slrz

What is it that Go supposedly calls casting? The term (or its variations) does not show up in the language specification.

People sometimes use it for type conversions but that's in line with usage elsewhere, no?

I guess that basically everything you'd consider for production use allows you to configure queue sizes and related behaviour however you fancy.

For example, debug/pe ImportedLibraries(), which is supposed to return all the libraries that a module imports, was stubbed out to return "nil, nil" in a minor release [1]

I just looked at the Git history and this is plain false. It already looked that way when the big source tree move (src/pkg/ -> src/) was done in 2014. Tracing it back further (to before Go 1.0 times, when there wasn't even a builtin error interface yet and the function returned os.Error), ImportedLibraries was *never* implemented in debug/pe.

google's 'reference' layout

Nothing to do with Google here, by the way. It's just the default format of the Unix date command.

So if you can't remember the order, just switch to your shell and run `LC_ALL=C date`.

No longer true. Podman nowadays ships with an optional daemon that serves a Docker-compatible interface, so you can use docker-compose directly if that's what you want.

See for example: https://www.redhat.com/sysadmin/podman-docker-compose

This was never an intended feature. If I understand the article correctly, they were using an undocumented ("private") API which happened to stop working.

You can always use sendmmsg(2), writev(2) or other iovec-based APIs.

I don't like it either but it's not as bad as it sounds: the ban almost certainly isn't enforced mindlessly and with no recourse for the affected.

I'm pretty sure that if someone from the University of Minnesota would like to contribute something of value to the Linux kernel, dropping a mail to GregKH will result in that being possible.

Most common distributions turn it on when running on a device with UEFI Secure Boot enabled.

So CentOS is actually getting better with a more open development model. Awesome.

Getting a hold of someone's secrets is not possible just by doing a pull request. It's really only about resource usage, at least when the runners in question provide sufficient isolation (true at least for the Github-hosted ones, or we're all in big trouble).

Unfortunately, using self-hosted runners to provide additional capabilities not supported by Github-hosted ones is basically impossible (for public repos at least) as you can't restrict a runner to an organization or project. Set up a bare-metal runner and it will receive jobs from random forks.

I don't think this is doing any HTTP. Autofs is generally used to mount remote file systems like NFS shares.

It's pretty common on Unix-like systems (especially in multi-user environments) and not at all specific to macOS.

References:

https://wiki.archlinux.org/index.php/autofs

https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5

https://access.redhat.com/documentation/en-us/red_hat_enterp...

It basically expects a string as the source and a fixed-size, not necessarily zero-terminated, buffer as the destination.

As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs

Does this refer to standard Web APIs or Chrome-specific and more or less experimental interfaces?

This is asking for a different thing, though.

  % taskset 1 nproc
  1

  % taskset 1 getconf _NPROCESSORS_ONLN
  8

Seems reasonable to me: this way, you don't have to duplicate the BOM stripping in the decoders of every single format you want to support.

It's also more general as there are other commonly-needed transformations that have an even weaker case for explicit support in the CSV library (charset conversion, dropping other bogus bytes, ...).

This one is an informational RFC though. No internet standard.

No. QUIC is a transport protocol. Its purpose is roughly equivalent to TCP: provide a reliable byte stream transport over an unreliable datagram service (IP, though QUIC prepends a small UDP header mostly for compatibility with existing infrastructure).

You might be thinking of the HTTP server push functionality. That was introduced with HTTP/2 and has been deployed for years already over TCP transports (i.e. totally unrelated to QUIC).

Due to how advertising networks work, I'd be surprised if anyone used server push in the way you fear.

Not libc. The stack probe was inserted by the compiler when compiling the vDSO (part of the kernel, but mapped into user processes) with certain ricer^Whardening flags enabled.

Actually, it used to be called just that.

Even for moderately complex designs the synthesis times are way too long for that to be feasible. Unfortunately, a lot of it is inherent to the problems/algorithms involved. So getting rid of the clumsiness of proprietary synthesis tools won't be sufficient, you are going to need another breakthrough.

I find it somewhat odd that Peter ascribes the valuing of stability and backwards compat to some weird Google-specific mindset, unheard of in other circles.

Instead, you can observe the same thing with many other ecosystems/platforms once they have reached a certain scale. Ask Microsoft's Windows team or the Linux kernel maintainers about the importance of keeping existing programs running. Or maybe the stewards of other programming languages like C or C++ can tell you about the difficulty of evolving a language when you have a gazillion lines of pre-existing code to consider. How long does it take the world to phase out support for obsolete SSL/TLS versions, even in the presence of well-known weaknesses?

It seems to me that the more users something has, the more thought has to be put into how not to break them.

Isn't programming in the large exactly the kind of thing Go set out to tackle? Placing a high value on stability appears only logical then.

Any guesses on how to interpret the description?

An authorization issue discovered in the CI jobs token handling allowed read access to public projects with restricted repositories. This issue is now mitigated in the latest release and is waiting for a CVE ID to be assigned.

A GitLab project can have multiple repositories? I don't think so. Is this just s/project/group/?

I'd be more optimistic if you had included a note that you know the history of CAcert (https://en.wikipedia.org/wiki/CAcert.org) and have a plan on how to tackle the issues that prevented its roots from getting into the common trust stores.

How is Google's work-from-home policy nowadays? Does it differ between Europe and the US?

ANSI C heavily mixed up the conversion rules for expressions involving both, signed and unsigned, integer types (value-preserving vs. unsigned-preserving in K&R C).

This might have been a factor here, given that most of Gosling's peers back then were probably still more familiar with K&R C and its different set of conversion rules.

They have become a lot better at upstreaming their changes.

Also note that the Zdnet headline seems bogus. Better look at the actual source[1] for their "news" which was posted to HN some time ago.

[1] https://googleprojectzero.blogspot.com/2020/02/mitigations-a...

And yet, maps and slices are implemented in Go.

https://golang.org/src/runtime/map.go

https://golang.org/src/runtime/slice.go

I don't see why you couldn't do something similar in your own Go code. It just won't be as convenient to use as the compiler wouldn't fill in the type information (element size, suitable hash function, etc.) for you. You'd have to pass that yourself or provide type-specific wrappers invoking the unsafe base implementation. More or less like you would do in C, with some extra care to abide by the rules required for unsafe Go code.

The SHA-2 checksums to verify packages against are delivered as part of the (signed) package index (as the article alludes to).

I think some undefined behaviour can also be detrimental to performance. If you pass two pointers to a function, and it's undefined whether they alias or not, there are optimisations you can't do.

I think this results from a misunderstanding of how undefined behaviour works in C. When a program exhibits undefined behaviour it is not a valid C program. The compiler may just assume (instead of having to prove) that it doesn't happen.

Example: the memcpy(3) standard library function. C says the behaviour is undefined if the given areas overlap. That means the implementation can perform optimizations "knowing" that there is no overlap. A valid C program can't possible invoke memcpy with buffers aliasing each other (because then, the program would be invalid). The compiler is not required to issue a diagnostic about these kinds of incorrect programs and just compiles your code assuming they don't exist.