The Bytecode Alliance: Building a secure, composable future for WebAssembly
> We have a vision of a WebAssembly ecosystem that is secure by default, fixing cracks in today’s software foundations. And based on advances rapidly emerging in the WebAssembly community, we believe we can make this vision real.
> WebAssembly can provide the kind of isolation that makes it safe to run untrusted code. We can have an architecture that’s like Unix’s many small processes, or like containers and microservices. But this isolation is much lighter weight, and the communication between them isn’t much slower than a regular function call. This means you can use them to wrap a single WebAssembly module instance, or a small collection of module instances that want to share things like memory among themselves.
Project Silica proof of concept stores Warner Bros. ‘Superman’ movie on quartz glass
> It was the first proof of concept test for Project Silica, a Microsoft Research project that uses recent discoveries in ultrafast laser optics and artificial intelligence to store data in quartz glass. A laser encodes data in glass by creating layers of three-dimensional nanoscale gratings and deformations at various depths and angles. Machine learning algorithms read the data back by decoding images and patterns that are created as polarized light shines through the glass.
Boarding soon: the five-star airship bound for the North Pole
> To date, the Airlander 10 has done seven test flights. Now a Swedish company, OceanSky Cruises, is selling tickets for trips to the North Pole starting in 2023. It promises “a flying five-star hotel”, with polar bears and whales lingering below. The round-trip from Svalbard — including cocktail, dinner and breakfast on the airship, lunch in the snow, and another dinner and cocktail on board — takes 38 hours.
Only $79,000 if you book now!
Another article: https://www.bbc.com/future/article/20191107-how-airships-could-return-to-our-crowded-skies
Adopting the Arm Memory Tagging Extension in Android
> As part of our continuous commitment to improve the security of the Android ecosystem, we are partnering with Arm to design the memory tagging extension (MTE). Memory safety bugs, common in C and C++, remain one of the largest vulnerabilities in the Android platform and although there have been previous hardening efforts, memory safety bugs comprised more than half of the high priority security bugs in Android 9.
> We believe that memory tagging will detect the most common classes of memory safety bugs in the wild, helping vendors identify and fix them, discouraging malicious actors from exploiting them. During the past year, our team has been working to ensure readiness of the Android platform and application software for MTE. We have deployed HWASAN, a software implementation of the memory tagging concept, to test our entire platform and a few select apps. This deployment has uncovered close to 100 memory safety bugs. The majority of these bugs were detected on HWASAN enabled phones in everyday use. MTE will greatly improve upon this in terms of overhead, ease of deployment, and scale. In parallel, we have been working on supporting MTE in the LLVM compiler toolchain and in the Linux kernel. The Android platform support for MTE will be complete by the time of silicon availability.
How to wring power from the night air
> Solar power is all very well, but it is available only during daylight hours. If something similarly environmentally friendly could be drawn on during the hours of darkness, that would be a great convenience. Colin Price, an atmospheric scientist at Tel Aviv University, in Israel, wonders if he might have stumbled across such a thing. As he told a meeting of the International Union of Geodesy and Geophysics, held in Montreal in July, it may be possible to extract electricity directly from damp air—specifically, from air of the sort of dampness (above 60% relative humidity) found after sundown, as the atmosphere cools and its ability to hold water vapour diminishes.
AMD Zen 2 Microarchitecture Analysis: Ryzen 3000 and EPYC Rome
> We have been teased with AMD’s next generation processor products for over a year. The new chiplet design has been heralded as a significant breakthrough in driving performance and scalability, especially as it becomes increasingly difficult to create large silicon with high frequencies on smaller and smaller process nodes. AMD is expected to deploy its chiplet paradigm across its processor line, through Ryzen and EPYC, with those chiplets each having eight next-generation Zen 2 cores. Today AMD went into more detail about the Zen 2 core, providing justification for the +15% clock-for-clock performance increase over the previous generation that the company presented at Computex last week.
How does Apple (privately) find your offline devices?
> A big caveat: much of this could be totally wrong. I’ll update it relentlessly when Apple tells us more.
> Since this is a security system, the first question you should ask is: who’s the bad guy? The answer in this setting is unfortunate: everyone is potentially a bad guy. That’s what makes this problem so exciting.
The Mueller report: How long can cable news talk about a document it doesn’t have?
> And that’s why — as the Erik Wemple Blog was finishing this post — all the channels were still going strong as they worked toward three hours of gabby analysis, “breaking news” bits and speculation. On CNN, legal analyst Joey Jackson was talking about President Trump’s protection from indictment. On MSNBC, Melber was talking to Sen. Richard Blumenthal (D-Conn.) about releasing the report. On Fox News the great Chris Wallace was saying, “We’re all tired of this investigation. . . . I think the country at large has been suffering Mueller fatigue, investigation fatigue.” It’s also known as cable-news fatigue.
IoT Security Bills Use Federal Spending as Leverage
> The bill includes a number of separate provisions, but the one that stands to have the biggest potential effect on IoT security is the establishment of a set of standards for security in connected devices, standards that will be developed by the National Institute of Standards and Technology. The draft legislation doesn’t set out too many specifics for what those security standards would be, but dictates they will include four separate areas: secure development, identity management, patching, and configuration management. Under the language in the bill, vendors selling IoT devices to federal agencies will have to meet the NIST standards for those areas.
A proposed API for full-memory encryption
> Hardware memory encryption is, or will soon be, available on multiple generic CPUs. In its absence, data is stored — and passes between the memory chips and the processor — in the clear. Attackers may be able to access it by using hardware probes or by directly accessing the chips, which is especially problematic with persistent memory. One new memory-encryption offering is Intel’s Multi-Key Total Memory Encryption (MKTME) [PDF]; AMD’s equivalent is called Secure Encrypted Virtualization (SEV). The implementation of support for this feature is in progress for the Linux kernel. Recently, Alison Schofield proposed a user-space API for MKTME, provoking a long discussion on how memory encryption should be exposed to the user, if at all.
CES 2019: A Show Report
> On display this year was connectivity and integration for consumers based on about 10 years of incremental and sometimes hardly noticed baby steps. There are three big developments that are enabling the vast majority of scenarios on display at CES 2019:
> Any screen/speaker can play any streaming media.
> Any device can be turned on/off/controlled by voice.
> Any device can have a radio and connect to any other device with a radio.
Fun times ahead.
Lots of pictures.
Using molten salt to store electricity isn’t just for solar thermal plants
> Malta’s business pitch is that its thermal pumped storage system can be located anywhere (unlike hydroelectric pumped storage, which requires elevation changes, or compressed air energy storage, which has been primarily deployed near natural underground caverns). It can be expanded easily, and unlike chemical batteries, such a system is made of common and cheap industrial materials that have 20-year lifespans.
> CECPQ1 was the experiment in post-quantum confidentiality that my colleague, Matt Braithwaite, and I ran in 2016. It’s about time for CECPQ2.
> CECPQ2 will be moving slowly: It depends on TLS 1.3 and, as mentioned, 1.3 is taking a while. The larger messages may take some time to deploy if we hit middlebox- or server-compatibility issues. Also the messages are currently too large to include in QUIC. But working though these problems now is a lot of the reason for doing CECPQ2—to ensure that post-quantum TLS remains feasible.
Here Comes ‘Smart Dust,’ the Tiny Computers That Pull Power from the Air
> The idea of a perpetual machine—one that, once set in motion, never stops—is preposterous. The energy it needs must come from somewhere. But a twist on the idea, where energy is sponged from the environment to power ultra-efficient devices, isn’t a fantasy. Some people even call it perpetual computing.
The Deepness in the Sky is nigh.
The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies
Go 2 Draft Designs
> As part of the Go 2 design process, we’ve published these draft designs to start community discussions about three topics: generics, error handling, and error value semantics.
Go & Versioning
> We need to add package versioning to Go. More precisely, we need to add the concept of package versions to the working vocabulary of both Go developers and our tools, so that they can all be precise when talking to each other about exactly which program should be built, run, or analyzed. The go command needs to be able to tell developers exactly which versions of which packages are in a particular build, and vice versa.
Compulab Passively-Cooled Airtop2 Inferno with GeForce GTX 1080
Maybe, maybe not, but it seems there’s still room for improvement and innovation with motionless convection cooling systems.
Quantum computing in the NISQ era and beyond
> “Intermediate scale” refers to computers with between 50 and a few hundred qubits. The 50 qubit milestone is significant because that takes us beyond what we can simulate by brute force using the most powerful existing supercomputers. “Noisy” emphasises that we’ll have imperfect control over those qubits. Because of the noise, we expect a limit of about 1000 gates in a circuit – i.e., 1000 fundamental two-qubit operations. Executing a single gate is about 1000 times slower on an ion trap quantum processor than on a superconducting circuit.
Regarding the near future potential of quantum computers.
For a look at the past, Shor’s Algorithm: https://blog.acolyer.org/2018/02/02/polynomial-time-algorithms-for-prime-factorization-and-discrete-logarithms-on-a-quantum-computer/
A vision for portability in Rust
> TL;DR: This post proposes to deprecate the std facade, instead having a unified std that uses target- and capability-based cfgs to control API availability.