Top all-time · #695
Sylvain Kerkour
Personal blog · kerkour.com · on HN as sylvain_kerkoursecurityprogramming
Sylvain Kerkour's personal blog at kerkour.com covers security and programming. Since 2018, 92 different Hacker News readers have linked it 389 times, most often “Optimizing SQLite for Servers”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Sometimes recommended · 7 of 39 sampled comments recommend it?
Why HN links it
HN readers link Kerkour's posts on SQLite for servers, Rust supply chains and embedded Rust. The SQLite-for-servers post is the one most often cited.
- Recommended for · 7 comments
- Called a good read on SQLite for servers and a good embedded Rust intro, plus a great SIMD resource and advice to stick to.
Summarised by Claude from a sample of 39 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
(Ab)using technology for fun & profit.
Most-linked posts?
- Optimizing SQLite for Servers12 people · 14 mentions · first linked 2024-02-15
- Rust needs an extended standard library6 people · 6 mentions · first linked 2024-10-02
- Denial of Wallet Attacks: The new (D)DoS4 people · 5 mentions · first linked 2022-08-03
- Introduction to embedded development with Rust: Overview of the ecosystem4 people · 5 mentions · first linked 2025-06-11
- Bugs that the Rust compiler catches for you4 people · 5 mentions · first linked 2022-05-04
- How can Rust be so fast in the TechEmpower Web Framework Benchmarks?4 people · 4 mentions · first linked 2024-02-20
- Using Rust and Postgres for everything: patterns learned over the years3 people · 4 mentions · first linked 2026-03-05
- Backdooring Rust crates for fun and profit (2021)3 people · 4 mentions · first linked 2022-09-07
- Engineer vs. Entrepreneur Mindset3 people · 4 mentions · first linked 2022-03-08
- Choosing a hash function for 2030 and beyond: SHA-2 vs. SHA-3 vs. BLAKE33 people · 4 mentions · first linked 2024-12-18
What Hacker News says?
> Rust is literally the best positioned language to handle the upcoming onslaught of CVEs. Rust is also a language with no real stdlib, and so you have to import crates for everything including the kitchen sink. Which opens you up to the very real risk of supply chain vulnerabilities unless you make an active effort to code review your imports and keep the length of your import list under control.[1][2][3] Rust supp…
Comment linking /rust-supply-chain-nightmare
on “Security advisory: Critical remote code execution vulnerabilities, update now”Submitted Backdooring Rust crates for fun and profit as a story · 362 points
HN discussion> countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx ) Don't make me tap the sign: https://news.ycombinator.com/item?id=41727085#41727410 > Centralized package managers only add a layer of obfuscation that attackers can use to their advantage. They add a layer of convenience. C/C++ are missing that convenience because they aren't as composable and have a long tail of pre-pa…
Comment linking /rust-stdx
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted Distributed SQLite: Paradigm shift or hype? as a story · 252 points
HN discussionIndeed, Rust's supply chains story is an absolute horror, and there are countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx ) TL;DR: ditch crates.io and copy Go with decentralized packages based directly on and an extended standard library. Centralized package managers only add a layer of obfuscation that attackers can use to their advantage. On the other hand, C / C++ style…
Comment linking /rust-stdx
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted Bugs that the Rust compiler catches for you as a story · 243 points
HN discussionCan you give an example of this toxic bashing from rust contributors or are you talking about just random HN posters when you say “rust community”? Moreover, I wouldn’t say they’re completely ignoring supply chain risks, as there have been discussions about this as early as 2021 [1] and there are ongoing efforts to address this [2] [1] https://internals.rust-lang.org/t/about-supply-chain-attacks... [2] https://kerko…
Comment linking /fixing-rust-supply-chain-security
on “11 year old unsoundness bugs found in Rust borrow checker”Submitted Comparing AWS S3 with Cloudflare R2: Price, Performance and User Experience as a story · 226 points
HN discussionHi HN, creator here! Today is a good day, the achievement of months of works (but also the start of a great adventure ). I'm very excited to announce Bloom: A free and Open source ‘Google’. Our mission ? Empowering the world with open technologies. Why? How? What? https://kerkour.com/blog/bloom-a-free-and-open-source-google Website: https://bloom.sh Android App: https://play.google.com/store/apps/details?id=com.bloo…
Comment linking /blog/bloom-a-free-and-open-source-google
on “Show HN: Bloom – A free and open source 'Google'”Submitted Overthinking (2021) as a story · 195 points
HN discussion> SQLite is best suited for embedded / clientside applications with minimal dependencies. Often repeated and certainly rooted in truth but there was a healthy discussion on here the other day[0] where tptacek shared a link in a comment[1] to a related blog post about getting more scale out of using SQLite serverside. 0: https://news.ycombinator.com/item?id=39975596 1: https://kerkour.com/sqlite-for-servers
Comment linking /sqlite-for-servers
on “Redis re-implemented with SQLite”Submitted Overthinking as a story · 195 points
HN discussionTechnically SQLite can only have 1 writer at any given moment, but it can appear like it works across multiple writers and let it serialize the calls for you. By default SQLite will not do what you want out of the box. You have to turn on some feature flags(PRAGMA) to get it to behave for you. You need WAL mode, etc read: * https://kerkour.com/sqlite-for-servers * https://zeroclarkthirty.com/2024-10-19-sqlite-databa…
Comment linking /sqlite-for-servers
on “SQLite concurrency and why you should care about it”Submitted Entropy Is Fatal as a story · 183 points
HN discussionExplanation of sqlite performance PRAGMAs https://kerkour.com/sqlite-for-servers
Comment linking /sqlite-for-servers
on “SQLite concurrency and why you should care about it”Submitted Async Rust: What is a runtime? how Tokio works under the hood as a story · 178 points
HN discussionFirm disagree. Sylvain Kerkour described the problems Rust faces by having a limited standard library: "The time has come for Rust to graduate from a shadow employment program in Big Tech companies to a programming language empowering the masses of engineers (and not just "programmers") wanting to build efficient and robust sfotware. What crypto library should we use? ring, RustCrypto, rust-crypto (don't use it!), b…
Comment linking /rust-stdx
on “Lies we tell ourselves to keep using Golang (2022)”Submitted The biggest threat to Rust's sustainability as a story · 171 points
HN discussionEDIT: Paste this hacky snippet into your browser's console to save all of the links into your clipboard: (() => { let result = [...document.querySelectorAll('td a')] .map((link) => link && !link.href.includes('ycombinator') && !link.href.includes('javascript:void') ? link.href : '' ) .filter(Boolean); result = [...new Set(result)]; result.sort(); copy(result.join('\n\n')); })(); Just to help, here's a compiled-list…
Comment linking /
on “Ask HN: Great Blogs by Programmers”Submitted The unusual way I'm funding my open source work as a story · 112 points
HN discussionShameless plug: https://kerkour.com Rust, Go, Security & Cryptography :)
Comment linking /
on “Ask HN: Great Blogs by Programmers”Submitted Building a web application with Rust and WebAssembly as a story · 102 points
HN discussionSome tweaks that I keep for my personal toy webservices: PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 5000; PRAGMA synchronous = NORMAL; PRAGMA cache_size = 1000000000; PRAGMA foreign_keys = true; PRAGMA temp_store = memory; And use BEGIN IMMEDIATE transactions. https://kerkour.com/sqlite-for-servers
Comment linking /sqlite-for-servers
on “SQLite on Rails: The how and why of optimal performance”Submitted Rust for web development: 2 years later as a story · 73 points
HN discussionThis is kind of missing the point. I can only speak for the company that sponsors LiteFS (I don't think any edge computing companies put 'otoolep up to doing rqlite, for instance). We love Postgres. Most of our users use Postgres. And Postgres works fine in edge/backhaul configurations; companies were doing geographically distributed Postgres read replicas long, long before we came around. That's where we got the id…
Comment linking /sqlite-for-servers
on “Distributed SQLite: Paradigm shift or hype?”Submitted WebAssembly: A promising technology that is quietly being enshitified as a story · 70 points
HN discussionIf you read the article you would know that this is just about changing defaults. You already could achieve this by editing your project's Cargo.toml. As is documented and discussed in several places over the years (google "shrink rust binary size"). The `strip` was added to rust nightly in 2020. 1: https://github.com/johnthagen/min-sized-rust 2: https://kerkour.com/optimize-rust-binary-size 3: https://rustrepo.com/…
Comment linking /optimize-rust-binary-size
on “Making Rust binaries smaller by default”Submitted Learn Rust by implementing a SHA-1 hash cracker as a story · 68 points
HN discussionThere is a good chance this is the article the author mentioned reading: https://kerkour.com/sqlite-for-servers
Comment linking /sqlite-for-servers
on “Searchcode.com’s SQLite database is probably 6 terabytes bigger than yours”Submitted Optimizing SQLite for Servers as a story · 65 points
HN discussion
