Cloudflare cut origin handshake retries from 52% to 3.7% by probing
TLS 1.3 makes the client guess a key agreement algorithm in the first packet. Cloudflare replaced the guess with a per-origin measurement.
Serguey Asael Shinder
Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
Signed pieces
Researcher publishes the factors of RSA-896
Two 448-bit primes, published on a one-page post dated 19 September. The multiplication verifies in a second; the method is not described at all.
Axboe proposes thread-identity swapping for io_uring
The blocking-handoff tax is paid on every operation that might block, even when it doesn't. The RFC pays it only when blocking actually happens.
Open-weight models with refusals stripped score 84.5% on CyberGym
An open-weight model with its refusals stripped out, running on hardware a person can buy, scoring 84.5% on CyberGym — and the bottleneck is deployment, not detection.
New benchmark compares ZFS, Btrfs and bcachefs under failures
ext4, XFS, ZFS, Btrfs and bcachefs across single and multi-device layouts, run continuously in CI — and the caveats are stated as loudly as the numbers.
A Rust developer rebuilds his JSONPath library in Zig
Seven years of Rust, one reimplementation of RFC 9535, and the thing that changed his workflow was the missing IDE rather than the borrow checker.
GitHub disables pull_request_target for public repos on 2 November
Execution protections reach general availability, and with them a default rule that blocks the one trigger that runs fork code against your secrets.
Cloudflare cuts 100TB of RAM from its load balancers
A load balancer was holding 100,000 hash points per server. The maths said the last 90,000 bought a 0.7% accuracy gain, and 32-bit hashes made them worse than useless.
Allowlists enforce the day they were written
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
Amazon SNS raises the message payload limit to 1 MiB
The workaround everyone built - put the body in S3 and publish a pointer - is no longer required for messages under a megabyte.