Luca Bruno

Engineer, Rust/Go developer, enthusiast Debian and FLOSS supporter.
Previously at @deno_land, @CoreOS, @RedHat.
→ @[email protected]

[Luca Bruno @lucabruno]

The planning for the #Rust devroom at #FOSDEM 2025 is almost done!
This year we received a lot of great proposals, way more than what we could fit into a single day.
On the bright side, we got allocated a room with very large capacity (500+ seats).
See you there in February!

[Luca Bruno @lucabruno]

@LiliCosic And for a matching cocktail, a flaming B-52 🍸
Same vibe!

[Deno @deno_land]

4 years after Deno 1.0, the next generation of JavaScript is ready for production at scale.

Deno 2 is out today:
🐢 Fully backwards compatible with Node and npm 📦 Package management and node_modules and package.json
📅 Long term support

https://t.co/LsV4D4Too8

[Luca Bruno @lucabruno]

Recently I've been playing with Quint, a specification language with static typing and (symbolic/temporal) model checking... it is absolutely amazing 🚀
A very welcome and refreshing alternative to TLA+ and its Toolbox:
https://t.co/6PQNuqMcKT

[Luca Bruno @lucabruno]

@LiliCosic Oh, the amount of misunderstandings avoided and time saved by such a tool... on every. single. paged. incident.🤤

[Luca Bruno @lucabruno]

I don't have a proper voltage glitching setup at home, so that's all for the moment 😀

[Luca Bruno @lucabruno]

Spent some time today tearing down a "Chipolo ONE Point" and identifying debug pads.
It's a Bluetooth tag (FCC ID: 2AD85-C21M) compatible with Google's Find My Device network.

[Luca Bruno @lucabruno]

The MCU is a nRF52833 and it's programmed with APPROTECT enabled.
However the chip seems to be an older revision (AAA0), so it may be still vulnerable to voltage glichting attacks to bypass the debug protection lock.

[Boshen @boshen_c]

The oxc parser has achieved parsing 100% of stage 4 features in the Test262 suite, including all syntax errors and regular expressions!

AST Parsed: 46287/46287 (100.00%)

[Luca Bruno @lucabruno]

From @CryspenHQ and Google, a formally verified Rust implementation of standard post-quantum algorithms.
https://t.co/s0c6w7Rsja

[Luke Edwards @lukeed05]

My (somewhat) hidden favorite bit of `tschema` is its CI and release pipeline. I'll probably reuse this in modules to come 😍 I have:

- source is @deno_land powered
--> native TypeScript
--> lint, type check, auto fmt, auto-docs, test, etc

- oxc-transform generates the .d.ts & .mjs files for npm
--> /cc @boshen_c

- one-liner gzip size checker in CI
--> reports the size in every Actions run (bottom log)
--> powered by @bunjavascript + terser

- dual publish to JSR & npm registries
--> Attestations linked & verified for each registry
--> run `deno task release <version>` and thats it~!

So on every commit, my repo is fully built, size-logged, tested, linted, and type-checked in under 10 seconds.

And on every git tag (see custom Deno task above!), "Publish" step waits for "Test" to succeed, which will build the module for each registry. This is a custom script, but for JSR it sets the `"version"` to my tag's value. And for npm, everything is built from source.

Both registries offer attestation signing/verification which prove that CI is the authentic publisher.

[CedarDB @cedar_db]

We were surprised to find out that everybody uses our strings. They even call them "German Strings". 😲🇩🇪

Take a look at our latest blog post to find out why @duckdb, @ApacheArrow, @DataPolars, and Facebook Velox use our custom string implementation.

https://t.co/uWkajXMdjg

[Luca Bruno @lucabruno]

@fredbrancz Just for the sake of completeness, I found the corresponding binary package and it is an even older version, built on April 2022.
So the binary should be outside the attacker timeframe.

[Luca Bruno @lucabruno]

@fredbrancz @iximiuz The refspec technically allows both the tag and the digest to be specified at the same time, but I'm not sure how well this is supported nowadays across tools: https://t.co/zilCWesb7S

[Marco d'Itri @rfc1036]

As everybody expected, after less than one month @AGCOMunica's (communications regulator) #antipezzotto platform censored @Cloudflare's IP 188.114.97.7 which hosts hundreds of thousands of web sites that have nothing to do with sports streaming. Congratulations to everybody!

[Polar Signals @PolarSignalsIO]

📢 Last announcement for the year! In collaboration with @materializeinc, we're super excited to introduce @rustlang heap memory profiling and a general-purpose library that made it happen! 🧊

Read about it on the blog! 🤩 #profiling #memory #leak #OOM

https://t.co/b2SvF5xyPx

[Luca Bruno @lucabruno]

The schedule for the Rust devroom at FOSDEM'24 is now up online: https://t.co/SBjH0RSMqQ.
Among the topics in this edition: Thunderbird, Servo, gccrs, Tower, WASM, Neo4j, cancer research, performance analysis, and much more...
See you there!

[Polar Signals @PolarSignalsIO]

🚀 We're beyond excited to announce a collaboration with @Canonical, on a path to enable frame-pointers by default starting in @Ubuntu 24.04! Read the full details on the blog 📖

https://t.co/w1ohwtTwfQ

[Brendan Abolivier @BrenAbolivier]

Over the past few months, we've been working hard to introduce support for @rustlang into @mozthunderbird.

Come join me in the Rust devroom at @fosdem 2024, to learn how we got there and what this means for the future of Thunderbird!

https://t.co/Jjrx1jS6Gt