You assume people read. :)

It's a bit ironic the page is protected by Cloudflare. So, all of our traffic is going through some other company to log and track before it gets to you, eh?

I generally vibe code with vim and my playlist in Cmus.

Man I was vim for life until cursor and the LLMs. For personal stuff I still do claude + vim because I love vim. I literally met my wife because I had a vim shirt on and she was an emacs user.

> I literally met my wife because I had a vim shirt on and she was an emacs user.

The editor wars are officially over. Thanks for your story!

Claude open in another tab, hitting L to reload the file doesn't do it for you?

I literally installed librewolf for the first time on my fresh Debian install. Couldn’t have had better timing!

There is no "arbitrary code execution and all kinds of nasty" in the Fil-C version and it profits from the decades spent fixing all the logic bugs, races, environment variable mess in coreutils.

Meanwhile, the Rust version of course is vulnerable to all of those: https://ubuntu.com/security/notices/USN-7867-1

> The "unknowns" in a C implementation means arbitrary code execution and all kinds of nasty.

In Fil-C?

isnt it x86_64 exclusive?

https://github.com/pizlonator/fil-c?tab=readme-ov-file#requi... says that the current implementation only targets Linux+x86_64 but that they see no reason it couldn't be portable.

But you're in the wrong (sub)thread; this (sub)thread is about whether it's safe.

ah, sorry about that and thanks for the link

As if Microsoft/GitHub (closed source platform) care about open source or free software…

Once you use CGO, portability is gone. Your binary is no longer staticly compiled.

This can happen subtley without you knowing it. If you use a function in the standard library that happens to call into a CGO function, you are no longer static.

This happens with things like os.UserHomeDir or some networking things like DNS lookups.

You can "force" go to do static compiling by disabling CGO, but that means you can't use _any_ CGO. Which may not work if you require it for certain things like sqlite.

You can definitely use CGO and still build statically, but you do need to set ldflags to include -static.

You can even cross-compile doing that.

Yes, indeed, I do.

You don't need CGO for SQLite in most cases; I did a deep dive into it here.

https://til.andrew-quinn.me/posts/you-don-t-need-cgo-to-use-...

> Which may not work if you require it for certain things like sqlite.

there is cgo-less sqlite implementation https://github.com/glebarez/go-sqlite it seems to not be maintained much tho

You're linking to a different version - this is the one that most people use https://github.com/modernc-org/sqlite

Yes and no, the package above is a popular `database/sql` driver for the same SQLite port you linked.

> This happens with things like os.UserHomeDir or some networking things like DNS lookups.

The docs do not mention this CGO dependency, are you sure?

https://pkg.go.dev/os#UserHomeDir

I was surprised too, that I had to check the docs, so I assume the user was misinformed.

Perhaps I misremembered or things changed? For instance, the os/user results in a dynamicly linked executable: https://play.golang.com/p/7QsmcjJI4H5

There are multiple standard library functions that do it.. I recall some in "net" and some in "os".

os.UserHomeDir is specified to read the HOME environment variable, so it doesn’t require CGo. os/user does, but only to support NSS and LDAP, which are provided by libc. That’s also why net requires CGo- for getaddrinfo using resolv.conf

There are at least a couple of ways to run SQLite without CGO.

I think the standard answer here is modernc.org/sqlite.

Careful, you're responding to the author of a wasm-based alternative.

No need to be careful. I won't bite. ;)

I remember when my greatest fear was sql injection. It’s great to see we have become more secure with our technology.

> It's a red flag for sure.

The first red flag was the repeated screenshots featuring Theo Browne, as if his thoughts or ideas carry any kind of authority.

I always used flash messages instead of toasts. I'm not sure if flash is the right term-- it's the inline message next to or above the form/element that changed or was submitted.

I thought flashes were easier to see (not only for people with special needs). As it turns out, when you make things more accessible, everyone wins.

I went through a phase where I used toasts because it felt like everyone was using them and my product/design was "old". I happily went back to flash messages when I came back to my senses.