Paul McCullagh

Absolutely blown away by all the positive feedback on the #Hardwood 1.0.0.Alpha1 release 🥳! Thanks a lot to all the comments, discussions on issues in the tracker, pull requests, stars on the repo! So cool to see that this parser for #ApacheParquet, optimized for minimal dependencies and great performance, seems to itch a scratch for folks. I got invited to present Hardwood on the Parquet community call where we'll explore opportunities for collaboration, and I'll hop on a few podcasts to talk about the project, too. For the 1.0 release, the key items we're planning to implement initial support for predicate push-down, reading files from S3, and a compatibility layer with parquet-java. And, of course, further performance improvements: just today, Rion Williams opened a PR which substantially cuts down allocation rates, thus reducing GC pressure and improving overall latency. Onwards 🚀!

63

1 Kommentar

Yesterday’s security training session with 🦾 Paweł Hordyński was all about users, permissions, and processes in Linux. Here’s what I learned: 🐧Root, sudo, and security: whoami, sudo -i, sudo su, sudoedi 🐧User management: adduser, passwd, usermod, groups, id 🐧Permissions and ownership: chmod, chown, chgrp (symbolic & numeric modes) 🐧Special permissions: SUID, SGID, sticky bit (/tmp, passwd examples) 🐧Working with processes: ps aux, top, htop, kill, killall, nice, jobs, fg, bg 🐧Understanding terminal sessions and subshells 🐧Hands-on: creating users, setting file permissions, killing a zombie process (intentionally created) Loving the deep dive into Linux internals 👨‍💻🐧 #Linux #SysAdmin #LearningInPublic #Permissions #Processes #DevLife #TechTraining

2

🧑‍💻 An "Approved” pull request doesn’t always mean compliant changes. If Bitbucket Cloud pull request rules matter for your team, read it here: https://lnkd.in/d3uamBvj Pull requests in Bitbucket Cloud are where decisions get made. But approvals alone don’t guarantee compliance without a systematic and automatic change control in place. How do you ensure in @Bitbucket Cloud that: 🔖 Commit messages follow standards? 🔗 #Jira work items are properly linked? 📝 Pull request titles and descriptions are meaningful? 🏷️ Branch names are traeceable to work items and reflect your workflows? We broke down for engineering managers and compliance leads what Bitbucket Cloud can enforce out of the box, where it falls short, and how to build automated guardrails for your team’s pull requests. 🛂 No more manual policing 🧐 No more missed links for audits ✅ Just clean, compliant, traceable merges If Bitbucket Cloud pull request rules matter for your team, read it here: https://lnkd.in/d3uamBvj 💭 Curious: What’s the ONE rule you wish every pull request in your org followed by default?

4

Not every app needs Kubernetes. At the next AWS Container Meetup in Zürich, Tobias Emil Vonesch (copebit AG) will show how Amazon ECS offers a simpler way to run small or single-purpose applications without giving up scalability or reliability. In his talk, “Small Apps, Big Effect: Fast and Reliable Deployments on AWS ECS,” Tobias explores how teams can deploy containers quickly and operate them efficiently using ECS — a service that’s powerful, lightweight, and easy to manage. It’s a session for developers and engineers who want to move fast, automate with confidence, and keep their architecture focused on outcomes — not overhead. As an AWS Community Builder and DevOps enthusiast, Tobias works at the intersection of engineering and enablement — helping teams turn cloud complexity into clear, repeatable solutions. 📅 18 November 2025 | Zürich 🔗 Register: https://zurl.co/AICNY We’re looking forward to seeing you there — to learn, connect, and build with the Containers on AWS community.

6

1 Kommentar

When a change of load balancer delivered a mysterious 502 error, DeepL engineer Philipp Hossner embarked on an investigation. In the latest post on our Tech Blog, he reveals what he discovered: an ambiguity in how load balancers treat :scheme headings, and the solution to fix it. Read Philipp's and DeepL’s troubleshooting journey here: https://lnkd.in/eHSZG4pj #DevTech #DeepLTechBlog #loadbalancers

20

When we switched monitoring platforms, we suddenly had 300 alerts we didn't have before. We could've suppressed most of them. They weren't all urgent. But that's exactly how monitoring dies — one reasonable exception at a time until nobody trusts the dashboard anymore. So we fixed them. All of them. Took a week. Now we have 6 alerts and every one of them means something. Worth a read if you manage any kind of monitoring estate: https://lnkd.in/dQuA-4Zu

1

So the first time I saw 'Diskless Kafka' advertised at a conference I was suspicious. My mind went straight to 'Serverless' Compute... which despite the name seemed to require a whole lot of servers. Yes, I know, just not ones you manage yourself. But still. Well I've finally dug into 'Diskless' Kafka and it's actually well named! The brokers genuinely offload storage to object stores like S3, which changes the economics and operational overhead pretty dramatically. This article by Abhay Soni lays out the basics clearly with a nice comparison chart to boot. What catches my eye: tiered storage isn't just a cost play. It fundamentally changes how you think about retention and replay. That's a big deal. Curious what others are seeing in the wild with tiered storage adoption?? https://lnkd.in/eXJUdmJF

34

3 Kommentare

Yet another week of shipping at Amp Code. Here is Thorsten Ball doing a short walkthrough of it all. • Review tool • Command palette! No more slash commands. • Amp can read other Amp threads. • Workspace Entitlements. • Public Profiles (quick, reserve your handle!). • Experimental subagent. Release the Kraken?

11

4 Kommentare

Check out this newly published Manifesto on Technical Debt! My wonderful colleagues Brigid O'Hearn and Ipek Ozkaya are part of a world-class group of researchers who came together to reframe the field of technical debt. The post below features a one-page summary, and you can click through to download the full report from Dagstuhl Perspectives Workshop 24452. DoD Acquisition friends, I'm curious: how do you measure/track technical debt in your software programs? Brigid O'Hearn Ipek Ozkaya William Nichols Rita Creel Christina Rhylander

7

One Prometheus to rule them all. Sounds efficient. In multi-tenant Kubernetes, it’s also a decision with consequences. In our latest blog post, our colleague Dominik Heilbock takes a deep look at what centralized monitoring really means when multiple tenants share the same Kubernetes infrastructure. Because Prometheus isn’t just another component. It defines visibility boundaries, RBAC exposure, and the blast radius of your observability stack. In this article, we explore: • What changes when Prometheus becomes shared infrastructure • Why namespace isolation doesn’t automatically protect metrics • Where cross-tenant visibility risks appear • How vCluster private nodes strengthen tenant separation If you operate multi-tenant Kubernetes platforms and treat observability as infrastructure, not as an afterthought, this discussion will resonate. 👉 Read the full article: link in the comments How are you structuring monitoring in your multi-tenant clusters today? #Kubernetes #Prometheus #MultiTenancy #PlatformEngineering #Observability #CloudNative #vCluster #LiquidReply

9

1 Kommentar

Something new kept me busy over the last weeks. Now you can read about it: - Closing the gap between TLA+ specifications and the implementations with interactive symbolic testing. The implementation gets inputs from the specification, and the specification gets the outputs back into the model checker's SMT context. Not a new idea, but it's the first time it works for TLA+. - Bootstrapping a test harness with Claude, including several Docker containers, a Docker network, C&C script to control the test clients in the containers and communicate with the SUT over UDP. - Generating sequence charts with Claude from the real logs that are produced by the harness. - Adding adversarial behavior to the clients in the TLA+ spec. - Testing several implementations of the TFTP network protocol as a case study, plenty of bugs in my TLA+ specification found, a few unexpected findings in the implementations. - A new lightweight API for Apalache, to script symbolic execution of TLA+ specs any way you want. I have to warn you. This is a long read. Next time you ask me how my specification relates to the actual code, I have the answer. https://lnkd.in/gKjXuEUG

48

3 Kommentare

We at Edera just published the write-up on TARmageddon (CVE-2025-62518) — a stream desynchronization bug in the Rust async-tar lineage including tokio-tar, astral-tokio-tar, and krata-tokio-tar. The root cause is a header interpretation flaw between PAX and USTAR entries. In the TAR format, a PAX header (type x) precedes the USTAR header for the same file, carrying extended metadata such as size=N. The vulnerable parsers correctly store the override but later advance the read head using the USTAR size field instead of the effective PAX one. When those disagree, especially when USTAR reports size=0, the parser skips zero bytes instead of N, leaving the cursor sitting at the start of the file payload. From that moment, the stream is out of phase. The next 512-byte block, which should have been file data, is treated as a header. If that payload happens to contain valid ASCII header bytes — and an attacker ensures it does — the parser interprets it as a new entry. By embedding a nested TAR in that payload, the inner headers get treated as top-level entries during extraction. The result is silent file injection or overwrite during unpack, using an archive that looks perfectly clean to every validator or SBOM scanner. The exploit is straightforward. A crafted archive defines a PAX header claiming size=N, a USTAR header claiming size=0, and then embeds a valid nested TAR in the data region. Alignment still holds because of 512-byte padding, so even low-level tar validators see nothing wrong. There’s no unsafe code and no memory corruption. It’s a pure logic failure — a parser state machine that drifted off its expected trajectory. Rust’s safety guarantees don’t cover that class of error. The fix is equally simple conceptually but disruptive across forks: always honor PAX overrides, reject inconsistent header pairs, enforce 512-byte boundary discipline, and fail closed on malformed metadata instead of skipping. The patched versions of astral-tokio-tar and krata-tokio-tar are available; tokio-tar remains unmaintained. Anyone unpacking untrusted TARs in CI systems, container build paths, or runtime extractors should audit dependencies immediately. This one is a good reminder that language safety is not protocol safety. Memory-safe code can still misparse a valid archive into doing something catastrophic. Full breakdown: https://lnkd.in/eABNCgPM Huge thanks to everyone who helped handle the disclosure and mitigation cleanly — Ann W., Alex Zenla, Kaylin Trychon, Marina Moore, and Steven Noonan for moving fast, keeping coordination tight, and avoiding what could have been a messy ecosystem incident.

39

1 Kommentar

If you have not tried DuckDB yet, you're missing out. It has been a vital part of my toolset for the last few years to analyze and transform huge amounts of data. It is mind-boggling how it keeps getting faster and more capable at such a rapid pace.

3

🎬 Recently watched "The Imitation Game" — the incredible story of Alan Turing and his team at Bletchley Park, who cracked the German Enigma code during WWII. 🔐 What was Enigma? The Germans used the Enigma machine to encrypt their communications. It relied on rotors, plugboards, and wiring, generating ~150 quintillion possible settings. Each day, the settings changed, making brute force impossible. Same machine, same settings: one typed → cipher text, the other reversed → plain text. 🔓 How did Turing crack it? Turing built the Bombe, an electromechanical device that: Leveraged predictable message patterns (“cribs” like Heil Hitler or weather reports). Simulated Enigma’s rotors at lightning speed. Eliminated wrong configurations logically until the daily key was found. ✅ Impact: This codebreaking (codenamed “Ultra”) gave the Allies access to German plans, shortened the war by ~2 years, and saved millions of lives. ⚡ Why it matters today Turing’s work wasn’t just about winning a war — it laid the foundation for modern cryptography and computing. Today, cryptography underpins everything: RSA / ECC for authentication AES for securing sensitive data PKI for digital trust Post-quantum algorithms for the future 💡 Takeaway: Yesterday, the challenge was to break codes. Today, the challenge is to build stronger ones. Cryptography is not just math — it’s the invisible shield of our digital age. 👉 Curious to know: what do you think will be the biggest breakthrough in cryptography over the next decade?

2