At Black Hat USA, security researcher Chris Domas told David Bombal that compilers can legally strip out security-critical operations like memory-clearing code, even when source code follows best practices. He demonstrated how subtle factors such as data size, register pressure and structure layout can determine whether an optimized binary is safe or exploitable, with some byte sizes producing secure code and nearby sizes producing vulnerable output.
A developer found that copying the login.keychain-db file from one Mac to another no longer works on macOS Tahoe when the destination Mac has a Secure Enclave chip. Previously, users could transfer this SQLite-based keychain file and unlock it on a new machine simply by entering the correct password, but that method now fails.
Martin Uecker details how GCC compiles nested functions that access variables from an enclosing function, explaining that such functions are lowered early in the middle-end. Variables referenced by the nested function are gathered into a single synthetic struct, with a pointer to that struct passed to the nested function instead of using older stack-frame-pointer techniques like those in Pascal.
A technical blog post by Martin Uecker examines how GCC compiles nested functions using trampolines placed on the stack, which normally require the stack to be executable. He shows that by extracting the code address and static chain values embedded in the trampoline and passing them to the __builtin_call_with_static_chain built-in, developers can indirectly call nested functions on older GCC versions without needing an executable stack.
The FlowG team is preparing its 1.0 release and identified a gap: no native integrations with the logging services of AWS, Google Cloud, and Azure, despite already supporting eight general-purpose forwarders. To build and test the AWS CloudWatch integration without incurring cloud costs or needing live accounts, they used floci, a local emulator launched via a single Docker command, which let them configure the AWS SDK to hit a local endpoint and verify log forwarding using standard CLI tools.
Walgit is a new open-source Git hosting server written in Rust that runs as one binary with no database or leader node, storing all repository data directly in an S3-compatible bucket or Google Cloud Storage. It supports smart HTTP fetch/push, Git LFS, bundle-uri clones, a web browsing UI, a JSON API with SDK, per-repo push policies and webhooks, letting repositories scale beyond the size of the host machine. Any number of servers can point at the same bucket and serve identical repositories without coordination, since the bucket itself is the source of truth.
GoKawiil