alsadi

Untill the entire scope of this is identified I suggest activating the kill switch

https://bcksp.blogspot.com/2024/03/how-to-disable-xz-backdoo...

here I've eliminated uvicorn, nothing changed

https://gist.github.com/muayyad-alsadi/3a1e1cdbafca34df8b178...

Many things have changed since the old days. In PEP 3333 sendfile is exposed as opposed to PEP 333 (so in the WSGI days they had no way of doing it, but in ASGI they can do it).

The assumption that nginx is always there no longer hold, specially in microservices, ex. Running behind haproxy (does not service static files) or running bechind cloud provides like AWS ALB.

As I pointed out in my other comment, serving a static file should be a single call to a kernel routine called sendfile (sendfile in c or in python io.sendfile or loop.sendfile). No loop, no memory copy, no further context switch.

Again if you think I was not fair to fastapi, suggest a change to the fastapi part. Do not cripple the competing solution.

If you want believe the time is wasted by the introduction of uvicorn layer as opposed to pure python implementation, I can run the fastapi in pure python ASGI without that layer, it would be worse. Because you uvicorn is one of the best implements.

BTW being ASGI is not excuse because ASGI spec (PEP 3333) have a section on how to expose and make use of sendfile kernel routine.

https://peps.python.org/pep-3333/#optional-platform-specific...

I made it like that to be as fair as possible and as simple as possible. I've done other experiments with same results. If you think I was not fair to the fastapi part feel free to edit the fastapi part in the form of github gist. And give me the link.

It's reported here and they suggest adding nginx with x-accel which is basically surrending.

https://github.com/tiangolo/fastapi/issues/5803

Computers are just infinite tape marked out into squares... (Turing machine). A pyramid is just a stack of cubic rocks.

I do agree. When I first see it I knew that. Comparing two sequences (actual dom and dom) to find diff is like O(n^2) and the assumption that dom ops is expensive is a lie (premature optimization). Dom ops on ids and classes and fragments is very fast. In most cases a slow dom is always a developer fault failing to use fragments.

How about making it redis+msgpack vs. postgresql json-like?

2015

We are big pharam, give us tons of money and hope that we cure you! We don't! we just treat you.

Some optimizations can be enabled

"python -OO -m compileall mydir"

But it's merely skipping comments and names

I guess Prius is not affected. But Prius is borning.

Kazakhstan forces their citizens to install government-issued certificate to use SSL.

So why debian/ubuntu vulnteer to remove this layer? Why doing the equivalent of installing random certs for every gov/isp on every user?

Yes, government can force someone to install it, but it won't use force on every single person.

This would have been prevented

https://www.debian.org/security/2019/dsa-4371

Those arguments are invalid. Because debian/ubuntu fail to use https regimes like egypt/syria can track people who try install tor and they can cherry-pick block repos based on package name.

I'm sorry for not liking your favorite color and distro. Please deal with it.

And btw they don't digitally sign their package too (they sign separated meta data file having checksum which is not equivalent of embeding signature inside the package and validate it).

Compare that to yum/rpm which use secure https and signed rpm and signed metadata (both the medium and the payload are secured)

I miss redhat's bluecurve icons. https://www.deviantart.com/redrope/art/Bluecurve-Complete-Ic...

No, kufi is named after a city in what is now Iraq not Iran.

https://en.m.wikipedia.org/wiki/Kufa

it's a known calligraphy style called kufi, just google it.

https://www.google.com/search?q=arabic+calligraphy+kufi&clie...

no, it's very readable because it's a well known calligraphy called kufi as others have pointed out.

The logo on the right is the arabic letters of the word Algorithmi (al-Khwarizmi) the persian muslim scholar after him algorithms and logarithms were named

Start feeling sad for the birds that eat them.

I guess SELinux/SVirt would mitigate this

Many comments mistaken redhat as an OS company? They are not. IBM did not buy redhat to get RHEL.

They bought it for the hybrid cloud as clearly stated.

Redhat has openstack platform, cloud formation/manage iq, openshift, ansible, ceph, glusterfs, codeenvy (behind eclipse che),... Etc

Defeting aws not ms. And projects like ansible and cloud formation / manage iq are the weapons

Seriously! It would be much easier to get an effective ak47 from black market than printing sub-par plastic useless gun.

.. would spot ..

the article describe how to spot a supposed spying chip when it happens, but why they single China? Just replace it with Israel and the article would still valid.

Not all fpgu are equal. Maybe this targets those with lower specs.

Red Hat is wrong example, both RHEL and Openstack has no secret sauce, it's all opensourced.