news
Free, Libre, and Open Source Software; Standards Discussed
-
OpenSSH ☛ openssh.org/txt/release-10.5
Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes.
We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher. This suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too. Given this, the OpenSSH team will, for now, be making more frequent releases to get bugfixes into users' hands more quickly rather than batching them until the next planned release.
-
Andrew Nesbitt ☛ The Software Stewardship Lab
The organisations set up to address open source sustainability have the same funding problem as the maintainers they are trying to help, often a worse version of it because a maintainer at least produces software that people want to use, and almost everyone I know doing this kind of research is patching together an income the same way I am. Grant programmes fund a project for a fixed term and then stop, which is also roughly how the academic contracts work for researchers studying maintainer burnout, while the tools built to measure the ecosystem need servers and bandwidth that someone has to keep paying for year after year regardless.
-
SaaS/Back End/Databases
-
Extending immutability: deletion without losing data
Tigris has a pretty advanced replication scheme for writes. What happens when you actually need to delete things? Turns out deleting things is hard in distributed systems. Especially when you have a geo-replicated active-active database like Tigris does. We can (and do) use tombstones to mark where data once was, but how do you let people undo an accidental delete?
-
-
Content Management Systems (CMS) / Static Site Generators (SSG)
-
Christian Cleberg ☛ I Built My Own Org-Mode Static Site Generator - cleberg.net
I was tired of bolting solutions onto my SSGs, so I built my own.
-
-
Standards/Consortia
-
Chuck Carroll ☛ Converting FLACs to Opus
I have music collection of over 12,000 tracks. I prefer to actually own my music (ie digital files) and being able to play it on any device I choose rather than using a service like Spotify. That said, I also prefer using OGG over MP3, and the majority of my music collection is (currently) in OGG Vorbis format. Over the years, I've been accumulating lossless albums from places like Bandcamp and transcoding them.
-
University of Toronto ☛ URLs aren't strings, and my recent encounter with this
Suppose that you have a URL in the form of a UTF-8 or Unicode text string and you want to show it to people in a web context, and some parts of the URL have characters (or Unicode codepoints) that fall outside of the straightforward 'US-ASCII' character range. If you're putting the URL (string) into HTML, you can often get away with not doing anything special (beyond using UTF-8); your HTML is probably UTF-8 and browsers will do all of the hard work for you. But if you're putting your URL in other places, you may have to encode and quote it. One of those places you need to encode it is in HTTP Location response headers, which you may generate if you're redirecting a URL to some canonical version of it (for example, one without random 'utm' query parameters).
-