thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

sindresorhus

Pure ESM package

The package that linked you here is now pure ESM. It cannot be require()'d from CommonJS.

This means you have the following choices:

1. Use ESM yourself. (preferred)
   Use import foo from 'foo' instead of const foo = require('foo') to import the package. You also need to put "type": "module" in your package.json and more. Follow the below guide.
2. If the package is used in an async context, you could use await import(…) from CommonJS instead of require(…).
3. Stay on the existing version of the package until you can move to ESM.

nafg

val generateInstallInstructions = taskKey[Unit]("Generate install instructions in README.md")

generateInstallInstructions := {
  val info = Def.task((projectID.value, description.value, (publish / skip).value)).all(ScopeFilter(inAnyProject)).value
  val lines =
    for ((moduleId, descr, noPublish) <- info.sortBy(_._1.name) if !noPublish) yield {
      "// " + descr + "\n" +
        s"""libraryDependencies += "${moduleId.organization}" %%% "${moduleId.name}" % "${moduleId.revision}""""
    }

shakna-israel

Let's Destroy C

I have a pet project I work on, every now and then. CNoEvil.

The concept is simple enough.

What if, for a moment, we forgot all the rules we know. That we ignore every good idea, and accept all the terrible ones. That nothing is off limits. Can we turn C into a new language? Can we do what Lisp and Forth let the over-eager programmer do, but in C?

---

johnynek

/*
 * Consider a simple recursive function like:
 * f(x) = if (x > 1) f(x - 1) + x
 *        else 0
 *
 * This function isn't tail recursive (it could be, but let's set that aside for a moment).
 * How can we mechanically, which is to say without thinking about it, convert this into a stack safe recursion?
 * An approach is to model everything that happens after the recursion as a continuation, and build up that
 * continuation in a stack safe manner. Here is some example code:
 */

djspiewak

Quick Tips for Fast Code on the JVM

I was talking to a coworker recently about general techniques that almost always form the core of any effort to write very fast, down-to-the-metal hot path code on the JVM, and they pointed out that there really isn't a particularly good place to go for this information. It occurred to me that, really, I had more or less picked up all of it by word of mouth and experience, and there just aren't any good reference sources on the topic. So… here's my word of mouth.

This is by no means a comprehensive gist. It's also important to understand that the techniques that I outline in here are not 100% absolute either. Performance on the JVM is an incredibly complicated subject, and while there are rules that almost always hold true, the "almost" remains very salient. Also, for many or even most applications, there will be other techniques that I'm not mentioning which will have a greater impact. JMH, Java Flight Recorder, and a good profiler are your very best friend! Mea

pathikrit

/**
  * Quick and dirty Scala app to print git commit punch-card e.g.
  *
  *    ┃08┃09┃10┃11┃12┃13┃14┃15┃16┃17┃18┃19┃20┃21┃22┃23┃00┃01┃02┃03┃04┃05┃06┃07┃
  * Sun┃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
  * Mon┃▁▁▁▄▄▄▅▅▅▅▅▅▄▄▄▆▆▆▇▇▇▇▇▇███▆▆▆▅▅▅▄▄▄▃▃▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
  * Tue┃▁▁▁▃▃▃▆▆▆▅▅▅▅▅▅▅▅▅▆▆▆▇▇▇▆▆▆▆▆▆▅▅▅▅▅▅▄▄▄▃▃▃▂▂▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
  * Wed┃▁▁▁▄▄▄▅▅▅▇▇▇▅▅▅▅▅▅███▇▇▇▅▅▅▆▆▆▇▇▇▃▃▃▃▃▃▂▂▂▂▂▂▂▂▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
  * Thu┃▁▁▁▂▂▂▄▄▄▆▆▆▅▅▅▆▆▆▇▇▇▇▇▇▆▆▆▇▇▇▅▅▅▄▄▄▃▃▃▂▂▂▂▂▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
  * Fri┃▁▁▁▂▂▂▄▄▄▅▅▅▅▅▅▄▄▄▄▄▄▅▅▅▅▅▅▃▃▃▃▃▃▂▂▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁

MasseGuillaume

Proposed Name	Comment	Author
Escalators		[Will Sargent]
Scalars	(pronounced "scholars")	[John Page]
Scalabradoodle		[Heather Miller]
Scalabrador		[Heather Miller]
Scalobsters		[Someone]
Scally	(like Sc-ally)	[Heather Miller]

hobwekiva

sealed trait Decidable[+Proof]
final case class Yes[Proof](proof: Proof) extends Decidable[Proof]
final case object No extends Decidable[Nothing]

sealed trait List[+A] {
  def nonEmpty: Decidable[this.type <:< ::[A]]
  def ::[AA >: A](value: AA): ::[AA] = new ::[AA](value, this)
}
final case object Nil extends List[Nothing] {
  def nonEmpty: Decidable[this.type <:< ::[Nothing]] = No

paulp

// These lines go in ~/.sbt/0.13/global.sbt
watchSources ++= (
     (baseDirectory.value * "*.sbt").get
  ++ (baseDirectory.value / "project" * "*.scala").get
  ++ (baseDirectory.value / "project" * "*.sbt").get
)

addCommandAlias("rtu", "; reload ; test:update")
addCommandAlias("rtc", "; reload ; test:compile")
addCommandAlias("ru", "; reload ; update")