SShortSingh.
Back to feed

Developer Finds 140 Hidden Bugs After Porting Python String Library to Rust

0
·1 views

A developer porting the Python string-similarity library textdistance to Rust discovered that the initial code compiled and appeared correct but contained 140 behavioral divergences from the original. To verify equivalence across more than 30 algorithms, the developer used differential fuzzing, running both the Python and Rust implementations against identical inputs and comparing outputs. Many discrepancies stemmed from subtle implementation details, including a threshold condition in the Jaro-Winkler algorithm dating back to William Winkler's 1990 paper that is routinely omitted in popular descriptions of the formula. Additional bugs arose from floating-point precision drift at the 15th decimal place, which standard unit tests were not sensitive enough to catch. The project, now published as textdistance-rs, highlights how passing an existing test suite is not sufficient proof of a correct port without deeper equivalence testing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Transformers 5.15.0 and Meta Muse Glimmer Lead Latest AI Releases

A review of eleven recent AI and agent updates found only two meeting a strict 36-hour recency threshold. Meta Muse Glimmer is a roughly 30-billion-parameter multimodal model released under Apache 2.0, designed for agentic workloads with 4-bit weights reportedly under 20 GB. Hugging Face's Transformers 5.15.0 adds support for Muse Glimmer, FSDP plans across 94 causal-LM classes, batched Omni audio generation, and Tekken tokenizer support. The update also introduces notable breaking changes, including opt-in kernels for linear-attention families and revised cache-cropping behavior using negative offsets. Six additional tools — including SGLang 0.5.17, Anthropic Python SDK 0.121.0, and Pydantic AI 2.27.0 — are flagged for a broader 72-hour watchlist pending further verification.

0
ProgrammingDEV Community ·

Engineering Team Shrinks 190 GB Production Database to 45 GB Before Cloud Migration

A software team reduced a production database from 190 GB to 45 GB in a single overnight maintenance window ahead of a cost-sensitive cloud migration. Initial measurements revealed that only 106.7 GB of the 190.6 GB allocated was actually in use, meaning 84 GB was simply unreclaimed empty space from past growth spikes. The team found that the largest storage offenders were not high-row-count tables but blob-heavy tables with relatively few rows, including one configuration table consuming 13 GB across just 21,000 rows. To prevent the transaction log from overwhelming available disk space during bulk deletions, the database was temporarily switched from full to simple recovery mode, keeping log size stable at 6.5 GB throughout the three-hour operation. The team documented six key lessons, emphasizing the importance of measuring allocated versus used space and ranking tables by size in megabytes rather than row count before planning any cleanup.

0
ProgrammingDEV Community ·

How to Secure Your Software Supply Chain With SBOMs, Signing, and SLSA

Most production code consists of third-party dependencies that are trusted by default, making the software supply chain a prime attack vector, as seen in incidents like SolarWinds and the xz backdoor. A Software Bill of Materials (SBOM) provides a machine-readable inventory of every component in a software artifact, enabling faster vulnerability assessment when new CVEs emerge. Code signing and provenance verification — facilitated by tools like Sigstore — help confirm that artifacts are genuine and unmodified throughout the build process. The SLSA framework offers a tiered maturity model for hardening build pipelines, while least-privilege CI practices and dependency hygiene further reduce exposure. Shifting security checks as early as possible in the pipeline — ideally at pull-request stage — significantly reduces the cost and impact of discovering vulnerabilities later in production.

Developer Finds 140 Hidden Bugs After Porting Python String Library to Rust · ShortSingh