Programming Leftovers

posted by Roy Schestowitz on Jan 11, 2023

• The Rust Programming Language Blog: Security advisory for Cargo (CVE-2022-46176)

  The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks.

• PEP 703: Making the Python global interpreter lock optional [LWN.net]

  In late 2021, LWN covered a plan to eliminate the Python global interpreter lock (GIL), thus improving the language's thread-level concurrency. This plan has now been codified as PEP 703, which includes an extensive discussion of the changes that would be made.

• Daniel Lange: Happy tenth birthday, dear Thunar bug

  Thunar, the Xfce4 file manager, has a bug that is underflows the time remaining for a file copy since ten years now (bugzilla, gitlab). Happy birthday!