Boyd Wilson

C/C++ is still improving, & ideally there will be a simplified subset with limited additions for memory safety etc., along with easy interop with legacy code: https://lnkd.in/exA-wi9m https://lnkd.in/e5YnTQk8 https://lnkd.in/eTvWiZ-C Why bother when there's Java, C#, Go, & Rust? While the first 3 are slower & have more bloated runtimes, Rust is similar in performance, but can also have a bloated runtime, and the language itself may not be very appealing to C/C++ developers. Additionally, the culture around Rust has been somewhat toxic, perhaps driven not just by egos (all sides) but due to the fact influencers are being paid to promote Rust, which can be detected by others as disingenuous, creating a conscious or even subconscious aversion to the language. With US Gov and BigTech pushing Rust, this can also rub some people the wrong way as a reduction of freedom of choice. I learned & used Rust on a fairly large commercial cybersecurity project, where Rust was a good fit for the product. While Rust was fun at first, as learning new things is part of the enjoyment of development, over time Rust compiler bugs, Cargo issues, very slow compilation times (large project), and the unfortunate insane complexity of the language in order to promote safety left me eager to get back to C++ for max performance projects. On a subsequent project with another company, a team member wanted to use Rust, & I shared my experiences, noting that while it was fast & stable as promised, & Cargo when it worked correctly was pretty cool, it wasn't the best choice for creative work, & some people are really going to hate it. This team went with Rust for this project, and sure enough, some loved it, some hated it. I've never seen this level of divisiveness before with any other language (there were similar events when Java, C# were promoted/pushed on devs by their respective corporations trying to expand marketshare, but not the level of hate directed toward the languages themselves as with Rust). Most human beings love freedom, & this may be part of the push-back on the Gov/BigTech to force Rust on everyone. For those who use & love Rust, all good. Others who don't like Rust can use Java/C#/Go (say 1.5-2.x slower with some GC spikes) along with small amounts of C/C++ for critical high performance elements, providing Rust level of performance, safety, & a much larger talent pool for developers vs. Rust, without the drama. I agree C/C++ is too large & complex, like Rust, though some of the complexity is optional in C++, & ideally the future Safe C++ will be simplified such that safety will be provided while the language looks as clean & simple as C# or simpler, with no loss in performance (possibly faster due to improved language design & modern language tech). Want to keep using C/C++? Politely & professionally, speak up, get involved, & help shape the future of tools.

2

1 Comment

I've updated the page for the Encyclopedia of Crash Dump Analysis Patterns, Third Edition, adding all available purchase options https://lnkd.in/gckWeNxe

5

PulseParse & EverCBOR Uses F* and Pulse to formalize several new standards for secure data formats and attestations, including CBOR, CDDL, and COSE, producing verified libraries and compilers. If you're building security-critical components in embedded systems, secure boot loaders, device attestation components, software bill of materials, etc.: Use our formally verified, high-performance code! The result includes * a detailed formalization of multiple RFCs, with mechanically checked proofs of correctness and security. * a library in verified C and in verified safe Rust for validating, parsing, and serializing CBOR objects * a verified compiler for CDDL specifications, yielding either verified C or verified safe Rust code, for parsing and serializing CBOR objects according to a CDDL schema * a verified implementation of COSE_Sign1, again in C or Rust, using verified cryptography from HACL* * and a verified implementation of DICE Protection Environment, using the CBOR profile Hat tip to Tahina Ramananandro, who drove this work! #fstarlang #pulse #rust #cbor #cddl #cose #everparse #sbom #dice #dpe https://lnkd.in/gkDzxjZt CBOR: https://cbor.io/ CDDL: https://lnkd.in/g8ydYzYa COSE:

54

2 Comments

KV-Cache Exploits and The Next AI Frontier: Academia is Building Defenses, While Industry Chases Performance and Cost 2025 is the year LLM serving grew up: vLLM, SGLang, and TensorRT-LLM turned “run the model” into a full-stack system problem. Disaggregated prefill vs. decode, FLOPs vs. bandwidth, and KV cache + scheduling policies became the centerpiece for user KPIs like throughput and tokens per $. As someone who’s spent a decade exploring the interplay of HW/SW, this sounds familiar: performance always came first, we love caching! But what about the hidden KPIs: security and privacy? The truth: a KV cache isn’t just an optimization buffer. It’s the working memory of prompts, and the closest thing to the “real intent" of users in the system.  When we introduced cross-tenant prefix sharing, cache-aware schedulers, or offloading, we created observable signals that leak what other users (or the system prompt) said. PROMPTPEEK[1] demonstrates prompt reconstruction by exploiting cache-aware scheduling and request completion times. “The Early Bird Catches the Leak” [2] shows timing side channels (e.g., TTFT diffs on cache hit vs. miss) that are used to infer system prompts and even other users’ prompts. InputSnatch [3] extends the idea to “input theft” by combining candidate construction with robust timing analysis under noise. It’s also showing in the wild: “Auditing Prompt Caching in Language Model APIs” [4] proposes audits that detect prompt caching and cache-sharing scope and evidence of cross-user/global sharing in *real* providers with latency silently becoming a privacy oracle. On the defense side, mitigations are still just papers and prototypes: per-tenant cache isolation (effective, expensive), selective sharing like SafeKV (share non-sensitive KV, isolate spans), timing obfuscation/constant-time strategies, and KV-cache protection schemes like KV-Cloak (for stronger “KV is exposed” threat models).[5-7] Call to action: if you start an LLM infrastructure company, treat KV cache as sensitive state, not a free performance lever. Productize what academia demonstrates: auditable caching policies, isolation tiers, privacy-aware cache managers, and security-first scheduling. The next generation of LLM winners won’t just ship the best tokens/$, but the best tokens/$ *with privacy guarantees*. [1] Wu et al. “I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving” 2 Song et al. “The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems” 3. Zheng et al. “InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks” 4. Gu et al. “Auditing Prompt Caching in Language Model APIs” 5. Chu et al. “Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference” 6. Luo et al. “Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference” 7. Yuan et al. “SCX: Stateless KV-Cache Encoding for Cloud-Scale Confidential Transformer Serving”

15

For all my former RTM customers, there his help on the way in MariaDB 12.3+. There are other ways to get around write/update heavy workload like performing ETL's using SELECT INTO OUTFILE and following up with LOAD DATA INFILE to get around replication locking, but it's good to know that more solutions are on the way.

6

Blind Insight is the only platform capable of training machine learning algorithms on large datasets with latency measured in seconds, not hours or days, on standard hardware.

17

4 Comments

If you're using Drupal in a business, you might want to chip in to ensure your own ability to continue using it in the very short term.

5

2 Comments

This week, Brandon Whichard, Michael Coté and Matt Ray discuss AWS re:Invent announcements, Agentic Development, and OpenAI's Code Red. Plus, a Digital ID field test and more on silverware sorting. https://lnkd.in/gRfeE5hy

5

#Automated #Fuzzing -- Automating OSS-Fuzz integrations using an agentic approach to build generation: https://lnkd.in/euzJMBbp Fuzzing a new target always means getting past the initial hurdle of building the target correctly, with sanitizers (even 3 different ones), coverage and so on, and doing fuzzing at scale needs solutions for this. In this blog post we show an LLM-based agentic approach that has many promising aspects for solving this! Check it out if you're doing fuzzing and even more so if fuzzing at scale. Naturally the build generation works in a pipeline with OSS-Fuzz-gen's fuzz harness generating capabilities, i.e. wrapping up the loop for full end-to-end OSS-Fuzz project integrations. There's still a lot of work needed, but at this point automated fuzzing is making waves and it's really exciting to follow along.

41

1 Comment

Raw telemetry can overwhelm more than it informs. That’s why organizations are leaning on PacketRanger to make SNMP and NetFlow practical, cost-effective, and compatible with modern monitoring tools. Three ways PacketRanger helps: 🔹 Filter Before You Forward – Keep dashboards meaningful and reduce data costs. 🔹 Translate for Compatibility – Convert SNMP traps into syslog for SIEMs and aggregators. 🔹 Spot Anomalies at the Source – Catch misconfigurations and outages in real time. When SNMP and NetFlow are implemented intentionally, they become powerful tools for clarity and control.

3

California is mandating an "Age Signal" for every OS by 2027 (AB 1043). 🛡️💻 For closed ecosystems like Apple or Microsoft, it’s a checkbox. For the open-source community, it’s a technical and legal crisis. We’re already seeing projects like MidnightBSD geofence the state rather than comply with a centralized identity mandate. In Episode 3 of Merlin with Merlin, I’m digging into the "Compliance Collision" hitting our kernels. We’re talking about why the "Analog Backbone" of the internet is under fire—and I have one question for the lawmakers: How do you put an age on "root"? Check out the full breakdown below. 👇 #Linux #CyberSecurity #IdentityManagement #AB1043 #OpenSource #TechLeadership #MerlinWithMerlin #OpenToWork

9