👋, and music with the WipEout soundtrack.

News

[fr] Clément Viktorovitch en entreveue chez Blast : Le journalisme neutre n’existe pas.

Kottke: Gou Miyagi skates very mellow, Tyshawn Jones skates fast, Fabio Wibmer bikes fast, Ryan Williams’ mindbreaking BMX Free Willy.

Software

That was quite the eventful security week:

• Casey Muratori: The Apple M-series GoFetch attack (exploit site).

• Low Level Learning: Linux CVE-2024-1086 exploit is insane.

• Backdoor in xz/liblzma leads to ssh server compromise (HN). Timeline. It’s RCE, not auth bypass (2) (HN). xz/liblzma: Bash obfuscation explained (HN). Xz vuln: A microcosm of open-source projects interactions. xzbot: notes, honeypot, and exploit demo for the xz backdoor (HN). Prime Reacts: Jonathan Blow predicts xz years ago. Also, You are all on the hobbyists maintainers’ turf now and I am not a supplier, via Brodie Robertson. Jussi Pakkanen: Aesthetics matter. Low Level Learning: Revealing the features of the XZ backdoor. Initial detailed analysis & HN. Deep dive into the xz backdoor - Columbia Engineering, Advanced Systems Programming guest lecture (HN). 404media: Bullying in open source software is a massive security vulnerability.

Dom Marti: Internet users preferences about advertising, personalization, and privacy, varies wildly.

Real Engineering: The engineering of the Gameboy.

Prime Reacts: DHH - Be less precious.

AI

NYC’s AI chatbot tells businesses to break the law. Tasty skewer of factual errors presented as facts by a chatbot supposed to be authoritative. Via waxy.

Oh hey, Google Search is experimenting with pushing AI results first.

Games

[fr] Thief 2 - Une brève analyse.