惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

D
DataBreaches.Net
T
Threatpost
N
News and Events Feed by Topic
PCI Perspectives
PCI Perspectives
V2EX - 技术
V2EX - 技术
D
Docker
G
Google Developers Blog
Microsoft Security Blog
Microsoft Security Blog
N
News and Events Feed by Topic
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
Google Online Security Blog
Google Online Security Blog
The GitHub Blog
The GitHub Blog
Hacker News - Newest:
Hacker News - Newest: "LLM"
Y
Y Combinator Blog
M
MIT News - Artificial intelligence
Blog — PlanetScale
Blog — PlanetScale
博客园 - 司徒正美
T
Troy Hunt's Blog
Webroot Blog
Webroot Blog
Security Archives - TechRepublic
Security Archives - TechRepublic
量子位
Apple Machine Learning Research
Apple Machine Learning Research
H
Help Net Security
F
Full Disclosure
B
Blog
O
OpenAI News
H
Hackread – Cybersecurity News, Data Breaches, AI and More
博客园_首页
Google DeepMind News
Google DeepMind News
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Engineering at Meta
Engineering at Meta
大猫的无限游戏
大猫的无限游戏
Forbes - Security
Forbes - Security
Know Your Adversary
Know Your Adversary
B
Blog RSS Feed
MongoDB | Blog
MongoDB | Blog
Scott Helme
Scott Helme
T
The Exploit Database - CXSecurity.com
博客园 - 聂微东
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
The Last Watchdog
The Last Watchdog
Recorded Future
Recorded Future
IT之家
IT之家
Project Zero
Project Zero
Stack Overflow Blog
Stack Overflow Blog
小众软件
小众软件
Attack and Defense Labs
Attack and Defense Labs
L
Lohrmann on Cybersecurity
SecWiki News
SecWiki News
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com

HN's home page

More than 6 out of 10 people turn to AI for psychological support databow: a Rust CLI to query any database with an ADBC driver Pluto.jl 1.0 release – reactive notebook for Julia Use your Nvidia GPU's VRAM as swap space on Linux Show HN: Paseo – Beautiful open-source coding agent interface 4K years ago, Mohenjo-daro grew more equal over time Gleam v1.17.0 Released I'm skeptical about efforts to revolutionize schooling CT scans of BYD car parts Branchless Quicksort faster than std:sort and pdqsort with C and C++ API My thoughts after using Clojure for about a month The advertising cartel coming to your web browser Open Repair Data Standard – Open Repair Alliance JLink JTAG Access on the Pinecil Gmail Thinks I'm Stupid, So I Left HP re-releases classic computer science calculator: The HP-16C Show HN: Edsger – A handwritten Clojure REPL for the reMarkable 2 Microsoft's MAI-Code-1-Flash Scores 51% SWE-Bench Pro with Just 5B Active Params MAI-Thinking-1 Microsoft Announces AI Autopilot | Hacker News Morningstar values SpaceX at $780B, half its IPO target GitHub Copilot App | Hacker News Bringing Up DeepSeek-V4-Flash on AMD MI300X U.S. Army Corps of Engineers Bay Model Anthropic scales Claude Mythos to critical infrastructure in 15 countries QBE – Compiler Backend – 1.3 Larry Ellison: "Citizens will be on their best behavior because we’re recording" (2024) Three Ways to Get Paid (2018) Coreutils for Windows | Hacker News Trump signs executive order granting oversight of AI models Rethinking Search as Code Generation How we index images for RAG 1-Click GitHub Token Stealing via a VSCode Bug thunderbolt-ibverbs: We have InfiniBand at home WiFi Time | Hacker News Preparing for KDE Plasma's Last X11-Supported Release Please don't spam people looking for employment. It's just cruel Fidonet: Technology, Use, Tools, and History (1993) A walking tour of surveillance infrastructure in Seattle Expanding Project Glasswing Apple rejected my dictation app for using the accessibility API CSS-Native Parallax Effect | Hacker News Adafruit receives demand letter from Fenwick legal counsel on behalf of Flux.ai Stop Ruining It Why Janet? (2023) | Hacker News You Don't Love Systemd Timers Enough Show HN: Eyeball | Hacker News Strace-ui, Bonsai_term, and the TUI renaissance macOS needs its grid back How is Groq raising more money? Can the stockmarket swallow Anthropic, SpaceX and OpenAI? Age verification for social media, the beginning of the end for a free internet? Chipotlai Max | Hacker News OpenAI frontier models and Codex are now available on AWS Debug Project | Hacker News Should you normalize RGB values by 255 or 256? AI Agent Guidelines for CS336 at Stanford The newest Instagram “exploit” is the goofiest I've seen Anthropic confidentially submits draft S-1 to the SEC The Dirt That Refused to Die KDE at 30 The Pirate Bay Remains Resilient, 20 Years After the Raid CS336: Language Modeling from Scratch Sysadmining Like It's 2009 | Hacker News Nvidia Cosmos 3 Malicious npm packages detected across Red Hat Cloud Services Windows GOG DOS Games on M-Series Macs Flipper Zero Zig Template | Hacker News Linux Basics for Hackers (2019) Launch HN: Expanse (YC P26) – Unlock Wasted GPU Capacity Microsoft builds MacBook Pro rival with NVIDIA-powered Surface Laptop Ultra Now is the best time to be a duct tape engineer Go Experiments Explained | Hacker News Using Git's rerere feature to escape recurring conflict hell How turkey hacked the hair-transplant industry A 10 year old Xeon is all you need Sum-product, unit distances, and number fields Chuwi Minibook X | Hacker News Cloudflare Turnstile requiring fingerprintable WebGL Dav2d | Hacker News Squillions: How money laundering won London's Free Roof Terraces | Hacker News The Website Specification | Hacker News Why Custom Attributes in .NET Give Me Nightmares Muxcard, a dyi credit card size computer Webcam head tracking, webcam to control in‑game FOV CQL: Categorical Databases | Hacker News Decades of Effort Restore Steelhead and Salmon Passage on Alameda Creek Reviving Teletext for Ham Radio Unix in East Germany (GDR) (1990) Benchmarking SurrealDB 3.x vs. Postgres, Mongo, Neo4j and Redis (With Fsync) Key chemistry question answered, no quantum computer required New Beam Spring Keyboards | Hacker News Finding success in industry as a chip designer Linux/M68k | Hacker News Fooling around with encrypted reasoning blobs The Genius of the Barn Owl's Feathers Having your insulin pump die while you're on vacation Tracing HTTP Requests with Go's net/HTTP/httptrace Only 17% of all 64-bit Integers are products of two 32-bit integers
Ported my C game to WASM, here's everybug that I hit
birdculture · 2026-06-13 · via HN's home page

With regards to 1), do not write/read structs directly to/from files. Instead write a proper serializer/deserializer. Without it, you may encounter another breakage soon when a different compiler/compiler options insert different struct padding bytes, which will then once again make your data non-portable, and a maliciously crafted save file with no length/size field validation on the deserializer level can lead to a variety of memory bugs.


struct layout is well specified, it should be possible to avoid any padding issues by just aligning and by padding (with dummy members) correctly. The problem in practice is mostly integer representation (big-endian vs little-endian).


Specified by whom? Not the C standard for sure. It is indeed soecified by individual ABIs, and ABIs don't tend to do anything too weird, but that's another question.


Why is a relatively new technology like WASM being limited to 32-bit pointers? Why repeat the same mistake again?

> Web is 32-bit. Your 64-bit structs will break. This was the root cause of most of my bugs. WASM is 32-bit address space, pointers are 4 bytes not 8.


1: Letting your code break on pointer size changes is a quite bad sign imho (it's a sign that many other things are probably done with aliasing,etc and has a high risk of breaking due to undefined behaviour once gcc/clang gets around to utilizing it for an optimization).

2: iirc WASM was initially designed to be shimmable via Asm.JS to force laggards(Apple, Google) to implement it, Asm.JS in turn relied on specific rules in JS to get reliable 32bit arithmetic (but impossible for 64bit).

Wasm64 is implemented and works in Chrome and Firefox.. Apple is lagging again with Safari.


Thanks!

1: True, although it also limits the addressable memory and the typical 4GB limit seems less these days. I’m thinking of large apps like Figma running in the browser.

2: Will existing 32-bit WASM binaries break on WASM64 engines or does the binary have a flag for compatibility?


1: Something like Figma could probably offload some of the memory pressure to GPU textures. (But they'd probably run into safety browser limits before that).

2: Most runtimes are 64bit already, A runtime detecting a wasm32 binary will just continue to generate code with the current JIT compiler whilst WASM64 will require another JIT (and perhaps memory system since WASM32 runtimes are often based on "hacks" where 4gb of address space is reserved but not given real memory so that the JIT compiler gets an easier job without security implications).


what would make it break? i think the program just calls a 64 bit wasm memory function if it uses the capability


Because a web page shouldn’t use 4 GB of ram, and the win is that each pointer can be half the size (better for memory and cache).

The real mistake is requiring pointer to be 64 bit when most programs don’t use it.


I believe 32-bit was chosen partially due to implementation efficiency reasons. It makes sense because you can allocate a 4GB mapping, so there is no need for a second software virtual memory layer. Also perhaps they internally require tagged pointers, which are much cheaper, especially if aligned, if the pointer is only 32 bits


WASM has a (pointer + i32) address mode, and the effective address is 33 bits. So WASM implementations use 8GB mappings ...


32 is better for a lot of things like simd. the strength of it is wasm can do both types now and js can't unfortunately. a number in js is strictly 64.


I love how WASM is the thing that finally blurred the line between Web and Native programming, formely two realms isolated from each other for a long time. This both develops better awareness of how the code is executed by the hardware, which JavaScript devs often lack, and also brings skilled folks from the Native platforms who seem to be not so against WASM as they were against JavaScript (and all other parts of the Web, really). Maybe this will bear fruit in that people will make more Native user interfaces again.


I wanted to love it. As someone who hasn't done any web stuff since I was a child, I thought it'd amazing for it to be "just another platform".

I'm a bit disappointed though:

* There's still no way to do DOM manipulation. So then it's tempting to just grab a canvas and draw everything yourself, which of course wreaks on things like accessibility. I'm no fan of the web, but at least it comes with a somewhat agreed-upon way to display graphical stuff – it's a bit of a shame if we're all gonna just treat it like a surface for pixels.

* WASI still leaves something to be desired. Why can't I have raw sockets and file access and stuff, in a POSIX-like way? I understand that sandboxing is important, so this can all be on a per-request-basis, but still. This "just another platform" is still too far from just that.

* The amount of JS glue needed to actually load WASM stuff in the browser is annoying. The idea of needing a bunch of magic "bundlers" is sad.


> WASI still leaves something to be desired. Why can't I have raw sockets and file access and stuff, in a POSIX-like way?

FWIW, that's exactly what they shipped first, with WASI preview 1 (wasip1). You can still use this today, and all runtimes with any level of WASI support will be able to run it.


If enough people adopt identical or similar js glue then they can use that for a new standard. If people dont care about a standard interface then why both creaing a new standard? Look what happened with jquery selectors and ajax. People loved it and it became the new standard built into browsers.


You can call JS in which you can manipulate the DOM.

Of course architecturally (also regarding your file access) it's better to use the wasm for logic as much as possible where the web (HTML/JS) provides the UI and IO, data flows into wasm for work and results flow back to the web.

This also has the benefit that you can keep your original C/C++ source code much more platform agnostic which helps reusability and testing.


> You can call JS in which you can manipulate the DOM.

Well sure. But for me, the promise of WASM was to make the browser "just another platform". Now it's "this special platform where you have to access some of the most important functionality through FFI interop with a very high-level, very opinionated language".

> Of course architecturally (also regarding your file access) it's better to use the wasm for logic as much as possible where the web (HTML/JS) provides the UI and IO, data flows into wasm for work and results flow back to the web.

OK, but like, I wanted the browser to be "just another platform". I don't want to use JS, and I consider HTML orthogonal to my logic. I realize that's not where we're at, but that's what I dreamt of. Hence my disappointment. Which is OK, I don't matter :)

> This also has the benefit that you can keep your original C/C++ source code much more platform agnostic which helps reusability and testing.

It feels the opposite to me.


There's no way to draw on a canvas in WASM either. You just decided to write JS wrapper functions for that. But you didn't write wrapper functions for DOM manipulation.


You're right. But at least the JS wrapper for the canvas is just used for setting up the shared memory, if I remember correctly?

At any rate: this doubly makes my point.


Fun game! The demo works great on mobile except for some small font sizes and you can't hover over items to see the tooltip before selecting them.


Meta: a space is missing in the title.

Since this is one of the bugs, I always recommemd writing

    game->boardPieces = swAlloc(sizeof(ThingHandle*) * row * column);

Like this instead:

    game->boardPieces = swAlloc(sizeof *game->boardPieces * row * column);

It's not 100% better, but it cuts out a few tokens which helps readability and moves the significant asterix further left where I think it's easier to spot.


It's totally true, using sizeof like a function is one of my pet peeves. Even the kernel people do it but it's WRONG and you are right.

But ACSHUALLY, how you write allocation is like this

    #define sane_alloc(type, count) ((type *) malloc(sizeof (type) * (count)))

    game->boardPieces = sane_alloc(BoardPiece, row * column);

The kernel people seem to finally have figured out this one in 2026.


Honestly, I think I'm more likely to get your form wrong than the original one. This doesn't obviously look wrong to me:

   game->boardPieces = swAlloc(sizeof game->boardPieces * row * column);

Maybe I find this harder to parse because I'm not used to sizeof without brackets (though I know it's valid). But I think the bigger deal is that your version has a bug if the star is missing whereas there's has a bug if the star is present; it's easier to spot something extra than it is to spot something missing.


The memory64 proposal was merged into upstream last year, any reason to opt into 32 bit despite that?


It's slower. Wasm32 can just reserve 8 GiB (32-bit pointer + 32-bit offset) of the virtual address space from the OS for each memory, so checking for out-of-bounds memory accesses imposes no performance penalty. Wasm64 can't do that, so each memory access is a bit slower.


Oh that's interesting, never noticed it in my experience but I have never written anything in wasm where it would matter. Makes perfect sense now that I think about it though. Thanks!


You don't need 4GB and it wastes memory to make pointers twice as big? Even Linux supports running 64-bit code in a 32-bit address space ("x32 ABI") for this reason.


> Even Linux supports running 64-bit code in a 32-bit address space ("x32 ABI") for this reason.

I don't think that ever had much, if any, adoption and it looks like it will be removed in the next few releases.


they limit some good things on purpose just for the sake of ecosystem competition. but with this they are slowly implementing it?