I don't see any good reasons here cited for using undocumented, unstable interfaces. For Zig's part, there seems to be some poorly-explained interest in linking against "lower level" libraries without any motivating use case (just some hand waving about security and drivers, neither of which makes much sense. Onecore.lib is a thing if you wanted a documented way of linking an executable that run on a diverse set of Windows form factors. And compiling drivers may as well be treated as a seperate target, since function names are different). For Bun, I assume they are trying to have low binary size. But targeting NTDLL vs. Kernel32 should not make a big difference, especially when the shim is just doing basic file IO. For an example of making small executable with standard API, you can make hello world 4kb using MSVC just by using /NODEFAULTLIB and /ENTRY:main with link.exe and this program :
#include
ntdll.dll!RtlUserThreadStart()
There are valid reasons to use APIs from NTDLL. Where I disagree with zig#1840 is the idea that it is always better to use NTDLL versions of API. Every other software ecosystem uses the standard Win32 APIs and diverging from that without a good reason seems like a good way to have unexpected behavior. One concrete example is most users and programmers expect Windows to redirect some file system paths when running on WOW64. But this is implemented in Kernel32, not ntdll.
-
Zig, Rust, and Other Languages
https://github.com/ziglang/zig/blob/5cd7fef17faa2a40c8da23f0...
Generally speaking, it’s as mentioned just a convention. A zig library might not allow its users to pass allocators for example.
In C++, stl containers can take an allocator as a template parameter. Recent C++ versions also provide several polymorphic allocators in the stdlib. You can also override the global allocator or a specific class’ allocator (override placement new).
-
Nanos – A Unikernel
We need to remove that. We did have a channel on freenode a while back but got rid of it.
Outside of gh discussions there is also https://forums.nanovms.com/. We made a decision a while ago to follow Zig's lead here and have no 'official' community space (https://github.com/ziglang/zig?tab=readme-ov-file#community) instead letting people form their own spaces.
Zig also has an IRC channel on libera (#zig) that is moderated by Andrew Kelley.[1]
- Ask HN: What Underrated Open Source Project Deserves More Recognition?
-
Top Paying Programming Technologies 2024
1. ZIG - $103,611
-
MicroZig: Unified abstraction layer and HAL for Zig on several microcontrollers
ESP32 and STM32 support is very welcome!
I have been following https://github.com/ziglang/zig/issues/5467 for a while and progress seemed to have slowed significantly
What are some alternatives?
PyCrypto - The Python Cryptography Toolkit
Nim - Nim is a statically typed compiled systems programming language. It combines successful concepts from mature languages like Python, Ada and Modula. Its design focuses on efficiency, expressiveness, and elegance (in that order of priority).
Odin - Odin Programming Language
pycryptodome - A self-contained cryptographic library for Python
v - Simple, fast, safe, compiled language for developing maintainable software. Compiles itself in <1s with zero library dependencies. Supports automatic C => V translation. https://vlang.io
pyOpenSSL -- A Python wrapper around the OpenSSL library - A Python wrapper around the OpenSSL library
rust - Empowering everyone to build reliable and efficient software.
PyNacl - Python binding to the Networking and Cryptography (NaCl) library
go - The Go programming language
ssr-proxy-js - A Server-Side Rendering Proxy focused on customization and flexibility!
Paramiko - The leading native Python SSHv2 protocol library.
rust - Rust for the xtensa architecture. Built in targets for the ESP32 and ESP8266