Dirkjan Ochtman
@djc.ochtman.nl
Fan of Rust, open source maintainer. Please consider sponsoring my OSS work on GitHub.
We (the rustup team) have published a release candidate for rustup 1.29.0, with a much improved toolchain download experience. Please try it out to give us feedback in advance of the release.
internals.rust-lang.org/t/seeking-be...
internals.rust-lang.org/t/seeking-be...
Seeking beta testers for rustup v1.29.0
Hi everyone! I'd like to announce on behalf of the rustup team that rustup 1.29.0 beta is now available for testing and we are currently looking for testers. The headline of this release is that rus...
internals.rust-lang.org
December 14, 2025 at 10:33 AM
We (the rustup team) have published a release candidate for rustup 1.29.0, with a much improved toolchain download experience. Please try it out to give us feedback in advance of the release.
internals.rust-lang.org/t/seeking-be...
internals.rust-lang.org/t/seeking-be...
Reposted by Dirkjan Ochtman
Interesting Rust semver hazard: if you're not `warn(unnameable_types)`, you could be leaking private dependencies via fields in types that are unnameable but can be reached, and this won't be detected by tools based on rustdoc-types (like cargo-check-external-types).
December 12, 2025 at 9:15 AM
Interesting Rust semver hazard: if you're not `warn(unnameable_types)`, you could be leaking private dependencies via fields in types that are unnameable but can be reached, and this won't be detected by tools based on rustdoc-types (like cargo-check-external-types).
Reposted by Dirkjan Ochtman
Super exciting: Rust is no longer experimental in the Linux Kernel, it is here to stay!!!
lwn.net/Articles/104...
lwn.net/Articles/104...
The end of the kernel Rust experiment
The topic of the Rust experiment was just discussed at the annual Maintainers Summit. The cons [...]
lwn.net
December 10, 2025 at 5:13 AM
Super exciting: Rust is no longer experimental in the Linux Kernel, it is here to stay!!!
lwn.net/Articles/104...
lwn.net/Articles/104...
Earlier this year, LWN.net featured an excellent article named "Linux's missing CRL infrastructure", and today
Canonical announced it will be working with me and @jbp.io over the coming weeks to start bridging the PKI infrastructure gap.
discourse.ubuntu.com/t/addressing...
Canonical announced it will be working with me and @jbp.io over the coming weeks to start bridging the PKI infrastructure gap.
discourse.ubuntu.com/t/addressing...
Addressing Linux's Missing PKI Infrastructure
Earlier this year, LWN featured an excellent article titled “Linux’s missing CRL infrastructure”. The article highlighted a number of key issues surrounding traditional Public Key Infrastructure (PKI)...
discourse.ubuntu.com
December 8, 2025 at 5:08 PM
Earlier this year, LWN.net featured an excellent article named "Linux's missing CRL infrastructure", and today
Canonical announced it will be working with me and @jbp.io over the coming weeks to start bridging the PKI infrastructure gap.
discourse.ubuntu.com/t/addressing...
Canonical announced it will be working with me and @jbp.io over the coming weeks to start bridging the PKI infrastructure gap.
discourse.ubuntu.com/t/addressing...
Reposted by Dirkjan Ochtman
damn why didn’t i think of making a js runtime that segfaults
December 2, 2025 at 6:57 PM
damn why didn’t i think of making a js runtime that segfaults
Reposted by Dirkjan Ochtman
With the @openuk.bsky.social Awards coming up, we’re excited that Rustls — a memory-safe TLS library — is shortlisted in two categories, and Creator Joe Birr-Pixton is also recognized individually.
The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡
The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡
Rustls Shortlisted for Two 2025 OpenUK Awards - The Rust Foundation
The Rust Foundation is delighted to congratulate Rustls for being shortlisted in the Open Source Software and Security categories of the OpenUK Awards 2025 — and Joe Birr-Pixton, Rustls Creator, for…
rustfoundation.org
December 2, 2025 at 7:45 PM
With the @openuk.bsky.social Awards coming up, we’re excited that Rustls — a memory-safe TLS library — is shortlisted in two categories, and Creator Joe Birr-Pixton is also recognized individually.
The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡
The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡
@bitwarden.bsky.social broke passkey support in their browser extension and after 8 days they have neither released a fix nor rolled back their extension to the previous version (which at least some extension directories allow).
github.com/bitwarden/cl...
github.com/bitwarden/cl...
`chrome is not defined` on Firefox in v2025.11.1 extension breaks Passkey function · Issue #17598 · bitwarden/clients
Steps To Reproduce Go to https://www.passkeys.io/ Open DevTools See Uncaught ReferenceError: chrome is not defined Notice that passkey request cannot be handled by Bitwarden and fallback to Windows...
github.com
November 30, 2025 at 12:12 PM
@bitwarden.bsky.social broke passkey support in their browser extension and after 8 days they have neither released a fix nor rolled back their extension to the previous version (which at least some extension directories allow).
github.com/bitwarden/cl...
github.com/bitwarden/cl...
Input lag on GitHub is increasingly bad. :(
November 27, 2025 at 8:01 PM
Input lag on GitHub is increasingly bad. :(
If your cargo-deny runs are failing this morning, it’s because we merged an advisory with v4 CVSS rating which only recently became supported in rustsec 0.31 (released 15 days ago). Fix submitted in github.com/EmbarkStudio..., workaround in github.com/rustsec/advi....
Update rustsec v0.31 by jayvdb · Pull Request #805 · EmbarkStudios/cargo-deny
Fixes #804
See https://github.com/rustsec/rustsec/releases/tag/rustsec%2Fv0.31.0
github.com
November 22, 2025 at 11:26 AM
If your cargo-deny runs are failing this morning, it’s because we merged an advisory with v4 CVSS rating which only recently became supported in rustsec 0.31 (released 15 days ago). Fix submitted in github.com/EmbarkStudio..., workaround in github.com/rustsec/advi....
So is type alias impl trait basically blocked on the next trait solver?
November 19, 2025 at 12:55 PM
So is type alias impl trait basically blocked on the next trait solver?
Love it when Vander Stoep comes out with another banger showing metrics for all the things Rustaceans feel in their bones.
November 14, 2025 at 6:31 AM
Love it when Vander Stoep comes out with another banger showing metrics for all the things Rustaceans feel in their bones.
Is there ever a legit use case for `const FOO: AtomicU8: ..`? If not, can we please promote `clippy::declare_interior_mutable_const` to a compiler lint?
November 11, 2025 at 1:25 PM
Is there ever a legit use case for `const FOO: AtomicU8: ..`? If not, can we please promote `clippy::declare_interior_mutable_const` to a compiler lint?
Hot take: don’t make callback APIs in Rust. Minimize Fn arguments; guard types are almost always a better solution (except in very simple/generic map() combinators).
November 6, 2025 at 5:14 PM
Hot take: don’t make callback APIs in Rust. Minimize Fn arguments; guard types are almost always a better solution (except in very simple/generic map() combinators).
Second time I heard this pitch this week. The problem is that (well-maintained) dependencies take care of the issues you haven’t thought of yet. There is some cost to having dependencies and making sure the dependency graph doesn’t grow too much takes work, but codegen doesn’t seem a great option.
What if, instead of adding dependencies for most things, we used large language models to generate code instead?
nrempel.com/smaller-sur...
nrempel.com/smaller-sur...
Smaller Surfaces
Modern dependency graphs feel like thickets. Agents make it practical to generate narrow helpers, keep the runtime surface small, and verify the results with the tools you already trust. This essay looks at how to use generation over integration without slipping into wheel reinvention or fragile bespoke stacks.
nrempel.com
November 1, 2025 at 6:25 PM
Second time I heard this pitch this week. The problem is that (well-maintained) dependencies take care of the issues you haven’t thought of yet. There is some cost to having dependencies and making sure the dependency graph doesn’t grow too much takes work, but codegen doesn’t seem a great option.
deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses
arxiv.org/abs/2506.15648
arxiv.org/abs/2506.15648
deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses
Although Rust ensures memory safety by default, it also permits the use of unsafe code, which can introduce memory safety vulnerabilities if misused. Unfortunately, existing tools for detecting memory...
arxiv.org
October 31, 2025 at 10:48 PM
deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses
arxiv.org/abs/2506.15648
arxiv.org/abs/2506.15648
Dutch folks: nerdvote.nl!
NerdVote.NL
Ondersteuning voor en informatie over alle kandidaat-kamerleden met en warm hart voor onze privacy en eigen IT-vaardigheden.
nerdvote.nl
October 29, 2025 at 8:09 AM
Dutch folks: nerdvote.nl!
Reposted by Dirkjan Ochtman
Please don't write your commit messages or PR descriptions with AI. If you didn't bother writing it I'm not sure I can be bothered reading it.
October 28, 2025 at 1:20 PM
Please don't write your commit messages or PR descriptions with AI. If you didn't bother writing it I'm not sure I can be bothered reading it.
Hot take: closures (above a certain fairly low complexity level) kinda suck and elaborating them into an explicit struct with an explicit method usually makes code easier to read. (More so in async world.) Instead, work on reducing the need (over guards), like partial borrowing?
New rust-lang blog post on explicit capture clauses, continuing to document thoughts about ergonomic ref-counting:
smallcultfollowing.com/babysteps/bl...
smallcultfollowing.com/babysteps/bl...
Explicit capture clauses · baby steps
smallcultfollowing.com
October 23, 2025 at 6:14 AM
Hot take: closures (above a certain fairly low complexity level) kinda suck and elaborating them into an explicit struct with an explicit method usually makes code easier to read. (More so in async world.) Instead, work on reducing the need (over guards), like partial borrowing?
This is going to be cool.
New #rust blog post on how we could get types that cannot be forgotten, types that must be moved, async and const drop, and other fun stuff:
smallcultfollowing.com/babysteps/bl...
smallcultfollowing.com/babysteps/bl...
Move, Destruct, Leak, and Rust · baby steps
smallcultfollowing.com
October 22, 2025 at 6:14 AM
This is going to be cool.
RustSec advisories for TARmaggedon are coming soon (probably tomorrow).
October 21, 2025 at 8:31 PM
RustSec advisories for TARmaggedon are coming soon (probably tomorrow).
Reposted by Dirkjan Ochtman
WTF. 🤯
Postman's server's are down and you can't even use desktop app with your local APIs!
This is exactly why I made yaak.app. It works offline, is open source, has no telemetry, no VC funding, and even syncs with Git!
Give it a try and let me know what you think ✨
Postman's server's are down and you can't even use desktop app with your local APIs!
This is exactly why I made yaak.app. It works offline, is open source, has no telemetry, no VC funding, and even syncs with Git!
Give it a try and let me know what you think ✨
October 20, 2025 at 4:43 PM
WTF. 🤯
Postman's server's are down and you can't even use desktop app with your local APIs!
This is exactly why I made yaak.app. It works offline, is open source, has no telemetry, no VC funding, and even syncs with Git!
Give it a try and let me know what you think ✨
Postman's server's are down and you can't even use desktop app with your local APIs!
This is exactly why I made yaak.app. It works offline, is open source, has no telemetry, no VC funding, and even syncs with Git!
Give it a try and let me know what you think ✨
Reposted by Dirkjan Ochtman
It's been 14 months since the ML-KEM spec was published.
age still isn't PQ because it's waiting for trivial details of the HPKE hybrids to stabilize, but they are blocked on the CFRG.
The TLS, SSHM, and LAMPS (X.509) IETF WGs are not waiting for CFRG. I just posted a plea for HPKE to do the same.
age still isn't PQ because it's waiting for trivial details of the HPKE hybrids to stabilize, but they are blocked on the CFRG.
The TLS, SSHM, and LAMPS (X.509) IETF WGs are not waiting for CFRG. I just posted a plea for HPKE to do the same.
[hpke] Let's ship post-quantum HPKE
Search IETF mail list archives
mailarchive.ietf.org
October 16, 2025 at 3:11 PM
It's been 14 months since the ML-KEM spec was published.
age still isn't PQ because it's waiting for trivial details of the HPKE hybrids to stabilize, but they are blocked on the CFRG.
The TLS, SSHM, and LAMPS (X.509) IETF WGs are not waiting for CFRG. I just posted a plea for HPKE to do the same.
age still isn't PQ because it's waiting for trivial details of the HPKE hybrids to stabilize, but they are blocked on the CFRG.
The TLS, SSHM, and LAMPS (X.509) IETF WGs are not waiting for CFRG. I just posted a plea for HPKE to do the same.