There was one in the Phoenix Framework (Elixir) about issuing certificates with an invalid end date: https://github.com/phoenixframework/phoenix/issues/5737

Interestingly, Azure had this bug some years ago too leading to an outage. https://azure.microsoft.com/en-us/blog/summary-of-windows-az...

This article describes their efforts at streamlining their systems, which resulted in lawsuit against Accenture:

https://www.henricodolfing.com/2019/10/case-study-hertz-acce...

You can check out the following project as a reference. It incorporates many of the modern techniques others have mentioned and is well built.

https://github.com/corona-warn-app/cwa-app-android

I get to the following PDF: https://www.stackit.de/wp-content/uploads/2022/05/220601_STA...

It's linked from here: https://www.stackit.de/en/prices

Java 14 does have something similar

https://openjdk.java.net/jeps/305

No, Java requires you to redefine the variable, i.e.

  if (obj instanceof String s) {
    // s is a String here, but obj is not
  }

That I would say still counts as “similar” not “the same”

That’s the same, just that the scoped definition is implicit.

No, that's the entire point of my question. In Typescript (and Kotlin, as others have noted), the type system knows within the scope of that if statement that obj is a string, so it lets you call string-specific methods on obj withOUT introducing the new variable s.

What I'm saying is that this:

  if (typeof obj === 'string') {
    // obj is a string
  }

is really not anything meaningfully different than this

  if (obj is string as obj) { // as in C#
    // obj is a string (shadowing the outer scoped obj)
  }

or this

  if (obj instanceof String obj) {
    // obj is a String here
  }

you can imagine a pseudo TypeScript language like this

  if (typeof obj === 'string' as obj) {
    // obj is a string
  }

Actual TypeScript merely allows you to elide the "as obj" and all it needs to trigger this is the "typeof obj === <string literal>" inside of an if expression. This can be done by a simple syntactic replacement, it doesn't require control flow analysis to get this specific feature. But yes, if you have a more general computed expression, that would apply, but that was not the case you were stating. Ie the variable isn't the issue (redefining in this case seems like a distinction without a difference)... However this does work in TS, which is a demonstration of CFA:

  const isStr = typeof obj === "string";

  if (isStr) {
    // obj is str
  }

For what it's worth I think CFA is useful in TypeScript based on it at its core being a structural typed bandaid over JS, but I think these specific CFA type narrowing features are redundant in stronger typed languages.

Java cannot do the same without breaking backwards compatibility, hence the idea to introduce a variable explicitly.

but is it a deep copy??

It is not a copy. It still references the same object.

F# also has:

  let foo : obj = failwith ""

  match foo with
  | :? SomeType as blah ->
      // use blah : SomeType

(You're allowed to just use the identifier `foo` in the match arm.)

As does Scala:

  match thing {
    case a: String => 
      // use a as string
    case a @ MyCaseClass(b: String, c, d) =>
      // use a as the instance of MyCaseClass or use b as a string
  }

Native apps can register their own URI handlers to handle interprocess communication, like: org.example.myapp://auth

how would that work with something like msmtp? https://wiki.archlinux.org/title/msmtp

Here's the paper: https://arxiv.org/abs/2204.03556

Thanks for the article!

Can you explain, how an IMSI catcher works on a protocol level?

There's a wide variety of attack methods, however most usually fall into one 1 of 2 types:

1. Active interception. The IMSI catcher is actively transmitting data to the victim device and forcing it to connect, appearing to be a normal cell tower. These are the most common and can usually get a very accurate location. Because 4G and earlier don't require the tower to authenticate to the device, only the device to the tower, there really isn't any vulnerability required to do this. They use different tricks to entice the victim to connect or update its location ( e.g: falsely inflating it's signal strength, appearing to be the only tower in a location, increasing the frequency of location updates ) . Some of these techniques are mentioned in the "Warnings" section of another article describing our Radio Sentinel app: https://armadillophone.com/blog/radio-sentinel

2. Passive interception. The IMSI catcher doesn't transmit any data, or transmits very little data. It's able to gather data and location from the victim using unencrypted data sent over the control plane. These generally aren't able to extract as much data, or as accurately as active interception, but they're much harder to detect. Usually they aren't able to extract the device's IMSI for example. However, there was a recent paper describing a passive IMSI catcher that was both extremely hard to detect and great at tracking victims: https://www.usenix.org/system/files/sec22summer_kotuliak.pdf

If you'd like a more technical description about the techniques described I'd be happy to jump into that too.

It looks like they'll revert the change: https://github.com/dotnet/sdk/pull/22262

Sort of nuts that it is solely reliant on Microsoft to approve this change. Calls the whole .NET Foundation into question, imo. What good is open source if the sole steward has interests that conflict with the overall well-being of everything under the NET umbrella.

Edit: Tough this is a community contribution with no official approval yet.

In EP 47 of Darknet Diaries the author cites an interview in which they said to have an ethics board which makes such decisions based on a variety of factors. They might find a country having issues with corruption, but still would like to help them catch them so called terrorists.