Yeroc

Yes, but sandboxing and fuzzing are insufficient. As pointed out in the article Google had been fuzzing this library and it didn't find the issue. They even tweaked the fuzzing after this issue was found to specifically target the area of the vulnerability and it apparently still didn't trigger the issue.

Google Chrome also implements sandboxing and many areas. It's not feasible everywhere. So for new code / libraries we should default to a memory-safe language.

May help? Studies have shown that ~70% [1] of all security issues (including this one) are memory safety issues.

[1] https://security.googleblog.com/2021/02/mitigating-memory-sa...

Yes and Google Chrome has invested heavily in sandboxing and still had to ship this as a high-priority fix. I'd say sandboxing in conjunction with memory-safe languages is the future.

I'm surprised the summary of the article only talked about over-reliance on fuzzing and then suggested 1) more thorough code reviews and 2) sandboxing as solutions?! To me, the solution lies in using memory-safe languages.

FYI, even in the most recent Java (21) LTS release this is flagged as an "early access" feature so you're unlikely to see production applications using it yet.

Check out Peter Lawrey's blog [1] has lots of excellent content coming from high performance trading background. Also some older (probably dated) content on Martin Thompson's Mechanical Sympathy [2] blog.

[1] http://blog.vanillajava.blog/

[2] https://mechanical-sympathy.blogspot.com/

I hear you. My compromise has been to use a cheap ChromeBook with touchscreen that flips around. I use the (somewhat clunky) Android MobileSheets app which supports syncing across various cloud storage so that part works quite nice.

But probably doesn't quite fall into the "lightweight" category...

Relevant quote from the article:

"The lack of real-world examples available - this obviously isn’t a limitation of the model itself but rather due to the fact that companies don’t want to advertise their architecture in detail in public."

Perhaps long-tenured folk that are now incentivized differently from how they were previously?

Yes, it's not about being able to pay the salaries of engineers. It's about being able to pay dividends to shareholders too!

That, and if you need to run some COTS (commercial off-the-shelf) software package chances are the vendor will only support it on RHEL (or CentOS). However, many of these vendors also support Ubuntu LTS or Suse Enterprise now so there are (usually) a couple of Linux-based alternatives.

Most likely yes. Can't speak for other organizations but the one I work for licenses RHEL on our critical servers and uses CentOS/Alma on all non-critical infrastructure. Obviously the reason that is done is because it's easy to support what's essentially a single OS. With this new change, if Alma/Rocky go away we'll be looking at either Suse or Ubuntu most likely and RHEL will go away completely to be replaced with the licensed equivalents of Suse or Ubuntu so that we only need to support a single OS.

There were similar discussions when the CentOS Stream thing was announced and Red Hat didn't change course so I'd guess they're not going to back off this change either.

I suppose Eclipse Che <https://www.eclipse.org/che/> would also count?

Well it seems like the President and CEO of the company was onboard the craft so I suppose the answer is "yes".

Sky News <https://news.sky.com/story/uk-billionaire-hamish-harding-on-...> identifies several of the passengers including:

- Hamish Harding

- Paul-Henry Nargeolet

- Stockton Rush (the President and CEO of OceanGate itself)

Is there any plan to introduce some simplifications to the processes using things like a bread machine to handle automating the rise and kneading of the bread doughs?

I second the Music Matters recommendation. The way he explains things and walks through the creation of various harmonies I find very illuminating.

All good points but while this saves you from the docker images disappearing it does nothing to solve the issue of those images no longer receiving important security updates and bug fixes going forward.

You'll only need the expertise to perform in-depth optimization if you're scaling to the level of Stack Overflow though. For the vast majority of sites it won't be a concern. The simpler architecture should be the default because local method calls are easily 2 orders of magnitude faster than a network roundtrip (yes I know that's not the whole story). I'm not sure how or why creating clear boundaries without the RPC crutch suddenly became insurmountable.

It's worth reminding people what is actually possible with a relatively simple architecture. There's a vast number of websites and services with a very small fraction of the traffic of Stack Overflow with a much more complicated architecture simply because everyone thinks you need Kubernetes etc to scale out.

Unless you live in Iran of course.

Indeed repairability may have been the biggest change. Major appliances centralize virtually all functions including on one or two main circuit boards including the high-voltage relays which in my experience are very prone to failure (they used to be mounted separately in a different location on older appliances). Those circuit boards typically cost ~1/3 the cost of a new appliance assuming you source and swap it yourself.

In conjunction with the decline of repairability in the appliances I think there's a corresponding decline in repair skills among the general population as well.

Even on Quay the centos7 tag hasn't been updated in 2 years so it's clearly not getting any of the package updates. Yay, security!

Not to worry. There's nothing inherent in the platform that encourages to be more civil and friendly other than established cultural norms that will soon be trampled by the influx of new users if things continue on the current trajectory.

The article notes that Finch is simply curating and/or wrapping Lima etc...

This sounds like much-ado about nothing. We probably need to be far more concerned about "Docker Official Image"s that have been deprecated and are no longer receiving updates such as the "official" /_centos images (including centos7 which in theory isn't EOL but RedHat apparently doesn't care).

I was hoping someone would mention "Learning How To Learn" as I was immediately reminded of this as well. The process described in this article aligns completely with portions of Barbara's research and teaching.

Bizarre. Most VPNs used in a workplace would take care of name-based host resolution (ie DNS) for you. This is not a new thing unique to Tailscale.

I would think the ambient outdoor temperature would have a rather large impact here. If it's cold outside the car has to use battery power to keep the batteries themselves within operating range.