Original title: Why Are You Telling Us All This?
The discussion centers around the privacy guarantees of messaging apps, particularly Telegram and Signal. The author criticizes Telegram for its misleading claims about security and highlights the lack of financial incentives for recommending Signal. They express concern over the promotion of VPNs over Tor by influencers, questioning the motivations behind such recommendations. The author emphasizes the importance of cryptography audits, detailing how they work and their limitations, while also noting that many apps boast outdated or superficial audit results. The piece aims to demystify applied cryptography, asserting that understanding it is accessible to everyone. The author plans to review Signal's cryptography, likening it to an audit conducted over a weekend, and aims to empower readers to critique the security of messaging apps themselves.
Original title: Introducing scheme-rs: A Glue Language for Async Rust
The blog post introduces scheme-rs, an implementation of R6RS designed to enhance the experience of programming with async Rust. The author, a long-time Rust user, acknowledges the frustrations associated with async Rust, such as slow compile times and difficult debugging, while emphasizing that these issues stem from intentional design trade-offs. Scheme-rs aims to provide a 'glue language' that allows for seamless interoperability with async Rust, enabling developers to define bridge functions and utilize a REPL for debugging. The choice of Scheme is justified by its expressive nature and robust macro system, which the author intends to leverage in a future language called Gouki. Gouki is envisioned as a superset of Scheme with a stronger type system, allowing developers to write most code in Gouki while using Rust for low-level tasks. Although scheme-rs is still a work-in-progress, it currently supports essential features like tail calls and a robust macro system, while lacking some built-ins and error handling. The author has recently transitioned scheme-rs from an interpreter to a compiler to improve performance and aims to complete the R6RS specification soon, inviting contributions from interested developers.
Original title: Common Lisp: A Personal Pick of Interesting Projects, Tools, Libraries, and Articles from the Last Two Years
The Common Lisp ecosystem has seen significant evolution over the past two years, with new projects, tools, and libraries emerging alongside community growth. Notable highlights include the successful integration of Hacker News with SBCL, the revival of Clozure, and the ongoing improvements in SBCL's garbage collector and performance tools. The community has been active, organizing events like the European Lisp Symposium and various meetups, while resources such as the CL Cookbook and FreeCodeCamp's Common Lisp course have been updated to support newcomers. Several implementations, including ABCL and ECL, have released new versions, and there are ongoing discussions about job opportunities in the Lisp domain. New editors like Neomacs and updates to existing ones like Lem have enhanced the development experience. Additionally, the introduction of new libraries and tools for web development, game development, and data structures reflects the ecosystem's vibrant growth. Overall, the landscape of Common Lisp continues to thrive, with a strong emphasis on collaboration and innovation.
Original title: Nintendo Switch 2: Developers Share Their Expectations and Challenges
Nintendo officially announced the successor to the Switch, prompting discussions among developers about their experiences with the original console and expectations for the new model. Developers faced significant challenges when porting games to the Switch, primarily due to limitations in CPU, GPU, RAM, and storage. The Switch's CPU often struggled with background loading, while its GPU required compromises in resolution and rendering quality. With only 4GB of RAM, developers had to optimize data management to avoid crashes, and storage limitations, particularly with cartridge sizes, added complexity to game development. Unique issues arose from the console's name interfering with programming commands, and developers noted that games designed specifically for the Switch encountered fewer problems. Looking ahead, developers overwhelmingly desire improved hardware specs for the Switch 2 to facilitate smoother game development and reduce compromises. They also expressed hopes for user-friendly features, such as a more durable controller, while maintaining their affection for the original Switch platform. Anticipation builds for the upcoming Nintendo Direct in April 2025, where more details about the Switch 2 are expected to be revealed.
Original title: New Junior Developers Can’t Actually Code
A growing concern in software development is that new junior developers, while able to ship code quickly using AI tools like Copilot and GPT, often lack a deep understanding of the code they produce. Many of these developers do not possess the foundational knowledge that was traditionally gained through problem-solving and debugging, leading to a reliance on quick fixes rather than comprehensive learning. The article contrasts the current ease of finding solutions through AI with the past experience of using platforms like StackOverflow, where developers engaged in detailed discussions and learned from the thought processes of experienced peers. The author emphasizes the importance of understanding not just how to code, but why certain solutions work, suggesting that developers should adopt a learning mindset when using AI, engage in meaningful discussions, and occasionally build projects from scratch to deepen their knowledge. The future of software development will depend on how developers integrate AI into their learning processes without sacrificing their understanding of the systems they work with.
Original title: [oss-security] MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client
Two vulnerabilities in OpenSSH have been identified: one allows a machine-in-the-middle (MitM) attack against clients using the VerifyHostKeyDNS option, and the other enables denial-of-service (DoS) attacks through excessive memory and CPU consumption. The MitM attack exploits a flaw where the client fails to properly verify the server's host key when certain error codes are returned, potentially allowing an attacker to impersonate a legitimate server. The DoS vulnerability arises from unlimited memory allocation during the handling of PING and PONG packets, which can lead to resource exhaustion on the client side. While the server has some built-in mitigations, the client lacks protections against this attack. The vulnerabilities were introduced in different versions of OpenSSH, with the MitM issue dating back to 2014 and the DoS issue introduced in 2023. A proof of concept demonstrates how an attacker can exploit these vulnerabilities to bypass host key verification and consume system resources.
Original title: 14 years of systemd
Lennart Poettering's keynote at FOSDEM 2025 marked 14 years of systemd, reflecting on its evolution from predecessors like System V init and Upstart. He emphasized systemd's role as a comprehensive suite for managing Linux systems, highlighting its modularity despite criticisms of being monolithic. Poettering discussed the project's influences, including Apple's launchd and Solaris's service management facility, and noted that systemd has become the default for major Linux distributions. He acknowledged the need for more frequent releases and outlined future goals, including enhancing system integrity, rethinking interprocess communication, and exploring Rust for development. Poettering also addressed the challenges of adopting image-based operating systems and the complexities of integrating legacy technologies.
Original title: Can I ethically use LLMs?
The exploration of the ethical implications of using large language models (LLMs) reveals a complex landscape. The author, who has experience with LLMs but currently refrains from using them, raises concerns about their significant energy consumption, particularly in data centers, and the environmental impact associated with their training and inference. Additionally, the issue of training data usage without consent is highlighted, with a call for mechanisms that allow individuals to opt out. The potential for LLMs to replace human jobs is acknowledged, emphasizing the need for societal responsibility in mitigating the resulting harm. Furthermore, the tendency of LLMs to produce incorrect information and exhibit bias poses risks, as does the concentration of power among a few companies that control the technology. The author concludes that while some uses of LLMs may be ethical, the overarching ethical questions must be addressed to avoid potential harm.
Original title: SQL Property Graph Queries in PostgreSQL: A New Way to Work with Graphs
The blog discusses modeling graphs in PostgreSQL using recursive CTEs and introduces SQL Property Graph Queries (SQL/PGQ), which is part of the SQL:2023 ISO standard. This new feature allows efficient representation and querying of relational data as graphs without needing a separate graph database. While third-party extensions exist, contributors are actively working on implementing SQL/PGQ into PostgreSQL. The article provides a step-by-step guide for patching PostgreSQL to explore SQL/PGQ functionality, including creating tables for nodes and edges, and populating them with data. It demonstrates simple and complex queries using both recursive CTEs and SQL/PGQ, highlighting the ease of use and clarity of the latter. The author expresses excitement for the future of SQL/PGQ in PostgreSQL, noting that while it is still a work in progress, it shows great potential for graph data handling.
Original title: Choosing the Right Browser: Security, Privacy, and Ethical Considerations
Choosing the right browser is essential for security, privacy, and user experience, especially with Chrome discontinuing support for the uBlock Origin adblocker. Brave is recommended for its strong privacy features and minimal anti-features, while Firefox is noted for its extensibility. Chrome excels in security due to its multi-process architecture and rapid update cycle, but it compromises user privacy by tracking behavior and sharing data with advertisers. Safari, while blocking some trackers, has limitations and contributes to privacy issues across the web. Ethical concerns arise as all browsers have monetization strategies that may exploit users, with Brave's attention-based model and Firefox's acquisition of an adtech company being particularly contentious. The article calls for the development of open-source browsers that prioritize user control and transparency, highlighting projects like Ladybird and Servo as promising alternatives that aim to avoid corporate conflicts of interest.
Original title: NES86: An IBM PC Emulator for the NES
NES86 is an emulator designed to replicate the Intel 8086 processor and associated PC hardware, enabling the execution of the Embeddable Linux Kernel Subset (ELKS) along with a shell and utilities. The emulator aims to support other x86 software that operates through a simple serial terminal. Users can download the NES ROM containing NES86 and ELKS or build them from the source. The emulator's mapper configuration is theoretically valid but not widely supported by existing emulators or flash cartridges. Testing has shown that Mesen2, FCEUX, and Rustico work with NES86, while others like Nestopia and BizHawk do not. To build NES86, users need to clone the project, install necessary dependencies, and follow a series of commands to set up the environment and compile both ELKS and NES86. The final NES ROM is located in the nes86/bin directory, and contributions to the project are encouraged.
Original title: The USB That Wasn’t
ACCESS.bus was an early attempt to create a universal bus for peripherals, developed by Digital Equipment Corporation (DEC) and based on the I²C protocol. It aimed to simplify connections between computers and low-speed I/O devices like keyboards and mice, allowing multiple devices to daisy-chain off a single port. Despite its advantages, such as low cost and ease of implementation, ACCESS.bus struggled to compete with faster standards like USB and FireWire, which ultimately became the industry standard. While it found some niche applications, particularly in monitor technology, it could not gain widespread adoption. The technology was eventually overshadowed by USB, which offered higher speeds and broader manufacturer support. Although ACCESS.bus is largely forgotten today, its legacy lives on in the Display Data Channel (DDC), which allows monitors to communicate with computers, showcasing how some of its concepts were integrated into modern standards.
Original title: Building Rails Applications with Components Using Superview
Rails applications often struggle with messy view layers as they grow, prompting the need for better organization. While component libraries like Phlex and ViewComponent offer solutions, they can introduce boilerplate code that becomes repetitive across multiple actions. Superview addresses this issue by allowing developers to build Rails apps using components without excessive boilerplate. By implementing Superview, developers can create inline views directly within controllers, streamlining the rendering process. Additionally, Superview supports organizing views in a dedicated directory while ensuring they are automatically loaded by Rails' Zeitwerk. The gem also provides flexibility for rendering different formats, such as JSON, and allows for easy error handling during updates. Overall, Superview enhances maintainability in Rails applications by simplifying component rendering.