Visit research.swtch.com → RSS feedOn Hacker News Feb 2010 – Jan 2026
Software Engineering 32Open Source 11Programming Languages 9Tools & Productivity 8Systems & Performance 8Security & Privacy 7
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
For decades, discussion of software reuse was far more common than actual software reuse. Today, the situation is reversed: developers reuse software written by others every day, in the form of software dependencies, and the situation goes mostly unexamined.
More precisely, we need to add the concept of package versions to the working vocabulary of both Go developers and our tools, so that they can all be precise when talking to each other about exactly which program should be built, run, or analyzed. The go command needs to be able to tell developers exactly which…
How do software developers understand which parts of their software are being used and whether they are performing as expected? The modern answer is telemetry , which means software sending data to answer those questions back to a collection server. This post is about why I believe telemetry is important for…
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
This blog post is about how we added package versioning to Go, in the form of Go modules, and the reasons we made the choices we did. It is adapted and updated from a talk I gave at GopherCon Singapore in 2018 .
Last week, the proposal review committee accepted the “vgo approach” elaborated on this blog in February and then summarized as proposal #24301 . There has been some confusion about exactly what that means and what happens next.
A versioned Go command must decide which module versions to use in each build. I call this list of modules and versions for use in a given build the build list . For stable development, today’s build list must also be tomorrow’s build list. But then developers must also be allowed to change the build list: to upgrade…
I was a remote opening keynote speaker at ACM SCORED 2023 , which we decided meant that I sent a video to play and I was on Discord during the talk for attendees to text directly with question as the video played, and then we did some live but still remote Q&A after the talk.
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…