@buildbuddy, maintainer of @bazelbuild's iOS support, creator of @MobileNativeFdn. LLVM & Swift contributor. Previously Principal Engineer @Lyft, @modular
Wow, @llvmorg just passed half a million commits to the monorepo! Congratulations to all of the 3811 contributors so far!
If you love LLVM, consider star'ing the repo: https://t.co/GXyeKGXWvd
Wow that's right. This was a big day and Swift has come a long way in the intervening decade: Congrats to everyone who has driven it forward to support such an amazing tech platform! 🍎🐣
The linker is in a better position to inject malicious code into your system than xz/liblzma if compromised because it can do whatever it wants with the programs being linked. For example, replacing a specific function during linking openssh would be a pretty easy hack.
Therefore, it is important to use a trustworthy linker binary to build your program. But how do you build a trustworthy linker? If you use a malicious linker to link another linker, it can inject code into the new linker which in turn could do something malicious to other programs. This is the well-known chain of trust problem.
This is a real issue for us because we distribute mold binary packages on our GitHub release pages. Fortunately, we recently implemented a change in the script to create the binary packages so that the script is reproducible -- meaning that regardless of the environment it's run in, the script always creates bit-for-bit identical output for the same git commit.
With the reproducible build, you can independently verify that our binary distributions are actually built from the corresponding release of source files. You can also ensure that no third-party binaries are involved during the build.
Thanks to Docker and QEMU, it is pretty easy to write a reproducible build script these days. I'd strongly recommend doing the same if you are distributing binary tarballs. The script for the mold linker is available here: https://t.co/qeeCfmrcm7
The xz backdoor was initially caught by a software engineer at Microsoft. He noticed 500ms lag and thought something was suspicious.
This is the Silver Back Gorilla of nerds. The internet final boss.
👩💻 We're excited to announce that we've open sourced the Mojo 🔥standard library! 📚
Building Mojo🔥 in the open will lead to a better result and open sourcing the standard library is our next step in the journey.
🚀 We're also dropping MAX 24.2 today!
https://t.co/X2BdAGfynY
Have you ever hesitated to try out an API from Azure, AWS or Google Cloud because just the idea of needing to figure out how to get API credentials puts you off?
One solution for swift macros build times is if someone (ideally the swift-syntax repo) distributed the required prebuilt xcframeworks instead of requiring everyone built from source (bonus points if someone solves shipping a single framework with muiltiple swiftmodules)