A supply-chain attack involving obfuscated malicious code in the xz package was discovered by a developer at Microsoft who noticed a small 600ms delay with SSH processes when doing some routine micro-benchmarking. The account that made the offending commits seemingly played the long game, slowly gaining the trust of xz's developer before injecting the attack. The attack allows for the interception and modification of data used with the library, allowing malicious actors to break sshd authentication and gain access to affected systems. The situation is developing and more vulnerabilities could be discovered. https://www.techspot.com/news/102456-linux-could-have-brought-down-backdoor-found-widely.htmlTechSpot
Linux could have been brought down by backdoor found in widely used utility
Andres Freund, a PostgreSQL developer at Microsoft, was doing some routine micro-benchmarking when he noticed a small 600ms delay with ssh processes, noticing that these were using...
🤯1
In a study, students who learned to code with AI made more progress during training sessions, had significantly higher correctness scores, and retained more of what they learned compared to students who didn't learn with AI.
https://austinhenley.com/blog/learningwithai.html
Austinhenley
Learning to code with and without AI
We studied the impact of AI code generators on novice programmers and how they used the AI.
The xz/liblzma vulnerability was introduced by an attacker who offered to help a struggling solo maintainer following community pressure to implement changes.
https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/
Robmensching
A Microcosm of the interactions in Open Source projects
Originally a thread on Twitter about the xz/liblzma vulnerability, when I finished typing it, I realized I had a real world slice of Open Source interaction that deserved more attention.
This article looks at how GitHub entered the market, what existed before, and what gap GitHub filled.https://graphite.dev/blog/github-monopoly-on-code-hosting
Graphite.dev
How GitHub monopolized code hosting
How GitHub became a version control monopoly
Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet. It utilizes SSH remote port forwarding under the hood to securely tunnel connections.
Portr is primarily designed for small teams looking to expose development servers on a public URL. It is not recommended for use alongside production servers.
Portr is primarily designed for small teams looking to expose development servers on a public URL. It is not recommended for use alongside production servers.
👍3
Meta released Llama-3 only three days ago, and it already feels like the inflection point when open source models finally closed the gap with proprietary models. The initial benchmarks show that Llama-3 70B comes pretty close to GPT-4 in many tasks:
• The official Meta page only shows that Llama-3 outperforms Gemini 1.5 and Claude Sonnet.
• Artificial Analysis shows that Llama-3 is in-between Gemini-1.5 and Opus/GPT-4 for quality.
• On LMSYS Chatbot Arena Leaderboard, Llama-3 is ranked #5 while current GPT-4 models and Claude Opus are still tied at #1.
The even more powerful Llama-3 400B+ model is still in training and is likely to surpass GPT-4 and Opus once released.Industry Leading, Open-Source AI | Llama
Discover Llama 4's class-leading AI models, Scout and Maverick. Experience top performance, multimodality, low costs, and unparalleled efficiency.