There is some chatter about a CA misissuing a certificate for 1.1.1.1. This CA (crt.sh?caid=201916, only ~300 certs) is only trusted by the Microsoft root program and the eIDAS QWAC trusted list. MS has not been actively managing their roots for years, and the EU wanted to push theirs on browsers.

Heading home from #GopherCon 2025 in NYC. As usual, many people asked how to get one of the amazing Go gopher Hawaiian shirts by Renee French. I've posted the details at github.com/rsc/gophersh.... (I know one person who has made pajama pants with the pattern. Socks might be nice too.) Enjoy!

Side point: this demonstrates the benefits of plain text file formats. When @robpike.io implemented the coverage tool he made it emit a simple line-based text file that Russ could then manipulate with the ubiquitous Unix tools.

Another fun magic trick! Differential Coverage for Debugging research.swtch.com/diffcover

Fifty Years of Open Source Software Supply Chain Security We are all struggling with a massive shift that has happened in the past 10 or 20 years in the software industry. For decades, software reuse was only a lofty goal. Now it's very real. queue.acm.org/detail.cfm?i... @swtch.com

With 8 minutes to go, @damienmiller.bsky.social sends me the only funny April Fool's joke of the day. Notably because I was on the team of people writing the firewall rules for Rob Pike's plan 9 desktop at Google. @tailscale.com fixes it (albeit ten years too late).

Yeah, about that... tailscale.com/blog/plan9-p... That gives the backstory :)

i was going to say it was hilarious but i wished it was real and then i realized it was

I only respect april fools jokes that commit to the bit. This? This is commitment.

This was a lot of fun!

"Tailscale Enterprise Plan 9 Support" tailscale.com/plan9 (A little thing I wrote and worked on over the past few weekends with @swtch.com)

@swtch.com you might be interested in this… zellyn.com/2022/01/gopi...

Does anyone know the effective time limit for GitHub comment edits being included in the comment text that is emailed to issue subscribers? GitHub renders "- #12345" differently on web (nice link with title and issue status) vs email (literally a useless blue #12345). 1/3

I have found exclusive footage of the mystery drones over New Jersey. youtu.be/qsb74pW7goU?...

Day 4 part 1 adventofcode.com/2024/day/4 #AdventOfCode pad dot-pads the matrix to avoid wraparound. x y shift m rotates the matrix x left, y down. d(=x y) shift4 m produces the 4 matrices shifted by d*0 1 2 3. d XMAS m identifies the X in XMAS in direction d.

Well, it's been 2/3 of a year since the xz attack. Is software safer now? Serious question. What improvements have we made?

Day 3 part 1. The function 'c step s' steps the state machine state s to incorporate the new character c. (step/ flip x) runs the state machine over the whole string, left to right. The reduction base case for "...yz" is 'y' step 'z', which step rewrites to ('y' step 'z' step initial-state).

Ivy remains a good choice for #AdventOfCode. Day 1: sample = transp read "sample.txt" op sort x = x[up x] op solve x = +/abs (sort x[1]) - sort x[2] solve sample op solve2 x = +/x[1] * +/x[1] o.== x[2] solve2 sample adventofcode.com (Ivy in 2021: www.youtube.com/playlist?lis...)

SVG, HTML5 Canvas, Apple Core Graphics, PDF, and probably many others all use the same core vector graphics model and operators, which I think of as from PostScript. Did the creators of PostScript invent these, did they originate in some even earlier system?

Learn a new magic trick! Hash-Based Bisect Debugging in Compilers and Runtimes research.swtch.com/bisect

This article attributes the xz attack to a Chinese hacker who texted about it, including claiming that they have at least one other open source bug. thenightly.com.au/world/chines...

A walkthrough of the xz attack shell script. An RC4 variant in Awk, what more could you want? research.swtch.com/xz-script

I put together a timeline of the xz attack, dating back to 2021. Corrections or additions welcome here on Bluesky. research.swtch.com/xz-timeline

The late, truly great Luiz Barroso wrote some very good, short essays on engineering practices at Google. He published them on his web site in a single PDF. The three one-pagers on pages 2, 3, and 4 are each gems.