Just want to balance the harsh (but useful) criticism here by saying thanks for pushing to try and make a better, more balanced alternative.
This is a space I have a tricky application for that's currently filled poorly by YAML, escaping regex is particularly painful. I will be watching with interest.
Severities are not directly comparable. The CVSS docs leave the choice of the "vulnerable component" as an exercise for the reader. The choice of the "vulnerable component" is also not encoded in the score so a critical may be a critical in the context of a library scored against a theoretical (and bad) program or it could be scored on a single website with known mitigations.
Thanks for the link!
1) It seems some are coming down, like RedHat
2) This pattern should be expected based on the amount of "intelligent" compute, heuristic agentic algorithms, money and awareness on the issue of software vulnerabilities at the moment. Projects like Glasswing, Daybreak, Fairwind, Purple etc are in full swing and seemingly effective
For claims of up to "2x" it certainly can do, but depending on the application and hardware, just like this.
It's not clear to me from the article if the comparison is with locally compiled binaries, that would be the fair comparison.
I would expect this to be better all rounder in theory, but it would be interesting to see what the difference is from a locally compiled baseline, and therefore if the complexity, obscurity and cost is worth it (again probably application and hardware dependant question).
This looks very similar to the Doom fire algorithm (later), except that one is applied to a fixed buffer over and over again every frame.
> it is tempting to view the algorithm as based on cellular automata (Sarkar 2000), yet the lack of parallelism and the strange shape of the 'neighbourhood' of cells surrounding X makes the cellular-automata notion contrived.
If you consider rows as time then dependence is local rather than global. It looks like a 2D automata with a temporal neighbourhood component. And IMO asymmetric or nonuniform neighbourhoods dont necessarily exlude it from the definition, but affects its classification.
Does anyone with deeper academic overview of CA have any insight here? I find many things can look like CA if you stare at it right, but am never sure where to draw the line (maybe there isnt one)
I threw in an upvote, there is previous history in software for version migration. With version 2 to 3 being the migration here, surely there's a way to stuff 2 bits of info somewhere in a git dir and just patch the version 2 today to start looking for those bits.
There is a 3rd option: malicious stupidity / aka wilful ignorance.
Google is a collection of individuals, so it's very likely both sides of Hanlon's razor are true: a little malice from those in control, persisting a state of stupidity for those executing the process.
As others have pointed out, there will be resistance to improving a process that negatively impacts their bottom line. Incentives, dictate long term behaviour of organisations; whereas Hanlon's razor works better at an individual level IME.
I'm not completely sure if this is supposed to be sincere, but it should be.
It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.
Not really (I've looked pretty thoroughly), but I've been looking into large format gaming monitors like the 48" Asus OLED PG48UQ [0] which are essentially dumb TV panels.
I haven't finished researching yet but happy to discover this category of monitor is a thing now, with close enough to the latest display tech at reasonable prices. I've never owned a TV either and I keep getting stuck trying to buy one because they are all so horrible.
These are essentially huge TV panels, with basic TV features like a remote control for the OSD. I guess because it's what gamers want... A TV scale monitor for use as a TV without all the smart TV bits which ruin games. There are also a bunch of "Smart Monitors" in this category to be ware, including from LG. The work is in distinguishing the true large format dumb monitors from the smart TVs in disguise.
A lot of TVs can still be used as a dumb display if you simply ignore all their other useless "smart" functionality. If anything, "large format gaming monitors" are a response to that usage from the monitor industry wanting to get back some of those customers.
Yes, that used to be the way. But it's getting increasingly hard to ignore their smart functionality and be comfortable enough simply leaving it "unnetworked".
The problem is the incentives, even though TVs represent a higher turnover for LGE (roughly $1 B), they barely break even, whereas most of the 0.5 B from their advertising division (made through the TVs) is majority profit. They don't want you to use their TVs as monitors (they lose money that way), they are highly incentivised to find a way to track you. This is not unique to LG but they seem the worse affected while having the largest chunk of the market.
I feel a lot more comfortable with a monitor controller attached to the same OLED panel rather than trying to figure out if i've neutered LGs ad department enough, or worrying about it somehow independently gaining network in the future after monitoring everything in isolation as proven in this latest news. I think LG tvs doing something like automatic exfil via their own mesh network in future is not far fetched, it's practical with their market share and they have the incentives.
Yes, the irony is that vertically scaling will always go "faster" due to latency until you genuinely need more DB than a single box can handle. Premature horizontal scaling only increase complexity and reduce performance. And even when you genuinely need it the implementation has to fight merely to approach single box latency, which sounds like what these guys have done.
But also vertical scaling seems to be able to handle so much these days that more people probably aught to ask themselves if their application is ever likely to truly need horizontal scaling - Maybe my work is just a small pond, but I suspect we will eventually end up in a place where the vast majority of applications are happy on a single box, and only twitter scale things need to care about this stuff.
.. or maybe I lack imagination of what possible future applications might make use of such massive horizontal scaling on such capable individual boxes (seriously).
> I suspect we will eventually end up in a place where the vast majority of applications are happy on a single box, and only twitter scale things need to care about this stuff.
We're already there IMO. A single box can scale up so much more than people expect these days - over a thousand cores and terabytes of RAM. The people coming up with overcomplicated architectures and mandatory high availability get in the way of it.
A single box may have that much resources available, but no software will use them efficiently alone. You end up having issues with NUMA, with your pagetable growing significantly forcing you to deal with hugepages and eventually memory fragmentation, and who knows what other kind of lovecraftian horror coming from the sheer complexity of a single system with that much resources. Turns out scaling vertically also has cost. That's why eventually you still want to scale horizontally. And that's not overcomplicating things for the fun of it, it's just tradeoffs.
For sure, but scaling vertically to that extreme is also unnecessary for the vast majority of systems. You can still have over a hundred cores without needing NUMA. And most systems will never even need that much.
I feel like this isn't a thing when it comes to applications. All the decisions you'd make to allow an app to scale sideways are just, like, good design decisions? Even if you never went 1->2 instances. Otherwise every app would just be PostgREST on top of a beefy VM.
This is a space I have a tricky application for that's currently filled poorly by YAML, escaping regex is particularly painful. I will be watching with interest.
reply