pdw

Focusing on sshd is the wrong approach. The backdoor was in liblzma5. It was discovered to attack sshd, but it very likely had other targets as well. The payload hasn't been analyzed yet, but _almost everything_ links to libzma5. Firefox and Chromium do. Keepassxc does. And it might have made arbitrary changes to your system, so installing the security update might not remove the backdoor.

It's amazing that (if I understand it correctly) the entire security of the system rests on the user not being able to execute arbitrary code. One wrong-code bug in the (privileged) compiler backend and it all falls down.

Algol 60 also allowed whitespace in variable names. But they had a solution to avoid Fortran's confusion: keywords had to be specially marked. https://en.wikipedia.org/wiki/Stropping_(syntax)

I'm not familiar with Sail, but the reason for separate logical operators is that you want short-circuiting behavior. For example, in:

    (a != NULL) && a->x

You don't want to right-hand side to be evaluated if the left-hand side is false.

Here's my transcription of that book: https://2k38.be/misp/

compiler.pas can be compiled with a modern Pascal compiler, but the resulting compiler cannot compile itself. I don't know if that's caused by a transcription error, a bug in the modern compiler or a bug in the Model Implementation.

I would love it if somebody gets this working. I don't think I myself will continue with this project.

Similar: Xlib and libX11.

For reqwest, using the feature "blocking" will enable the reqwest::blocking API.

The guy knows about emulators. They don't help if the software itself is lost.

Didn't IPX always run on top of Ethernet? I thought it was pretty much a direct derivative of Xerox PARC's research network protocol.

More accurately, before Microsoft cared about the Internet.

Some APIs require the use of setenv. For example, you need to setenv("TZ", ...) if you want to use multiple timezones.

That's weirdly similar to the alchemical _Axiom of Maria_: "One becomes two, two becomes three, and out of the third comes the one as the fourth."

Though the only thing that proves is that mystics all over the world could count to three.

It was all extremely silly. Debian took a different approach: before 2005, they put all crypto packages in a separate "non-US" archive, hosted in the Netherlands. American developers weren't allowed to upload there. That way, Debian never exported crypto code from the United States, it only ever imported it.

Gandi was sold earlier this year. The new owners do not have a good reputation.

I'm more curious how they squared this with Apple Records.

Nah, email and classic Unix use entirely unrelated date formats. The RFC 822 format looks like "Thu, 31 Aug 2023 20:53:11". Unix / ctime(3) uses "Thu Aug 31 20:56:52 2023".

Almost everything that claims to implement ISO 8601 actually implements RFC 3339 instead.

It's frustrating when articles like this don't mention the version of the software tested. Because that does matter.

From the PostgreSQL 14 release notes: "Allow hash lookup for IN clauses with many constants (James Coleman, David Rowley). Previously the code always sequentially scanned the list of values."

And in PostgreSQL 15: "Allow hash lookup for NOT IN clauses with many constants (David Rowley, James Coleman). Previously the code always sequentially scanned the list of values."

Now I'm confused. Why would you want duplicate entries in your command history? I get that on an overloaded system in the 80s it might have taken a perceptable amount of time to filter out duplicates. But on a modern system you surely want it always enabled?

Apologies, it's a note, not a footnote. But notes in ISO standards aren't normative either.

This is a general principle of ISO standards, see https://share.ansi.org/Shared%20Documents/Standards%20Activi...:

> 6.5 Other informative elements

> 6.5.1 Notes and examples integrated in the text

> Notes and examples integrated in the text of a document shall only be used for giving additional information intended to assist the understanding or use of the document. They shall not contain requirements ("shall"; see 3.3.1 and Table H.1) or any information considered indispensable for the use of the document, e.g. instructions (imperative; see Table H.1), recommendations ("should"; see 3.3.2 and Table H.2) or permission ("may"; see Table H.3). Notes may be written as a statement of fact.

You're quoting from a footnote. The footnotes are not part of the normative text, so how you choose to interpret it is irrelevant.

The actual definition of undefined behavior given by § 3.4.3 is: "behavior, upon use of a nonportable or erroneous program construct or of erroneous data, for which this International Standard imposes no requirements."

Since no requirement is imposed, compilers can do as they want.

Trapping on integer overflow was completely standard before C came along. Fortran and Pascal compilers did it. (Lisp compilers transparently switched to bignums :)

This is why I hate it when people describe C as "portable assembler". The Usenet comp.lang.c FAQ was already thirty years ago warning people not to write overflow checks like this.

Integer overflow is still undefined behavior in C23.

Or the mistake is that we're running different trust domains on the same CPU core.

All the various mitigations have already been very costly (something like a performance loss of 10% on current-gen CPUs?). Getting rid of speculative execution entirely would cost far, far more.

Well, according to the article Kermit's performance problems have been fixed :)

"Although ZModem came out a few years before Kermit had its performance optimizations, by about 1993 Kermit was on par or faster than ZModem."

We don't. To be honest, I didn't realize PyPy supported Python 3. I thought it was eternally stuck on Python 2.7.

So the good: It apparently now supports Python 3.9? Might want to update your front page, it only mentions Python 3.7.

The bad: It only supports Python 3.9, we use newer features throughout our code, so it'd be painful to even try it out.

OpenBSD is not a fast system.

That could have been a mainframe, but I think factories are much more likely to be using AS/400 aka IBM i. That runs on regular IBM Power servers these days.

This is an interesting overview of mainframe vendors and how many customers they might have: https://arcanesciences.com/os2200/app1.html Most of the "dwarves" are now using emulation...