BonusPlay

Only if you accept using random 2 star github repo (that may come with free supply chain attack) instead of the maintainer supplied one with 60k.

From my perspective zig doesn't have "big cleanup" upfront. It's removing older features as it goes.

stdlib changes as it wants from version to version. So do language features. Since zig is pre-1.0, zig foundation isn't scared of breaking changes.

Instead of debating for years (like other languages), zig just tries things out. Worst case you can always rollback changes.

IMO best APIs and designs are those that are battle tested by end users, not won in an argument war during committee meetings.

This makes zig unique. It's fun to use and it stays fresh.

You can always just stay on older version of zig. But if you choose to update to newer version, you get new tools to make your code tidier/faster.

Except that many component manufacturers release their efi capsules signed with Microsoft PKI. So no, you can't fully remove them if you want to verify updates.

Not the best name for the article. My first guess was version changes, or software being added/removed from repo. Turns out this is about source code modification.

A problem I encountered while writing custom stdlib, is that certain language features expect stdlib to be there.

For example, <=> operator assumes, that std::partial_ordering exists. Kinda lame. In the newer C++ standards, more and more features are unusable without stdlib (or at least std namespace).

Honestly I don't get why people are hating this response so much.

Life is complex and vulnerabilities happen. They quickly contacted the reporter (instead of sending email to spam) and deployed a fix.

> we've fundamentally restructured our security practices to ensure this scenario can't recur

People in this thread seem furious about this one and I don't really know why. Other than needing to unpack some "enterprise" language, I view this as "we fixed some shit and got tests to notify us if it happens again".

To everyone saying "how can you be sure that it will NEVER happen", maybe because they removed all full-privileged admin tokens and are only using scoped tokens? This is a small misdirection, they aren't saying "vulnerabilities won't happen", but "exactly this one" won't.

So Dave, good job to your team for handling the issue decently. Quick patches and public disclosure are also more than welcome. One tip I'd learn from this is to use less "enterprise" language in security topics (or people will eat you in the comments).

Seems like you assumed none of your tools got backdoored. I'd start bootstrapping from busybox.

Linux Local Privilege Escalation, but the attacker has to be in sudo group in the first place.

Great read, but this feels like academic research. Technically correct, but impractical at best.

> Proxmox uses ZFS making snapshotting quick

Proxmox only supports linear snapshots using ZFS (so no tree-like snapshots). This might be a deal-breaker for some usages.