eyalitki

6 ms·

1.
by eyalitki 12d ago
Comparison was done in the scope of coderabbit AI code review tool, which sadly makes it practically irrelevant. My personal experience as a software engineer, and a former security researcher who did manual code audit, is that this code re
2.
by eyalitki 4mo ago
OpenAI has released the specifications of the Multipath Reliable Connection (MRC) protocol, and they are now publicly available as part of Open Compute Project (OCP) foundation. MRC, which is already being used by OAI in production for trai
3.
MRC Protocol: Supercomputer networking to accelerate large scale AI training(openai.com)
5 points by eyalitki 4mo ago|1 comments
4.
by eyalitki 5mo ago
Dup of: https://news.ycombinator.com/item?id=47952181
5.
by eyalitki 5mo ago
The presented LPE vulnerability was gradually introduced to the Linux Kernel through refactors and optimizations, each commit making sense on its own. The vulnerability itself was exploitable since 2017 (!) and also doubles as a container e
6.
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution(xint.io)
25 points by eyalitki 5mo ago|3 comments
7.
by eyalitki 5mo ago
The employer doesn't "allow" them to take "time off" to fight as part of the IDF as reservists. This is the law in Israel, and has nothing to do with any employer whatsoever. During this time, Israel's National
8.
Sandia Supercomputer Built on NextSilicon's Maverick-2 Accelerators(hpcwire.com)
2 points by eyalitki 9mo ago|0 comments
9.
by eyalitki 11mo ago
OK, now I understood the gap. There is a technical limitation for relocation resolution when the relocation is against a different section. This means that for function sections we de-facto have no relocation finalization, only conversion o
10.
by eyalitki 11mo ago
Correct me if i'm wrong, but wouldn't "file-sections" be identical to generating a static bundle object per original object file, and wrapping them all inside a .a archive?
11.
by eyalitki 11mo ago
Thanks, appreciate your feedback. Crossing my fingers that my PR for GNU ld will go as planned.
12.
by eyalitki 11mo ago
> Regarding --whole-archive, is it correct that it would be the default and you could opt-out of it with the function-sections/gc-sections combination? This is the current intention, as implemented in the up-to-date draft: https:&#
13.
by eyalitki 11mo ago
There is nothing magical in resolving the local relocations. It is just that current static libraries (static archives of plain .o files) are produced directly using "ar" and don't even go through the linker... The changes to
14.
by eyalitki 11mo ago
OP here, it was also my opinion that the handling of static libraries should significantly be improved, and ld should have a "--static-lib" flag to properly handle it. Sadly, the ELF committee prefers a more subtle approach, hence
15.
by eyalitki 1y ago
The article is a follow up for an earlier thread of mine that was published here a few months ago: https://news.ycombinator.com/item?id=44613791 . While the previous article presented the problem domain (multiple issues with
16.
Static Bundle Object: Modernizing Static Linking(medium.com)
4 points by eyalitki 1y ago|2 comments
17.
by eyalitki 1y ago
In the world we have more than just bugs. We also have features, and refactoring and whatnot. Prioritization should be done across all tasks, so a bug could be "medium" but the team might not even work on bugs this week unless the
18.
by eyalitki 1y ago
It would be interesting to know how many of bugs are triaged and declared as "won't fix" in order to comply with the zero bugs policy. Aside from that, while it might seem like an ideal engineering culture, I find it a bit ex
19.
by eyalitki 1y ago
Not sure what is the measurable metric here, and what will be considered a success in this trial period. Propagating the fix downstream depends on the release cycles of all downward vendors. Giving them a heads up will help planning, but I
20.
by eyalitki 1y ago
If someone needs a wrapper for a technology, that modifies the output it provides (like meson and bazel do), maybe there is an issue with said technology. If pkg-config was never meant to be consumed directly, and was always meant to be pos
21.
by eyalitki 1y ago
Yeah, but when the product is an SDK, and customers develop on top of it (using their own toolchains) there isn't a lot left for me to play with.
22.
by eyalitki 1y ago
1. "Advanced" compilation environments (meson) probably limit this ability to some extent. 2. Package managers (rpmbuild for instance) mandate build with debug symbols and they do the strip on their own so to create the debug pack
23.
by eyalitki 1y ago
Agree, there should be a prefix. But if 2 of my dependencies didn't use a prefix, why is it my fault when I fail to link against them? Also, some managers object to a prefix within non-api functions, and frankly I can understand them.
24.
The .a file is a relic: Why static archives were a bad idea all along(medium.com)
77 points by eyalitki 1y ago|132 comments
25.
by eyalitki 2y ago
RHEL tried that in that past with 64KB on AARCH64, it led to MANY bugs all across the software stack, and they eventually reverted it - https://news.ycombinator.com/item?id=27513209 . I'm impressed by the effort on Goog
26.
by eyalitki 2y ago
Rapid Content Update file (detection signatures) are tested on the cloud side "Content Validator" which had a bug and didn't detect the issue with the faulty file. No where in the post mortem to CrowdStrike mention that these
27.
CrowdStrike admits faulty content update wasn't tested on a real machine(theverge.com)
27 points by eyalitki 2y ago|4 comments
28.
Lessons from Securing FreeRDP(eyalitkin.wordpress.com)
3 points by eyalitki 3y ago|1 comments
29.
by eyalitki 3y ago
FreeRDP's recent version (3.0.0) contains a new security mechanism aimed at blocking information-leak vulnerabilities. Said fix would have blocked more than 50% of the info-leak vulnerabilities discovered in the project since 2018, whi
30.
Vulnerabilities Found in Valve’s “Steam Sockets”(research.checkpoint.com)
2 points by eyalitki 6y ago|0 comments

More ›