Programming: Linux Overflow, Golang, and Python
-
Exploiting null-dereferences in the Linux kernel (Project Zero) [LWN.net]
The Google Project Zero page shows how to compromise the kernel by using a NULL pointer to repeatedly force an oops and overflow a reference count.
-
How to Connect MongoDB with Golang
Just like the C language, the Golang language is also an open-source language that can be executed on many tools on Windows and Linux/Unix systems to create records. Like C++ and Java, we can make a connection between a MongoDB client system and Go language using any golang tool. To do this, we will be performing several very important and necessary steps in Ubuntu 22.04 by utilizing the Visual Studio code tool for a program. Before making a connection with MongoDB compass, we tend to install MongoDB and Visual Studio Code along with “go” and required extensions in the guide to help you out in the Go language.
-
Formalizing f-strings [LWN.net]
Python's formatted strings, or "f-strings", came relatively late to the language, but have become a popular feature. F-strings allow a compact representation for the common task of interpolating program data into strings, often in order to output them in some fashion. Some restrictions were placed on f-strings to simplify the implementation of them, but those restrictions are not really needed anymore and, in fact, are complicating the CPython parser. That has led to a Python Enhancement Proposal (PEP) to formalize the syntax of f-strings for the benefit of Python users while simplifying the maintenance of the interpreter itself.
-
PyTorch and the PyPI supply chain [LWN.net]
The PyTorch compromise that happened right at the end of 2022 was rather ugly, but its impact was not widespread—seemingly, at least. The incident does highlight some of the perils of relying on an external "supply chain" for the components that are used to build one's software. It also would appear to be another case of "security researchers" run amok, though perhaps that part of the story is only meant to cover the tracks—or ass—of the perpetrator.
Beyond that, the incident shows that the Python Package Index (PyPI) and the pip package installer act in ways that arguably assisted the compromise. That clearly comes as a surprise to many, though those behaviors are well-known and well-established in the Python Package Authority (PyPA) community. There is, at minimum, a need for education on that topic.