today's leftovers

 

• openSUSE Tumbleweed – Review of the week 2021/15

  After I left you and Tumbleweed in the capable hands of Richard for two weeks, it is good to be back. The week has seen a slightly lower count of published snapshots, but only because openQA was nice enough to find bugs that we did not you having to fight with. So, we only released two snapshots (0408 and 0414). As usual, the large gap means a few snapshots were tested in between, and things accumulated.

• Pop!_OS 21.04 Preview: Test-driving the Cosmic Desktop!

  System76 recently unveiled their plans to debut a new desktop, dubbed "Cosmic", along with Pop!_OS 21.04 this coming June. I can't wait that long, so I decided to check it out right now. In this video, I show-off the current in-development version of the Cosmic Desktop as of April 16th, 2021.

• Ubuntu Blog: KubeCon co-located events: Operator Day is back!

  Another KubeCon is just around the corner and, due to popular demand, we’re hosting Operator Day again! Designed for KubeCon, but free and open to all. Last year, thousands of you joined us to get hands-on training from Ubuntu’s experts, so this time around we’re making the workshop even more elaborate and interactive! Operators simplify everyday application management on Kubernetes. Learn how to use them, how to create them in Python, and how to evolve from configuration management to application management. We’re working to create a community-driven collection of operators for everything that’s integrated and tested everywhere.

• Tetrate Service Bridge for Istio On Hybrid Clouds Ready for Production | Data Center Knowledge

  The startup recently raised $40 million in venture funding and now has a product ready to make Istio palatable for enterprises.

• What we learned from our survey about returning to in-person events

  Recently, the Linux Foundation Events team sent out a survey to past attendees of all events from 2018 through 2021 to get their feedback on how they feel about virtual events and gauge their thoughts on returning to in-person events. We sent the survey to 69,000 people and received 972 responses.

• Linux Foundation Newsletter April 2021: 30 Percent off Training Sale, New Research Division, LF Fights Rare Genetic Diseases [Ed: Jason Perlow from Microsoft signed/published on this newsletter from the failing “Linux” Foundation, whose newsletter is still served on Microsoft Windows]

Programming Leftovers

 

• Thoughts about gedit and Rust

  Nothing concrete yet, I've not started to work on it. But after a break of several months, I'm now considering learning Rust, and incrementally rewriting gedit in Rust.

• WASI, Bringing WebAssembly Way Beyond Browsers

  WebAssembly (Wasm) is a binary software format that all browsers can run directly, safely and at near-native speeds, on any operating system (OS). Its biggest promise, however, is to eventually work in the same way everywhere, from IoT devices and edge servers, to mobile devices and traditional desktops. This post introduces the main interface that should make this happen. The next post in this series will describe some of the already available, real-world implementations and applications of the same interface.

 

• Introducing Qt Quick 3D Particles

  As you may have already seen or heard, Qt Quick 3D introduces support for 3D particles in Qt 6.1. Similarly to instanced rendering , also 3D particles module is a technology preview in Qt 6.1 and will be fully supported in Qt 6.2. In this blog post we'll go through things every developer & designer should know about the new 3D particles, so please continue reading. With the visual elements such as particles, it is always beneficial to actually see what you can do with them. The video below goes through some demos from our Testbed application, included as part of the Qt 6.1 examples. [...] Two different logical particle types are supported: SpriteParticle3D for 2D texture particles and ModelParticle3D for 3D model particles. Model particles actually use instanced rendering to allow rendering thousands of particles, with full Quick 3D materials and lights support. Logical particle will define the common appearance of the particles. One important property is maxAmount , which is used for allocating the data for particles. Qt Quick particles don't have this feature, but instead they automatically grow the data based on emitRate, lifeSpan and bursts. Requiring it to be defined allows us to optimize the memory usage and to modify the emitRate and lifeSpan without reallocations

• Using the SystemTap Dyninst runtime environment

  SystemTap (stap) uses a command-line interface (CLI) and a scripting language to write instrumentation for a live running kernel or a user space application. A SystemTap script associates handlers with named events. This means, when a specified event occurs, the default SystemTap kernel runtime runs the handler in the kernel as if it is a quick subroutine, and then it resumes. SystemTap translates the script to C, uses it to create a kernel module, loads the module, and connects the probed events. It can set probes at arbitrary kernel locations or at user space locations. While SystemTap is a powerful tool, loading the kernel module requires privilege, and this privilege can sometimes be a barrier for use. For example, on managed machines or in containers that are without the necessary privilege. In these cases, SystemTap has another runtime that uses the Dyninst instrumentation framework to provide many features of the kernel module runtime only requiring user privilege.

    

• Broadening compiler checks for buffer overflows in _FORTIFY_SOURCE - Red Hat Developer

  Buffer overruns are by far the most common vulnerability in C or C++ programs, and a number of techniques have come up over the years to detect overruns early and abort execution. The _FORTIFY_SOURCE macro, provided by the GNU C Library, helps mitigate a number of these overruns and is widely deployed in Red Hat Enterprise Linux. This article on the Red Hat Security blog is a good introduction to _FORTIFY_SOURCE. In the GNU C Library’s 2.33 release, we added a new level for _FORTIFY_SOURCE to improve the protections the macro provides. Here we take a closer look at the internals of _FORTIFY_SOURCE in GCC and explore the need for this new level.

          

• Robert O'Callahan: Demoing The Pernosco Omniscient Debugger: Debugging Crashes In Node.js And GDB

  Traditional debugging forms a hypothesis about what is going wrong with the program, gathers evidence to accept or reject that hypothesis, and repeats until the root cause of the bug is found. This process is time-consuming, and formulating useful hypotheses often requires deep understanding of the software being debugged. With the Pernosco omniscient debugger there’s no need to speculate about what might have happened, instead an engineer can ask what actually did happen. This radically simplifies the debugging process, enabling much faster progress while requiring much less domain expertise. To demonstrate the power of this approach we have two examples from well-known and complex software projects. The first is an intermittently crashing node.js test. From a simple stack walk it is easy to see that the proximate cause of the crash is calling a member function with a NULL `this` pointer. The next logical step is to determine why that pointer is NULL. In a traditional debugging approach, this requires pre-existing familiarity with the codebase, or reading code and looking for places where the value of this pointer could originate from. Then an experiment, either poking around in an interactive debugger or adding relevant logging statements, must be run to see where the NULL pointer originates from. And because this test fails intermittently, the engineer has to hope that the issue can be reproduced again and that this experiment doesn’t disturb the program’s behavior so much that the bug vanishes. In the Pernosco omniscient debugger, the engineer just has to click on the NULL value. With all program state available at all points in time, the Pernosco omniscient debugger can track this value back to its logical origin with no guesswork on the part of the user. We are immediately taken backwards to the point where the connection in question received an EOF and set this pointer to NULL. You can read the full debugging transcript here.

• gfldex: All your idioms are belong to us

  In the closing thought in my last post I postulated the need to find idioms. That worried me a bit because finding things that are not there (yet) is no easy feat. By chance that day Hacker News linked to an article with well written and explained Python code. We can’t quite translate idioms from one language to another. But if we can steal ideasborrow features from other languages, maybe we can take inspiration for idioms too. The article by Bart de Goede kindly links to a github repo, where we can find the following piece of code.

Security Leftovers

• Security updates for Friday

  Security updates have been issued by Debian (smarty3), Fedora (libpano13, python3.8, and seamonkey), Mageia (chromium-browser-stable, gstreamer1.0, thunderbird, and x11-server), Oracle (libldb and thunderbird), SUSE (grafana and system-user-grafana, kernel, and openldap2), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm, linux-oem-5.10, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-raspi2-5.3, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon, and linux-oem-5.6).

• ISTIO-SECURITY-2021-004

• Windows 10 update causing blue screens of death — what to do