Made a demo of timing attacks as part of my &spectre writeup...hopefully I still have time to actually explain the Spectre part 😅

!til working on my &spectre article this morning, plz tell me if my handwavey pipeline diagram is too handwavey

!til In windows applications there is an

!til that &spectre is in principle possible for any kind of speculative execution, simply because if the CPU does the wrong thing, the behavior can be observed, whether by cache timing, or contention for internal CPU resources, or by monitoring power consumption...or basically anything else

!til Reducing the precision of performance.now() was a waste of time and only done to annoy me. &spectre

!til There is a conceptually simpler way of figuring out which value was read out of bounds in a &spectre attack - just index using an in-bounds value immediately afterward and see if the access is fast or slow. If it's fast, and you know the value used for the index, then you know that the secret out-of-bounds value == your index, and you've extracted the information.

!til about the BTB and RSB...so many ways for CPUs to speculate &spectre

!til There are multiple variants of &spectre described in the original paper, not just the out-of-bounds read that I've seen discussed in many places. (Also the original paper is very clear and well-written.)

!til people were extracting data via cache timing attacks back in like 2005, and yet somehow &spectre was not recognized until 2017?

I’ve been working on a visualizer for emmalloc, a small and simple memory allocator commonly used for WASM. It’s a combination of personal learning + building toward a new memory control proposal for WASM. Other people are going to need to know how these things work if I’m going to convince anyone to do things differently!

My LuaX project is finally paying off. This page used to be a pile of carefully arranged HTML with "thing-start", "thing-middle", and "thing-end" templates. Now I have "components" that are just Lua functions that return HTML - and I can just define a big table in Lua with all my data, loop over it to produce HTML, and return it to the browser.

I got sick of Go templates on my personal website and decided to try something weird. I like the syntax of JSX, but I wanted to server-render things and didn't want to use JS or any weird frameworks. So - I built a JSX-like transpiler for Lua. I guess it's called LuaX. Notice the HTML tags inline in the source code.

This allows me to write blog posts and other website content without ever recompiling the website binary. And using a real programming language instead of Go templates allows me to write nice "components", but all on the server. It feels very nice so far.

(Also, the whole transpiler is less than 1000 lines of code, because Lua is such a wonderfully simple language to parse.)

Unfortunately I didn't get to the interesting history-editing features I had in mind during the jam. I did at least manage to produce a git commit graph with collapsible commits. The idea is to condense the history of a repo so that the branching structure stands out more than all the individual commits. &dragit

Witness my visual git client! You can tell it's visual because you can pan and zoom. &dragit

(This is actually just proving that I have an Orca app up and running with git commands, which...took a while. The fun stuff starts now, finally.)

I've been working on Orca's dev tooling. When you set it up, you get a single orca executable that works for both bundling your own Orca apps or building the Orca runtime itself. It detects when you're running it from an Orca source directory and enables extra commands - and falls back on the version of the tooling in your source directory instead of the system-installed version.

I've been working on a WebAssembly disassembler / viewer. The goal is to make it easy to navigate types and functions, find the objects corresponding to a particular byte offset, see where a particular instruction is used...all the stuff that I wish I had at work. 🙂

https://timezones.exposed/ finally has a better city selector, plus the ability to share a setup with others.

At @d7's behest, you can now select a particular city, and in general just move the blue line around. Also I'm now rendering day and night on each individual timeline. https://timezones.exposed/

https://timezones.exposed now shows day and night on the map, correctly updated based on time of year

Here's a bug you may not have considered, that &yno could help you catch.

A few more &yno scenarios, all trying to verify if plain old HTTP requests are working.

1. Caddy is trying to force all traffic to HTTPS, which doesn't work. yno shows you the redirect packets.
2. Caddy is now only handling HTTPS, rejecting my initial request.
3. I have now forced Caddy to use HTTP, and things work!

This was real debugging; I didn't mean to configure Caddy this way, and yno actually helped me find the issue 😁

Finally have something to show! &yno is performing a battery of checks to figure out why HTTP connections aren't working, including sniffing packets to figure out which programs are actually handling the traffic despite connections not working.

https://timezones.exposed/ now lets you add/remove cities. And it’s prettier. And it’s faster. Now I’m actually taking a break from it.

https://timezones.exposed/. Pretty rudimentary but I wanted to get it out in some form before I have to take a break from it. Hopefully works ok on your phone.

Inspired by recent travel nonsense, I'm making a little web app where you can lay out time zones against each other and see exactly how the same time is measured everywhere. Note that this actually handles daylight saving time correctly, unlike every calendar app I use. Also clearly shows that not all time zones are offset by an hour...some are half-hour or even 15 minutes.

Handmade Math 2.0 is officially released: https://github.com/HandmadeMath/HandmadeMath/releases/tag/v2.0.0

A release candidate for Handmade Math 2.0 is finally out. If you use Handmade Math in your own projects, please give version 2.0 a try, and try running the update tool on your project to automatically update names. Let us know what you think! Thanks to @dev_dwarf for his work on this release. https://github.com/HandmadeMath/HandmadeMath/releases/tag/2.0.0-rc1

I did Advent of Code in Dreams this month as a way to seriously try one of my favorite visual programming systems. I just finished a blog post recapping the month and what I learned along the way. https://bvisness.me/advent-of-dreams/

My profiling adventures continue - I now have a tool to handle DTrace profiles directly. https://github.com/bvisness/dtrace2spall

The result is much uglier but more accurate profiles where the time axis actually means something!

I made a tool that can convert the stackcollapse format (available for many tracing tools) into the spall format: https://github.com/bvisness/sc2spall. This example is a Rust program from work being profiled via dtrace.

First blog post in a while! https://bvisness.me/essential-complexity/

Spent the day making a dashboard to help me profile Go apps. The heavy lifting of the profiling and the profile viewing was already done for me, but the process of actually recording, saving, and opening profiles was really annoying. No more!

Implemented TCP sending / receiving, with retransmission. It now reliably transmits data even if the network is unreliable! (In this example, one of the connections drops 10% of packets.) &netsim

Doing the TCP handshake, and sending and ACKing data! &netsim

After a bunch more work and one LLVM bug (🙃) we have better visualization of dropped packets, plus a lot of other little animation polish things. &netsim

We are simulating routing! Packets are moving through the network 😃 &netsim

At last...we have "simulated" a "packet". &netsim

Bringing Metadesk to the masses...by writing a parser in JS

The climb / hang tool for the robotics team is done enough for now. In this clip you can see that the robot basically flips upside down when it tries to climb - so then I add our battery to see how it changes things. I can move the battery's placement to see how it affects our center of mass and therefore how we hang.

The tool now has a few real-world materials to choose from, and will automatically calculate the mass of objects based on their material and dimensions. It has a few options relevant to our team, and an option to override the mass for special cases (like the battery).

You can screw around with it at https://bvisness.me/apps/hangar.

(The mass of the battery is overestimated in the video because I forgot to change the quantity to 1...so there are two batteries, apparently.)

I've spent the last few days working on a tool to help the robotics students test their climber ideas by seeing how the robot will naturally hang from a bar.

The students came up with a climber design that, while the geometry worked out, failed to actually climb because it hung at the wrong angle. A hanging object always wants its center of mass directly below the point of attachment - but this has proven to be hard for the students to understand and keep in mind while designing. This tool should make that a lot easier.

It is ugly as hell right now, and needs a lot of fixes and improvements still, but it's already almost perfectly replicating exactly the problems we saw with our real robot in competition.

(Written in C, using Raylib, and compiling to WASM.)

Made a few quality-of-life improvements to https://regular.express today (my visual regular expression tool):

• Character sets are rendered more clearly, have improved keyboard navigation, and can now be negated (putting a ^ at the beginning).
• Keyboard shortcuts should work correctly on macOS.
• More regex syntax is parsed and passed through even when it cannot be edited, making the tool more useful for quick edits to existing regexes.
• I also removed 12MB of zeroes from the executable that LLVM left in there for some reason.

&regex

I've been playing around with Metadesk bindings for Go. It's taken me a couple days but everything seems to be working! Metaprogramming is fun 😁

Making an app that can map out the release history of any NPM project.

The goal is to help you quickly spot several things: how often they break things (new major versions), how often they put out patches, whether they backport changes to old major versions...whatever matters to you.

Done. Super happy with how this turned out! Working on the full submission now. &db

I added aggregates, and @Ejektaflex added SQL pretty printing &db

Bigger example of the workflow. At each stage we can build up to a bigger query by looking at the data available to us. At the end we can easily make multiple "views" of the same data by making two Order nodes to sort the same data in different ways - and both Order options remain close at hand while we work forward from there. &db

joins!! &db

perfection &db

Incrementally building database queries. Start with a table, see the data, tweak the data, repeat.

Every node in the graph produces a valid query. You can even build up multiple queries in the same "workspace" and run them on the fly.

&db

A little better. &db

such beauty, truly the future of databases &db

Wrote up a blog post describing a strange issue @AsafGartner and I ran into while building the post editor for the new website. Resolving it involved digging into both Chrome itself and the Go compiler, and it was really fun to pick apart. https://bvisness.me/chrome-wasm-crash/

I can now compose this entire regex in my visual regex builder without touching the mouse. This is pretty exciting to me - this tool should be useful for both beginners and power users.

Undo and redo is working in the regex builder! Thanks to @rxi for the write-up of a simple undo system, and @ryanfleury for pointing out that allocator stuff can go in the undo system as well.

Hand-writing some WASM for fun. This is a memchr implementation that is being used to check if the character following a backslash is a valid "metacharacter" in a regex. No real reason to write this in WASM directly except to learn it better.

Making text input feel right is a lot of work, but it's paying off. This video demonstrates the same cursor and selection code being applied to two separate data structures, neither of which is a buffer of chars.

Tonight I made my regex builder distinguish between "insert index" and "cursor index/position", which allows me to display the cursor on the right or left side of an element without affecting how inserts and deletes work.

A robot simulator for the upcoming FIRST Robotics Competition season, since we won't be able to meet in person at the school! This is last year's actual robot code, running in FIRST's official hardware simulator, piping data over websockets to Godot, where we're using the simulator's output to drive a physics simulation.

It's maybe not the most "handmade" thing I've ever done, but I think it's a good reminder of what is possible when all the parts of your system are well-designed and easy to use!

Threw together a very simple IMGUI for my robotics students. The goal is to give the students a more interesting platform than just a command line!

Visual regex builder: now 200% prettier and rounder. (Gotta file down those sharp edges!) Also now has a bunch more keyboard shortcuts; I think when this is done it will be really powerful even without the mouse.

Making great progress on the visual regex builder lately. Now has various keyboard editing features, and as of today, the ability to paste in a regular expression from elsewhere so you can edit it visually.

Made great progress this weekend on my regex builder. The goal is to be able to build and manipulate regular expressions completely visually so you don't even have to deal with the syntax.

Spent the evening getting @rxi 's microui implemented in WASM without using Emscripten or any bulky C stdlib stuff. It was an absolute joy to use, once my hand-rolled memcpy stopped crashing everything 🙂

A concept for navigating code in an environment that doesn't care about files. Instead of your IDE jumping you over to a different file, it could just show the referenced item and any helpful context. For example, viewing an interface could automatically show you all the types that implement it, or viewing a method could show you the associated type.

https://bvisness.me/apps/columns/

Finally back to work on my VR vectors project. Added projection today! https://www.youtube.com/watch?v=3zWOvXlVQRU

Don't settle for other people's CI tools - build your own!

Making progress with the VR vector tool - added expression labels and the ability to drag between two vectors to get subtraction. https://www.youtube.com/watch?v=M14ic_Ogt30

Work in progress of a VR vector math tool! (Built using LÖVR, a project demoed at Handmade Seattle)

Day 1 of IMGUI learning complete

Coming soon to a phone near you...

Still rough, but a visualization of camera/eye space for a 3D scene.

Custom test coverage macros for Handmade Math. They just helped me discover that the four test cases I wrote for this function don't actually cover all four branches...

WIP WebGL car paint shader - basically a PBR shader with iridescence, two-tone colors, and clear coat. Still need to get shadows in there...

I made a 3D renderer of sorts...but in an online graphing calculator. I'm both so proud and so ashamed. https://www.desmos.com/calculator/c36bgd853p

a quick solver for Boggle (a word-finding game): https://bvisness.me/apps/boggler/

Generating mazes in Javascript, WASM (via Go), and WASM (via Rust), to compare the performance characteristics of each: http://bvisness.me/apps/wasmaze/