Cisco

Coins Bench

DevOps.com

ElixirStatus

Fatbobman

Hacker News

<h2>Must know</h2>
<ul>
<li><strong>Netflix solves container startup scaling bottlenecks</strong>: Netflix engineers identified severe startup latency after migrating to containerd with User Namespace isolation, caused by O(n) idmap mounts creating kernel lock contention. They developed a fix using Linux 6.3’s recursive bind mount (rbind) support to reduce operations to O(1), which has been merged into containerd v2.2.0. For older AWS r5.metal instances struggling with mesh CPU cache contention, they implemented hardware-level rerouting to mitigate the impact. <a href="https://app.daily.dev/posts/1EzpXbPep" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Critical auth bypass in Lightning Network Rust SDK</strong>: A CVSS 9.8 vulnerability was discovered in a remote signing SDK where a validation struct unconditionally returned true for webhook requests, bypassing HMAC verification. This flaw allowed attackers to forge commitment transactions and drain Lightning channels using unsigned requests. The fix, documented by the discovering researcher, requires implementing constant-time HMAC-SHA256 verification to prevent timing attacks and forged signatures. <a href="https://app.daily.dev/posts/6ds4DlYj9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux MGLRU patches deliver massive storage throughput gains</strong>: Tencent engineer Kairui Song submitted eight patches to the Linux kernel mailing list targeting the Multi-Gen LRU reclaim loop and dirty folio handling. Benchmarks show up to a 30% throughput increase for MongoDB on NVMe and over 100% gains for workloads on slower HDD storage. Beyond performance, the updates reduce code complexity and significantly decrease unexpected Out-Of-Memory events in production environments. <a href="https://app.daily.dev/posts/vkiJLGz9l" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Firefox 148 ships the Sanitizer API to block XSS natively</strong>: Mozilla’s latest release is the first to implement this web security standard, alongside a new Split View mode and a built-in 50GB free VPN. <a href="https://app.daily.dev/posts/nPBbJz5BW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite 8 migrates to Rolldown for 30x faster builds</strong>: The new version leverages the Rust-based bundler to significantly optimize frontend build performance and developer experience. <a href="https://app.daily.dev/posts/db4oA9qt6" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Devise v5.0.3 fixes email confirmation race condition</strong>: A vulnerability in the Confirmable module allowed attackers to confirm victim emails via concurrent requests; users should update or apply the manual override fix. <a href="https://app.daily.dev/posts/xUUVN4M4D" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Atomic scale imaging reveals semiconductor mouse bite defects</strong>: Cornell and TSMC researchers used electron ptychography to directly image roughness in transistor channels only 15 atoms wide. <a href="https://app.daily.dev/posts/uIm3A2zJl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Manjaro Linux team strikes over governance failures</strong>: Nineteen core members are demanding the project transition to a German nonprofit (e.V.) to escape the project lead’s personal control or face a fork. <a href="https://app.daily.dev/posts/3NkkvAFQd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WCPU 1 custom 8 bit CPU hits 1MHz on physical hardware</strong>: The Turing-complete project successfully moved from Logisim simulation to PCB, resolving real-world issues like floating address lines and RAM write glitches. <a href="https://app.daily.dev/posts/uS6vSlBQv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi ESC adds immutable configuration via final function</strong>: The new <code>fn::final</code> built-in allows platform teams to mark specific environment variables as unchangeable by child environments. <a href="https://app.daily.dev/posts/4mtaGLOgG" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The crypto exchange goodwill bounty insult</strong>: A researcher found a complete CSRF bypass on a major exchange’s Django admin panel because they only checked token length, not the actual key. The exchange called it ‘out of scope’ and tossed a $50 ‘goodwill’ bone despite the researcher proving they could hit any POST endpoint. It’s a classic case of a bug bounty program being used as a legal shield to avoid paying for critical security failures. <a href="https://app.daily.dev/posts/HINAKTgoX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Biological computers and the 10 year general purpose pipe dream</strong>: Final Spark is out here claiming their ‘biocomputers’ made of living neurons are a million times more efficient than your puny silicon. They’ve got 10,000 neurons on electrodes that die in three months, yet they’re promising a general-purpose biocomputer in a decade. It’s a bold roadmap for a technology that currently struggles with the ‘experimental variability’ of its hardware literally having a mind of its own. <a href="https://app.daily.dev/posts/2gDDVTHFD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The senior engineer interview narrative trap</strong>: Apparently, you aren’t failing interviews because you can’t code; you’re failing because your ‘narrative style’ is too mid-level. Career coaches are now pushing ‘story banks’ of 8 reusable tales to pivot every technical question into a leadership masterclass. It’s a great way to ensure the industry continues to hire the best storytellers instead of the best systems architects. <a href="https://app.daily.dev/feed-by-ids?id=9lbzULP9D&amp;id=D91jv8zbd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
