Everything we have published, newest first, from every desk.
Execution protections reach general availability, and with them a default rule that blocks the one trigger that runs fork code against your secrets.
Every writable volume in a pod has been executable by default. Two alpha gates in v1.37 let you say noexec, nosuid, nodev, and set a permission mode on emptyDir.
A load balancer was holding 100,000 hash points per server. The maths said the last 90,000 bought a 0.7% accuracy gain, and 32-bit hashes made them worse than useless.
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
Serguey Asael Shinder19 Sep2 min readEvery release process guards the code it writes. Almost none guard the code that arrives on somebody else's schedule.
Victoria Shinder19 Sep3 min readRFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through.
MilleMiglia produces realistic, privacy-preserving middle-mile instances in C++. The scarce resource in optimisation research is not algorithms - it is comparable problems.
The workaround everyone built - put the body in S3 and publish a pointer - is no longer required for messages under a megabyte.
The paste failed silently - no beep, no error, source still selected. The Register reports a fix has arrived for Excel 2016 only.
OpenID Connect gets specialised support, routing and request handling get quality-of-life changes, and the Kotlin Multiplatform client gets better defaults.
Point schema_cache_path at a .json file and Active Record stops paying the YAML cost at boot. A new herb:check task compiles every ERB template and fails the build.
Build 16 is tagged. The targeted list now includes a Simple JSON API in incubator, generational Shenandoah by default, and the deprecation of the macOS/x64 port.
Serguey Asael Shinder17 Sep3 min readThe Rust project warns of an ongoing campaign against maintainers of popular crates. The target is the publish token, not the laptop.
pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing.
A process for tracking, investigating and disclosing model behaviour, plus six cases observed over the last six months.