ptx

25 ms·

421.
by ptx 3y ago
Tagged templates[0], the language feature that enables this, were introduced in ECMAScript 2015 apparently – arguably at least somewhat new in the lifespan of JavaScript. :) Java is getting a similar feature with template processors [1], c
422.
by ptx 3y ago
There were also changes to systemd happening around that time which would have prevented the backdoor from working. See the timeline article by the same author linked in this one.
423.
by ptx 3y ago
There was an article from 2019 [0] that someone on HN linked recently about how "web of trust is dead", but it seems to concern scalability problems with the keyserver, which resulted in DoS attacks, which made them disable the fe
424.
by ptx 3y ago
Maybe now that we have things like GitHub Actions, Bitbucket Pipelines, etc., which can run steps in separate containers, maybe most of those things could be moved from the Maven build step to a different pipeline step? I'm not sure ho
425.
by ptx 3y ago
Some important context here is that Lasse Collin posted the LKML message and the web page on Saturday the 30th, so while the topmost comment argues that he had no obligation to respond promptly, he nevertheless did respond promptly.
426.
by ptx 3y ago
What do you think of WebAssembly modules? It looks to me like the shared memory support that came with the threading proposal (which seems somewhat widely supported) should allow libraries to be isolated in their own modules and exchange da
427.
by ptx 3y ago
Part of the backdoor was in the tests. The attacker in this case could easily have sabotaged the test as well if a test was required.
428.
by ptx 3y ago
The API for the shell function is kind of neat, in that it seems to prevent you from accidentally creating shell injection vulnerabilities by calling it without properly quoting the arguments. For example, in Python you could easily do this
429.
by ptx 3y ago
Panic and/or complain loudly, I guess? You can't fix a data breach after the fact, which is why organizations need some sort of pressure to take preventative measures.
430.
by ptx 3y ago
So on the one hand libsystemd provides what both you and the manual page describe as "useful" functionality for implementing this feature, but on the other you're implying that Debian shouldn't have used it to do what it
431.
by ptx 3y ago
It is confusing, but it's also kind of the standard pattern for decorators in Python, so it's a useful example. The decorator syntax itself is just simple syntax sugar for replacing the decorated function (add) with the return val
432.
by ptx 3y ago
The impression I got from the article is that it's a gimmick to bring attention to the law that forces married couples to adopt the same surname and get that changed.
433.
Swivel: Hardening WebAssembly Against Spectre(usenix.org)
3 points by ptx 3y ago|0 comments
434.
by ptx 3y ago
The general approach seems to work anyway. I tried it out with ChatGPT 3.5 and an online Cobol compiler[0], manually feeding back the output, and it managed to produce a working program on the 10th attempt (that displays the first 10 Fibona
435.
by ptx 3y ago
I think they added it in parts over the course of a year or two, with each part being plausibly innocent-looking: First some testing infrastructure, some test cases with binary test data to test compression, updates to the build scripts – a
436.
by ptx 3y ago
Python for Windows bundles liblzma from this project, but it appears to be version 5.2.5 [0] vendored into the Python project's repo on 2022-04-18 [1], so that should be fine, right? [0] https://github.com/python/c
437.
by ptx 3y ago
> Type inference is bad. It makes code harder to read, and languages that use it too much are harder to write. If inference is bad, maybe the second sentence shouldn't leave it up to the reader to infer what "it" means.
438.
Landlock: Unprivileged Access Control(docs.kernel.org)
59 points by ptx 3y ago|12 comments
439.
by ptx 3y ago
The latest commit is interesting (f9cf4c05edd14, "Fix sabotaged Landlock sandbox check"). It looks like one of Jia Tan's commits (328c52da8a2) added a stray "." character to a piece of C code that was part of a chec
440.
by ptx 3y ago
They say that one limitation on Wayland is that "AWT expects to be able to query and set the positions of all its own windows", but since AWT does an extremely poor job of this on X11, I hope this Wayland limitation will prevent t
441.
by ptx 3y ago
Was this article hallucinated by ChatGPT? Many of the features described look odd and it doesn't cite sources for them. For example, the "stream gatherer in action" example seems to just be using collectors, which is an older
442.
by ptx 3y ago
It looks like the FFI (Project Panama) finally landed in Java 22, released a few days ago: https://openjdk.org/jeps/454 Unless that feature also has some weird limitation, you could probably use that to call the socke
443.
by ptx 3y ago
Lots of things are crimes even though they're just offering something to a victim who willingly accepts it, e.g. phishing attacks, fraudulent investment schemes, contaminated food products.
444.
by ptx 3y ago
Couldn't the autoconf soup be generated from simpler inputs by the CI/CD system to avoid this kind of problem? Incomprehensible soup as a build artifact (e.g. executables) is perfectly normal, but it seems to me that such things d
445.
by ptx 3y ago
The use of "eval" stands out, or at least it should stand out – but there are two more instances of it in the same script, which presumably are not used maliciously. A while back there was a discussion[0] of an arbitrary code ex
446.
by ptx 3y ago
The memory management approach is basically the same as in Rust, according to the docs[0]. Merging Rust and Python into a single language sounds like a very challenging project, with "eventually" being far into the future at best.
447.
by ptx 3y ago
Perhaps, but as a counterexample, the SerenityOS people implemented the Delphi approach with Visual Builder but then realized that they preferred working with text, so they replaced it with a declarative DSL and live preview (GML Playground
448.
by ptx 3y ago
Yup, this is what WHATWG's Streams spec[0] (linked in the article) says. It defines backpressure as a "process of normalizing flow from the original source according to how fast the chain can process chunks" where the reader
449.
Streams Standard(streams.spec.whatwg.org)
2 points by ptx 3y ago|0 comments
450.
by ptx 3y ago
> The eventual removal part doesn't tend to happen. It's happening in Python 3.13: https://peps.python.org/pep-0594/

More ›