Their rewrites of all security critical libraries while also refusing to use AI which at the moment is surfacing huge vulnerabilities all over the place.
The Alice Huang relationship has been known about for a longer time, seemingly even by his family.
It more feels like someone wanted him gone. The second affair had to be leaked because after the first one it still appeared he still had a good chance of remaining CEO
P cores will eventually move to the same uArch as E cores so they'll get even more similar, I expect it'll be similar to amd's, as you're either pushing frequency at the cost of power, or going for general efficiency which you must do to even consider stuffing so many cores into a cpu
And in itself doesn't make much sense, the most likely illegal scenario, if there is one, is just pushing more gpus into China and lobbying for it which Nvidia wanted already because money
I very much think nobody can be bothered, not just the people in charge. We're all the same people and if there was an actual want by the regular person, the ones in charge in most of the world would be influenced enough to either want it too or have to do something
I, along with many other people, have fitted solar panels on my roof, installed a battery in my loft and replaced my gas boiler with a heat pump. Lots of people are bothered.
No: in Scotland I got a subsidy for the heat pump install capital cost, and I'm on the old feed in tariff scheme that pays me for every unit of energy produced. Including, oddly, energy I consume myself.
It's not so advantageous for new installs because the point of awkwardness in the UK has switched to storage. It's currently possible for some battery owners to make money from arbitrage because the grid hasn't bought enough batteries and north/south links yet.
Not the person your replied to, but I'm in the same position.
No? Unless you consider an HOA the government. Why would the make this hard? I now quite a few that will subsidize it. Fill in some paperwork, submit it along with the invoice and wait a few weeks/months for some free money back.
That it's not sensible to suggest that because something isn't happening that automatically means the majority of people don't want it, even in healthy democracy.
Romantic model of people being heard. 500M speaks more than a single vote. Its a shame. This already disproves your model - however, we should move towards it!
Zig's reimplementation of all of the standard libraries even though it's possible to use the existing ones is both baffling to me and kills usage of the implementation in my eyes.
Redoing critical parts such as crypto and compression is crazy in this day and age, hell they even have issues and merge requests open for issues that'd be headliners if found in any major language
Not just that, but on Windows, they're bypassing the actually guaranteed stable Win32 API in favor of linking directly to the lower-level components. Completely destroying any forward compatibility!
It's the kind of change that makes me read Zig as not trying to be a serious language. Not that there's anything wrong with that, but the way Zig positions itself is at odds with the completely bizarre takes they do.
If you spend some time working on cross platform code you will quickly realize that that choice is actually the right one. The NT API is actually very close in abstraction to Unix and allows for much less ad hoc code to handle windows specifics than using Win32 API (which is an abomination).
The zig windows NT implementations are very well done and I actually use them as reference when dealing with windows IO.
But the trust as a service (TaaS) platform could decide tomorrow that you are not trustworthy because, I don't know, it matched a pattern in a piece of ransomware which is actually a pattern you can produce by allocating 3 pages of memory in one call. Should you as a language now put compile time guarantees that 3 pages cannot be allocated?
This is obviously a ridiculous example, but what I'm aiming to say is, if a piece of software is matching something as untrustworthy when it's not, you shouldn't chase it down to force the little guy who's maxing good will software to fix it because the big bully thinks they are evil and deserve to get quarantined
Sure. But the heuristic the TaaS world is using isn't something as absurd as "allocates 3 pages", it's "uses undocumented system APIs". We're also not arguing in the abstract that "they might make a stupid determination in the future", they're making this determination now.
I'm not a fan of the the security industry's practices, but I can't say they're making a malicious/stupid choice here.
Yeah, I get that, I'm just unconvinced that using lower level, less documented APIs, which are not necessarily meant to be the way users interact with the system, is a good heuristic for malware detection.
I'm ignoring the fact that very few people in the world need an antivirus (other than maybe elderly/less technologically knowledgeable people, but even then I'm not sure they can be fully protected)
The idea/hope is perhaps that the Zig programs will be of better quality than other programs, which will make it hard for the other side (the antivirus) to justify its position in a reasonable way. And in the end the other side will be forced to change its processes.
It's a shame really that Microsoft wont officially bless ntdll because it's a much more sensible API generally speaking.
Like why the hell did they throw away the return value and make everyone do the insane BOOL ret = Win32Function(); if(!ret) { DWORD err=GetLastError(); } dance?
Not every function returnds a boolean. It is probably easier to write HANDLE file = CreateFile(...) than to send in a pointer to HANDLE. Also, this is exactly the same as what libc does with syscalls on Linux etc.
The update was withheld because releasing it without notifying major providers and distros would turn it into the same race, with ai having a release is the same thing as a disclosure.
This would've worked if other people were able to shut up about it. Because its existence got leaked they posted the announcement
There is no functional difference between doing just an announcement and doing an announcement with a series of builds containing the patch while withholding the source code. You do understand that right?
A message as vague as "there is a major RCE somewhere in this entire programming language" is usually pretty safe. We'll see how the details actually got out in this situation and whether the announcement caused it, but it still took a while. If you put out a patched build people will find and decompile the changes nearly instantly.
One security provider put "session.upload_progress.enabled, session.use_strict_mode" in the SEO keywords for their initial announcement, which was probably a good enough clue to feed to an LLM. https://web.archive.org/web/20261021005246/https://sansec.io... (go to page source, search for session.upload_progress). At least one person on Twitter saw this: https://x.com/its5q/status/2112700519261032497 Of course there's enough people who knew about this that the exploit vector may have leaked out to the general public through a different source as well.
Yep. It's probably one of a handful of functions. It'll be based on request input, a script doesn't have to call the function, and it works with default configuration. I bet it takes a half hour for AI to figure it out.
Php4 -> 5 was a massive change including zendengine2 and an overhaul of many modules. Fortunately that information really doesn't tell us much. (Also it was a year of work between the first beta and the release - many changes at that time)
I mean an agent can walk those changes, but it's close to just walking all the whole source / research from scratch at that point.
A patched build is strictly more information, and you'd only need to cross correlate between the two.
At this point shipping the build already may have been the best option but not necessarily everyone is actually able to ship yet. And this is of course assuming the actual vulnerability is the same one as the PoCs that are being tried, and not something even nastier instead
Yep, I have a decently powerful home server that's always on, but still run a cheap VPS for directly public services like my sites.
I don't think it's particularly likely that the home server would get hacked if updates were to br kept up with, but why risk it for that little money?
The AI would probably jump on DoH, what they need is proper decrypted inspection which I'm not particularly convinced they do with the stories that keep coming out
Going to higher densities with DUV needs high multi patterning which is very inefficient and ends up costing more than if they could do EUV with fewer patterns.
It's well known tech that is used globally, just not to that degree as yield and throughput goes way down
And of course it needs to get to stable first
reply