GeistHaus
log in · sign up

fasterthanli.me

Part of fasterthanli.me

amos likes to tinker

stories primary
2025 Recap: so many projects
retrospective

I’ve been working on so many projects in 2025, I thought it was important for me to make a recap, if only just to clear my head.

There are many, many, many things to go through and we don’t have a sponsor today, so I’m gonna start right away with facet!

facet

facet is a project that I started working on in March of this year — that’s right, it’s only been ten months, yet it feels like an eternity.

https://fasterthanli.me/articles/2025-recap
Introducing arborium, a tree-sitter distribution
rustdocstree-sitter

About two weeks ago I entered a discussion with the docs.rs team about, basically, why we have to look at this:

My browser showing a docs.rs page for a crate that I published myself, which contains a lot of different code blocks with different languages but they're all white on black. It's sad.

When we could be looking at this:

My browser showing a docs.rs page for a crate that I published myself, which contains a lot of different code blocks with different languages. this time it's colored.

And of course, as always, there are reasons why things are the way they are. In an effort to understand those reasons, I opened a GitHub issue which resulted in a short but productive discussion.

I walked away discouraged, and then decided to, reasons be damned, attack this problem from three different angles.

https://fasterthanli.me/articles/introducing-arborium
Does Dioxus spark joy?
rustdioxusfrontend
Amos

Note: this article is adapted from a presentation I gave at a Rust Paris Meetup — that’s why it sounds a little different than usual. Enjoy!

Good evening! Tonight, I will attempt to answer the question: Does Dioxus spark joy? Or at the very least, whimsy.

What’s Dioxus, you ask? It is first and foremost a name that is quote: “legally not inspired by any Pokémon”.

The deoxys pokemon

Even if the author concedes in a Hacker News comment that the “Deoxys” Pokémon is, I quote: “awesome”.

https://fasterthanli.me/articles/does-dioxus-spark-joy
Engineering a Rust optimization quiz
quizrusteurorust

There are several Rust quizzes online, including one that’s literally called the “Unfair Rust Quiz” at https://this.quiz.is.fckn.gay/, but when I was given the opportunity to record an episode of the Self-Directed Research podcast live on the main stage of EuroRust 2025, I thought I’d come up with something special.

Question Misc 6 of the unfair Rust quiz, about drop order.

The unfair rust quiz really deserves its name. It is best passed with a knowledgeable friend by your side.

https://fasterthanli.me/articles/engineering-a-rust-optimization-quiz
Making our own spectrogram
soundrustmaths

A couple months ago I made a loudness meter and went way too in-depth into how humans have measured loudness over time.

A screenshot of the fasterthanlime audio meter, with RMS, sample peak, true peak, and various loudness metrics.

Today we’re looking at a spectrogram visualization I made, which is a lot more entertaining!

We’re going to talk about how to extract frequencies from sound waves, but also how my spectrogram app is assembled from different Rust crates, how it handles audio and graphics threads, how it draws the spectrogram etc.

https://fasterthanli.me/articles/making-our-own-spectrogram
crates.io phishing attempt
rustsecurity

Earlier this week, an npm supply chain attack.

It’s turn for crates.io, the main public repository for Rust crates (packages).

The phishing e-mail looks like this:

A phishing e-mail: Important: Breach notification regarding crates.io  Hi, BurntSushi! We recently discovered that an unauthorized actor had compromised the crates.io infrastructure and accessed a limited amount of user information. The attacker's access was revoked, and we are currently reviewing our security posture. We are currently drafting a blog post to outline the timeline and the steps we took to mitigate this. In the meantime, we strongly suggest you to rotate your login info by signing in here to our internal SSO, which is a temporary fix to ensure that the attacker cannot modify any packages published by you.
Andrew Gallant on BlueSky

And it leads to a GitHub login page that looks like this:

A fake GitHub sign-in page.
Barre on GitHub

Several maintainers received it — the issue is being discussed on GitHub.

The crates.io team has acknowledged the attack and said they’d see if they can do something about it.

https://fasterthanli.me/articles/crates-io-phishing-attempt
color npm package compromised
npm

On September 8 2025, around 13:00 UTC, someone compromised Josh Junon’s npm account (qix) and started publishing backdoored versions of his package.

Someone noticed and let Josh know:

Hey. Your npm account seems to have been compromised. 1 hour ago it started posting packages with backdoors to all your popular packages.
Charlie Eriksen on BlueSky

Josh confirmed he’d gotten pwned by a fake 2FA (two-factor authentication) reset e-mail:

Yep, I've been pwned. 2FA reset email, looked very legitimate.  Only NPM affected. I've sent an email off to @npmjs.bsky.social  to see if I can get access again.  Sorry everyone, I should have paid more attention. Not like me; have had a stressful week. Will work to get this cleaned up.
Josh Junon on BlueSky

The phishing e-mail came from npmsj.help (registered 3 days prior) and claimed users had to reset their 2FA:

https://fasterthanli.me/articles/color-npm-package-compromised
The science of loudness
audiomathsphysics

My watch has a “Noise” app: it shows dB, for decibels.

My amp has a volume knob, which also shows decibels, although.. negative ones, this time.

And finally, my video editing software has a ton of meters — which are all in decibel or decibel-adjacent units.

How do all these decibels fit together?

https://fasterthanli.me/articles/the-science-of-loudness
Summer fasterthanlime update
meta

There are news!

Cool bear Cool Bear's hot tip

TL;DR: If you’re a patron or sponsor, check your Profile page to get detailed explainers of every perk. You’ll need to log in. Duh.

Here are all the changes I’m implementing, summarized as a table:

BeforeAfter📚 Articles remain exclusive for 6 monthsEarly access (couple weeks) for Silver tier🎞️ No early access for videoVideo early access on Patreon and website
https://fasterthanli.me/articles/summer-fasterthanlime-update
All color is best-effort
colorvideodsp

I do not come to you with answers today, but rather some observations and a lot of questions.

The weird glitch

Recently I was editing some video and I noticed this:

A screenshot of the video, there are visible circles at various places in the image. Some of them are black, some of them are white. The image itself shows some blue and white text composited on some blurry background, which doesn’t really matter for this, and there’s a red line horizontal up in the image. It’s very confusing.

Not what the finger is pointing at — the dots.

Here are the separate layers this image is made up of: the background is a stock image I’ve licensed from Envato Elements:

A picture of a canyon, darker than you’d expect.

Because I use it as a background image, I’ve cranked down the exposition in the Color tab:

https://fasterthanli.me/articles/all-color-is-best-effort
Introducing facet: Reflection for Rust
rustreflectionfacet

I have long been at war against Rust compile times.

Part of the solution for me was to buy my way into Apple Silicon dreamland, where builds are, like… faster. I remember every time I SSH into an x86_64 server, even the nice 64-core ones.

And another part was, of course, to get dirty with Rust itself.

I wrote Why is my Rust build so slow?, which goes in-depth into rust build performance, down to rustc self-profiling even!

https://fasterthanli.me/articles/introducing-facet-reflection-for-rust
The virtue of unsynn
rust
Addressing the rumors

There have been rumors going around, in the Reddit thread for facet, my take on reflection in Rust, which happened a bit too early, but here we are, cat’s out of the bag, let’s talk about it!

Rumors that I, podcaster/youtuber fasterthanlime, want to kill serde, serialization / deserialization framework loved by many and which contributed greatly to Rust’s success, and I just wanted to address those rumors and say that…

https://fasterthanli.me/articles/the-virtue-of-unsynn
Open sourcing the home CMS
ossrustftl-infra

I’ve been bragging about my website software for years! For… whew, it’s been 5 years!

A screenshot of github commits for the beginning of my website. It has commit messages like 'learning rusqlite', 'walk stuff', 'import input files', 'parse frontmatter and stuff', and 'do stuff in parallel'.

I didn't want to make a CMS! I did it out of spite!

I’ve been teasing folks about the cool things I did from the beginning — here are all the articles and series I’ve written that mention it:

https://fasterthanli.me/articles/open-sourcing-the-home-cms
The promise of Rust
rustmemory-safety

The part that makes Rust scary is the part that makes it unique.

And it’s also what I miss in other programming languages — let me explain!

Rust syntax starts simple.

This function prints a number:

fn show(n: i64) { println!("n = {n}"); }

And this program calls that function — it looks like any C-family language so far, we got parentheses, we got curly brackets, we got, uhh…

https://fasterthanli.me/articles/the-promise-of-rust
That health is mental
mental-health

Disclaimer:

Trigger warning: depression, talk of suicide.

It’s been a while since I wrote a mental health piece — but I think it’s important to occasionally stop, take a breather, and think about how we feel.

So.

deep breath

I’m okay, I think? Just a little restless.

A bit of personal context

For those keeping score, I went through major life events in 2023 — a divorce, a move, and the news that I might need a second round of jaw surgery.

https://fasterthanli.me/articles/that-health-is-mental
More devops than I bargained for
kubernetescalicoipv6
Background

I recently had a bit of impromptu disaster recovery, and it gave me a hunger for more! More downtime! More kubernetes manifest! More DNS! Ahhhh!

The plan was really simple. I love dedicated Hetzner servers with all my heart but they are not very fungible.

You have to wait entire minutes for a new dedicated server to be provisioned. Sometimes you pay a setup fee, et cetera. And at some point to server static websites and serve as a K3S server, it’s simply just too big, and approximately twice the price that I should pay.

https://fasterthanli.me/articles/more-devops-than-i-bargained-for
Impromptu disaster recovery
kubernetesdevopsllm
Background

im-promp-tu (im-ˈpräm(p)-(ˌ)tü)

  1. made, done, or formed on or as if on the spur of the moment: improvised

  2. composed or uttered without previous preparation: extemporaneous

Merriam-Webster

On March 18th, 2025, I thought I would look into self-hosted project management solutions — something kanban-y, but.. better?

A screenshot of WeKan, the open-source Kanban. It looks.. from another age.

This one does not spark joy.

After discovering that Teamhood was awesome (and EU-based), but had a 3-seat minimum on their subscriptions, I resigned to reluctantly self-host something.

https://fasterthanli.me/articles/impromptu-disaster-recovery
The case for sans-io
ziprustasync

The most popular option to decompress ZIP files from the Rust programming language is a crate simply named zip — At the time of this writing, it has 48 million downloads. It’s fully-featured, supporting various compression methods, encryption, and even supports writing zip files.

However, that’s not the crate everyone uses to read ZIP files. Some applications benefit from using asynchronous I/O, especially if they decompress archives that they download from the network.

https://fasterthanli.me/articles/the-case-for-sans-io
Catching up with async Rust
rustasynctraits

In December 2023, a minor miracle happened: async fn in traits shipped.

As of Rust 1.39, we already had free-standing async functions:

pub async fn read_hosts() -> eyre::Result<Vec<u8>> { // etc. }

…and async functions in impl blocks:

impl HostReader { pub async fn read_hosts(&self) -> eyre::Result<Vec<u8>> { // etc. } }

But we did not have async functions in traits:

https://fasterthanli.me/articles/catching-up-with-async-rust
Highlighted code in slides
htmlcssjavascriptcolor

I have obsessed about this long enough, I think it’s only fair I (and you!) get some content out of it.

When I started writing this article, I was working on my P99 CONF slides. Those slides happen to include some bits of code. And because I’m a perfectionist, I would like this code to be syntax highlighted, like this:

let addr: SocketAddr = config.address.parse()?; let ln = TcpListener::bind(addr? config
https://fasterthanli.me/articles/highlighted-code-in-slides
ktls now under the rustls org
rustlsktlsrust
What’s a ktls

I started work on ktls and ktls-sys, a pair of crates exposing Kernel TLS offload to Rust, about two years ago.

kTLS lets the kernel (and, in turn, any network interface that supports it) take care of encryption, framing, etc., for the entire duration of a TLS connection… as soon as you have a TLS connection.

For the handshake itself (hellos, change cipher, encrypted extensions, certificate verification, etc.), you still have to use a userland TLS implementation.

https://fasterthanli.me/articles/ktls-now-under-rustls-org
State of the fasterthanlime 2024
announcementmetaftl-infra

It’s time for some personal and professional news!

TL;DR: I started a podcast with James, I’m stable on antidepressants, I’m giving a P99 CONF about my Rust/io_uring/HTTP work, I’m trying on “they/them” as pronouns, I’m open-sourcing merde_json, rubicon and others, I got a divorce in 2023, I found a new business model.

Now that we’re on the same page: let’s unpack this a bit!

https://fasterthanli.me/articles/state-of-the-fasterthanlime-2024
Face cams: the missing guide
metaproduction

I try to avoid doing “meta” / “behind the scenes” stuff, because I usually feel like it has to be “earned”. How many YouTube channels are channels about making YouTube videos? Too many.

Regardless, because I’ve had the opportunity to make my own mistakes now for a few years (I started doing the video thing in earnest in 2019), and because I’ve recently made a few leaps in quality-of-life re: shooting and editing video, I thought I’d publish a few notes, if only for reference for my future self.

https://fasterthanli.me/articles/face-cams-the-missing-guide
Just paying Figma $15/month because nothing else fucking works
rantfoss

My family wasn’t poor by any stretch of the imagination, but I was raised to avoid spending money whenever possible.

I was also taught “it’s a poor craftsman that blames their tools”, which apparently means “take responsibility for your fuckups”, but, to young-me, definitely sounded more like “you don’t deserve nice things”.

I was also taught from an early age that I was born a sinner, incapable of doing good by myself, and that all the earthly things were temptations, sent by the devil to corrupt me (further I guess?) but also temporary, and that I shouldn’t attach myself.

https://fasterthanli.me/articles/just-paying-figma-15-dollars
Cracking Electron apps open
electronrustasar

I use the draw.io desktop app to make diagrams for my website. I run it on an actual desktop, like Windows or macOS, but the asset pipeline that converts .drawio files, to .pdf, to .svg, and then to .svg again (but smaller) runs on Linux.

So I have a Rust program somewhere that opens headless chromium, and loads just the HTML/JS/CSS part of draw.io I need to render my diagrams, and then use Chromium’s “print to PDF” functionality to save a PDF.

https://fasterthanli.me/articles/cracking-electron-apps-open