Keyan Zhang keyz

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Originally posted at community/community#9632 (comment)

Omg yes, please! This is one of my biggest pet peeves/code review slowdowns when performing large refactors to cleanup a legacy codebase.

The following were some manual review notes/commands I added to a recent PR to assist others who were reviewing:

The following git diff command will make it easier to see what actually changed in the code here, as opposed to what just moved around without being changed; to make review/etc easier. Dimmed code in the diff has been moved, but not changed.

I heard some points of criticism to how React deals with reactivity and it's focus on "purity". It's interesting because there are really two approaches evolving. There's a mutable + change tracking approach and there's an immutability + referential equality testing approach. It's difficult to mix and match them when you build new features on top. So that's why React has been pushing a bit harder on immutability lately to be able to build on top of it. Both have various tradeoffs but others are doing good research in other areas, so we've decided to focus on this direction and see where it leads us.

I did want to address a few points that I didn't see get enough consideration around the tradeoffs. So here's a small brain dump.

"Compiled output results in smaller apps" - E.g. Svelte apps start smaller but the compiler output is 3-4x larger per component than the equivalent VDOM approach. This is mostly due to the code that is usually shared in the VDOM "VM" needs to be inlined into each component. The tr

The MIT License (MIT)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

This API was removed in React 17

Interaction tracing with React

React recently introduced an experimental profiler API. After discussing this API with several teams at Facebook, one common piece of feedback was that the performance information would be more useful if it could be associated with the events that caused the application to render (e.g. button click, XHR response). Tracing these events (or "interactions") would enable more powerful tooling to be built around the timing information, capable of answering questions like "What caused this really slow commit?" or "How long does it typically take for this interaction to update the DOM?".

With version 16.4.3, React added experimental support for this tracing by way of a new NPM package, scheduler. However the public API for this package is not yet finalized and will likely change with upcoming minor releases, so it should be used with caution.

	let overrideCatalystScaleFactor: Void = {
	guard let sceneViewClass = NSClassFromString("UINSSceneView") as? NSObject.Type else {
	return
	}
	if sceneViewClass.instancesRespond(to: NSSelectorFromString("scaleFactor")) {
	// old
	swizzleInstanceMethod(
	class: sceneViewClass,
	originalSelector: NSSelectorFromString("scaleFactor"),
	swizzledSelector: #selector(swizzle_scaleFactor)

	import {
	Project,
	Type,
	Symbol,
	SymbolFlags,
	Signature,
	Node,
	TypeFormatFlags,
	} from 'ts-morph';

	/**
	* Returns the URL of a hyperlinked cell, if it's entered with hyperlink command.
	* Supports ranges
	* @param {A1} reference Cell reference
	* @customfunction
	*/
	function linkURL(reference) {
	var sheet = SpreadsheetApp.getActiveSheet();
	var formula = SpreadsheetApp.getActiveRange().getFormula();
	var args = formula.match(/=\w+\((.*)\)/i);

	import UIKit

	class ViewController: UIViewController {

	enum Section {
	case main
	}

	struct Item: Hashable {
	let height: CGFloat