Security
Passing a hash test suite says nothing about chosen-input collisions
A study of the popular fast hashes shows attacker-selected inputs can collide far above the average rate, without the attacker ever learning the seed.
Axboe proposes thread-identity swapping for io_uring
The blocking-handoff tax is paid on every operation that might block, even when it doesn't. The RFC pays it only when blocking actually happens.
Open-weight models with refusals stripped score 84.5% on CyberGym
An open-weight model with its refusals stripped out, running on hardware a person can buy, scoring 84.5% on CyberGym — and the bottleneck is deployment, not detection.
New benchmark compares ZFS, Btrfs and bcachefs under failures
ext4, XFS, ZFS, Btrfs and bcachefs across single and multi-device layouts, run continuously in CI — and the caveats are stated as loudly as the numbers.
A Rust developer rebuilds his JSONPath library in Zig
Seven years of Rust, one reimplementation of RFC 9535, and the thing that changed his workflow was the missing IDE rather than the borrow checker.
GitHub disables pull_request_target for public repos on 2 November
Execution protections reach general availability, and with them a default rule that blocks the one trigger that runs fork code against your secrets.
Kubernetes 1.37 adds noexec mount options for volumes
Every writable volume in a pod has been executable by default. Two alpha gates in v1.37 let you say noexec, nosuid, nodev, and set a permission mode on emptyDir.
Cloudflare cuts 100TB of RAM from its load balancers
A load balancer was holding 100,000 hash points per server. The maths said the last 90,000 bought a 0.7% accuracy gain, and 32-bit hashes made them worse than useless.
Allowlists enforce the day they were written
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
A vendor patch is an unreviewed change
Every release process guards the code it writes. Almost none guard the code that arrives on somebody else's schedule.
RFC 10008 defines QUERY, a sixth HTTP method
RFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through.