Better Dev #254 Apr 1, 2024

Hi all,

We come back to my second week :). If you like BetterDev, please help spead word out by refer to your friends. Buy Me a coffee would be great too

In previous email, I said about a new self hosted section. Due to a bug the sefl hosted doesn’t appear in email, you can go back to re-read the previous issue for awesome tool that you can run on your own hardware.

Onward to our news issue today.

First thing, there is a suppy chain attack on xz, it has assigned CVE-2024-3094, If you had install xz 5.6.x, that version is affected. If it’s a server, better to destroy and rebuild a new server with xz 5.4.

If you’re using mac, you can check which xz version you had installed

brew info xz

If it return 5.6, perform an brew upgrade xz and it will rollback to 5.4.

Continue on this story, no one know the real identity of the attacker so far. He has spend 2 years contribute code in a legitimate way. 2 years of works. Had he implement the backdoor correctly and not causing slowness, probably no one has notice. Someone shared a similar story on mastodon.

Another dance in open source community is the Redis license change, rest assured that if you’re just using Redis as an end-user theree is nothign change, you will be continue to use it. On top of that, Linux foundation has already launch Valkey , which is a fork of Redis right before the license change. In Redis codebase, top changeset contributions by employe is Tencent, not even Redis Lab. Alibaba comes in third place, then Huawei. So I think there will be definetely a path to the official Redis, similar to the IO.js story back in the old day, where everyone switch to the community fork. So no action require as an end-user, in the meantime, exploring the new ValKey project.

Garbage Collection for Systems Programmers

Let’s talk about one of the most performance-sensitive programs you run every day: your operating system. Since every speedup gives you more computer to compute with, an OS is never fast enough, so you can always find kernel and driver developers optimizing the bejesus out of their code.

Radios, how do they work?

A brief introduction to antennas, superheterodyne receivers, and signal modulation schemes.

JavaScript Visualized: Promise Execution

Due to its easi of use, and its forgiven model, promise remain an unclear? should I use return Promise<Value> or, return Promise.Resolve(value). all of that. Let look deeper to understand their execution model.

Hacking our PostgreSQL driver to get more out of Amazon RDS performance insights

In the process of improving Knock performance, Knock engineers found ourselves in the weeds hacking our Postgres driver, and we wanted to share some fun learnings we’ve gathered so far.

Running a Raspberry Pi with a read-only root filesystem

Many applications that run on Raspberry Pis and similar single-board computers — for example, environmental data loggers that report to a central database server — don’t really need to store any state locally on the Pi’s SD card. This means you can run the Pi with a read-only root filesystem, which will dramatically increase the SD card’s lifetime. Also good discussion on Hacker News for alternative method

How does Linux nat a ping

Pretty much any home computers are behind a NAT, mean multiple computer share a same public ip. In the TCP/UDP packet, there is a port, the pair ip:port can be used to track which host and send the packet back. But ping operate with ICMP, and ICMP packet doesnt have a port field. So how does NAT work for ICMP packets?

Attacker Techniques: Gesture Jacking

When a website ask you to hold down a key, what can happen? What is User Gesture? How to defend.

File Monitoring with eBPF and Tetragon

Anytime you start to implement HIPAA, SOC, NIST PCE-DSS, the file integrity monitoring come up? who changed this file? when? what is changed? In this articule, we look into that with Tetragon. Not just for security, say you have a config file, such as an env file that is source before application run, tracking changes to this file can help spot and solve problem in an outage too.

finding memory leaks in Postgres C Code

What is the process of this? what tooling, what setup, what is a step by step guide in layman term.

Digital wallets and the “only Apple Pay does this” mythology

Apple Pay is great, but I think there is some misunderstanding out there about the details of how it works.

Memory leaks in Go

A useful article to go over commont leaks in Go, method to find them.

Code to read

charcoal

Faster utf8.Valid using multi-byte processing without SIMD. Up to 50% faster than the standard library. Can be a useful tool to deal with email parser for example where we want to filter out non utf8 character

Go

weron

Overlay networks based on WebRTC

Go

node-sql-parser

Parse simple SQL statements into an abstract syntax tree (AST) with the visited tableList and convert it back to SQL

JavaScript

node-telnet-client

A simple telnet client for Node.js

JavaScript

lorax

Multi-LoRA inference server that scales to 1000s of fine-tuned LLMs

PythonLLM

pgvecto

Scalable, Low-latency and Hybrid-enabled Vector Search in Postgres. Revolutionize Vector Search, not Database.

Rust

noticed

a gem that allows your application to send notifications of varying types, over various mediums, to various recipients. Be it a Slack notification to your own team when some internal event occurs or a notification to your user, sent as a text message, email, and real-time UI element in the browser, Noticed supports all of the above (at the same time)!

Ruby

Tools

pglite

Lightweight Postgres packaged as WASM into a TypeScript library for the browser, Node.js, Bun and Deno. Use case is you may run an interactive embeded postgres in browser for a playground postgres application.

tetragon

owerful real-time, eBPF-based Security Observability and Runtime Enforcement such as monitoring file changes, block operation to file etc.

monogon

A pure Go minimal operating system. Based on Linux and K8S. It runs on a fleet of bare metal or cloud machines and provides users with a hardened, production ready Kubernetes, without the overhead of traditional Linux distributions or configuration management systems.

Go

monolith

CLI tool for saving complete web pages as a single HTML file

retina

eBPF distributed networking observability tool for Kubernetes.

Atlassian Pragmatic drag and drop

a performance focused drag and drop library that can be used to power any drag and drop experience on any tech stack. Pragmatic drag and drop makes working with the browsers powerful and flexible built in drag and drop functionality safe and easy.

Self Hosted

quary.dev

a SQL engine and CLI tool that lets you manage your data transformation projects with ease. use Quary to transform their raw data tables into actionable and trustworthy insights. Teams do so by layering well documented and tested transformations into useful insights ready for consumptio

PixArt

Fast Training of Diffusion Transformer for Photorealistic Text-to-Image Synthesis

Cosmos Server

A bundle of many app into a single web ui provide you with: app store, vpn , auth server, reverse proxy server, cron job and more.

puter

an advanced open-source desktop environment in the browser, designed to be feature-rich, exceptionally fast, and highly extensible. It can be used to build remote desktop environments or serve as an interface for cloud storage services, remote servers, web hosting platforms, and more

That's it for this round, have a great day! If you like this newsletter, please tell the world or tweet about this!
You can view this issue in web browser.

If you have any suggestion/feedback, do tell me by replying to this email. I read them all.

No longer want to receive these emails? Unsubscribe

want to support my work? buy me a coffee

BetterDev #254 - Garbage Collection for Systems Programmers and How radio work

Better Dev #254 Apr 1, 2024

Code to read

Tools

Self Hosted

Older messages

BetterDev #253 - Fifty Things you can do with a Software Defined Radio

BetterDev #251 - Writing a Debugger From Scratch

BetterDev #250 - What's the toughest bug you ever found and fixed

BetterDev #249 - Running my own LLM

BetterDev #248 - Putting the “You” in CPU

You Might Also Like

Import AI 399: 1,000 samples to make a reasoning model; DeepSeek proliferation; Apple's self-driving car simulator

Defining Your Paranoia Level: Navigating Change Without the Overkill

5 ways AI can help with taxes 🪄

Recurring Automations + Secret Updates

The First Provable AI-Proof Game: Introducing Butterfly Wings 4

GCP Newsletter #437

Charted | The 1%'s Share of U.S. Wealth Over Time (1989-2024) 💰

The Great Social Media Diaspora & Tapestry is here

Daily Coding Problem: Problem #1689 [Medium]

📧 Stop Conflating CQRS and MediatR