--- title: "A vulnerability in 'git clone'" publication: "StatusCode Weekly" issue: 307 published_at: "2021-03-10" canonical_url: "https://weekly.statuscode.com/issues/307" --- Plus Flutter 2, autopilot for Kubernetes, and why your GitHub just logged out. | #307 — March 10, 2021 [Web Version](https://weekly.statuscode.com/issues/307) StatusCode Weekly What's happening in software development, ops, platforms and tools. [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/enk599exyonerxf8mko9.jpg)](https://developers.googleblog.com/2021/03/announcing-flutter-2.html) [Announcing Flutter 2: Google's Dart-Based Cross Platform App Framework](https://developers.googleblog.com/2021/03/announcing-flutter-2.html) — [Flutter](https://flutter.dev/) is best associated with mobile app development but now lets you use the same codebase to ship native apps to five operating systems: iOS, Android, Windows, macOS, and Linux, as well as to the Web. No longer just for mobile, Google seems to be going all-in with it. Google [`git clone` Vulnerability Announced](https://github.blog/2021-03-09-git-clone-vulnerability-announced/) — It’s pretty rare you hear about a vulnerability in `git` itself. Upgrading is the best option here, but there are some simple mitigations you can apply even on older versions. There’s [more details on the issue here](https://www.openwall.com/lists/oss-security/2021/03/09/3) but basically _“Git could be fooled into running remote code during a clone”_ of malicious repos. Taylor Blau (GitHub) [![\](https://copm.s3.amazonaws.com/0f4741bf.png)](https://www.ardanlabs.com/training/?utm_source=Cooperpress%20PrimaryV4) [Remote Instructor-Led Go, Docker, Kubernetes, Terraform, & Python Training](https://www.ardanlabs.com/training/?utm_source=Cooperpress%20PrimaryV4) — We offer live-streaming remote training sessions for individual engineers and companies that want to augment their knowledge in Go, Docker, Kubernetes, Terraform, and Python. We’ve trained over 10,000 engineers via our carefully crafted classes. Ardan Labs sponsor [Netflix Explains Its _Cosmos_ Platform](https://netflixtechblog.com/the-netflix-cosmos-platform-35c14d9351ad) — A substantial writeup from Netflix on Cosmos, a platform that combines ideas from microservices, asynchronous workflows and serverless functions. It’s interesting to see their approach and the thought put into it here. Frank San Miguel (Netflix Engineering) [Citus 10 Released: Distributed 'Superpowers' for PostgreSQL](https://www.citusdata.com/blog/2021/03/05/citus-10-release-open-source-rebalancer-and-columnar-for-postgres/) — Citus is a long standing Postgres extension (open source but now broadly developed by a team at Microsoft) that makes Postgres more distributed and horizontally scalable. v10 introduces, most significantly, columnar storage support for Postgres as a way to reduce storage and improve the performance of analytical queries. Marco Slot (Microsoft) [Google Cloud Introduces GKE Autopilot](https://cloud.google.com/blog/products/containers-kubernetes/introducing-gke-autopilot) — _Autopilot_ is a new feature for Google’s managed Kubernetes service that aims to provide automated management of infrastructure or ‘true hands-free operations’ as they put it. While there are parallels with serverless ideas, I don’t really consider it such, but _they do_ by quoting a customer who says _“GKE Autopilot is the real serverless K8s platform that we’ve been waiting for.”_ So there you go. Google Cloud Blog Quick Bits - Did you notice your GitHub session dropped earlier this week? [GitHub invalidated all authenticated sessions](https://github.blog/2021-03-08-github-security-update-a-bug-related-to-handling-of-authenticated-sessions/) to mitigate against a vulnerability. - Is the [use of Google Analytics](https://trends.builtwith.com/analytics/Google-Analytics) declining? - If your last name is "True", [iCloud probably won't like it](https://twitter.com/RachelTrue/status/1365461618977476610). - Flutter (featured above) is now [the default choice for future Ubuntu apps](https://twitter.com/ubuntu/status/1367063203600031746). - Russia isn't happy with Twitter, but rather than block access to it, [they're slowing it down](https://www.reuters.com/article/us-russia-twitter/russia-slows-twitters-speed-over-failure-to-remove-banned-content-idUSKBN2B20ME). - The FreeBSD team are [talking about the state of FreeBSD](https://www.theregister.com/2021/03/10/the_state_of_freebsd/) as it approaches a big 13.0 release. - MIPS Technologies [has joined RISC-V](https://www.eejournal.com/article/wait-what-mips-becomes-risc-v/) and will be moving to the open source ISA standard. 💻 Jobs [Wanted: Curious Software Engineers with ❤](https://grnh.se/3052099d2us) — We’re a team of creative individuals dedicated to building brilliant products for innovative clients. Join Carbon Five for new projects, tech and challenges. Carbon Five [Find Software Engineering Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-webopsweekly%29&utm_content=5-minutes) — Take 5 minutes to build your free profile & start getting interviews for your next job. Companies on Hired are actively hiring right now. Hired 📘 Tutorials, Opinions and Stories [Dropbox's Journey from a Python Monolith to a Managed Platform with 'Atlas'](https://dropbox.tech/infrastructure/atlas--our-journey-from-a-python-monolith-to-a-managed-platform) — _Atlas_ is a platform built by Dropbox that lets them get the benefits of service oriented architecture (SOA) while minimizing the downsides. Naphat Sanguansin and Utsav Shah (Dropbox) [A Story of Bitsquatting Windows.com](https://remyhax.xyz/posts/bitsquatting-windows/) — Typosquatting is when someone buys a domain _similar to_ another one in the hopes a user will mistype the domain and end up at the wrong one instead. _Bitsquatting_ is somewhat more nuanced and is relying on memory errors instead. Remy Hax [Staying Out of TTL Hell](http://calpaterson.com/ttl-hell.html) — Cache strategies that don’t trade-off correctness for speed. Cal Peterson [Building a High-Scale Chat Server on Google Cloud Run](https://ahmet.im/blog/cloud-run-chat-server/) — This isn’t necessarily the _right_ tool for the job, but it’s interesting to think about what GCP’s serverless container compute service can handle. Ahmet Alp Balkan [Navigate Your Code Like It's 2021](https://web.eecs.utk.edu/~azh/blog/coderibbon.html) — A look at one developer’s ideas and experiments in improving tooling to make code navigation more efficient and productive. Austin Z. Henley [Save the Date. O11yfest Is Coming on May 17-18, 2021](https://o11yfest.org/?utm_campaign=statuscode&utm_source=cooper&utm_medium=Email) Lightstep sponsor ▶[How to Create Your First Netlify Serverless Function](https://www.youtube.com/watch?v=n_KASTN0gUE) — Netlify is an increasingly popular deployment and hosting platform and they let you deploy serverless functions (powered by AWS Lambda under the hood) in a particularly easy way, as demonstrated here. Ania Kubów [Developing with Rust on Windows](https://docs.microsoft.com/en-us/windows/dev-environment/rust/) — Microsoft is continuing to make big investments into the Rust space and this set of docs covers setting up a development environment and getting started using Rust to build Windows apps. Microsoft [What Happens Inside a 100-Hop IPv6 Wireless Mesh Network?](https://www.thingsquare.com/blog/articles/100-hops-ipv6-mesh/) — This is the “extreme ironing” of networking. Fredrik Rosendal [Ask HN: Can You Switch to a Programming Career Despite Nearing 40?](https://news.ycombinator.com/item?id=26383366) — In short, yes! Hacker News [Four Things You Didn’t Know You Could Do with GitHub Actions](https://github.blog/2021-03-04-4-things-you-didnt-know-you-could-do-with-github-actions/) Brian Douglas 🛠 Code and Tools supported by [![Okta\](https://res.cloudinary.com/cpress/image/upload/v1602154330/de7dtktheistsfpqdem4.png)](https://developer.okta.com/?utm_campaign=newsletter_cooperpress_all_multiple_inc_dev_sponsored-section_null&utm_source=cooperpress&utm_medium=cpc) [Serverless Stack (SST): Live Dev Environment for AWS Lambda](https://docs.serverless-stack.com/) — This is _very_ clever and if you’re a heavy AWS Lambda user you’ll want to check it out or at least [watch the example 30-second video.](https://www.youtube.com/watch?v=hnTSTm5n11g) In essence SST provides an environment where you can make changes to code live and stream real Lambda function invocations to this local code over WebSockets. [This Hacker News thread](https://news.ycombinator.com/item?id=26315585) provides more details from the creators. Anomaly Innovations [Google Cloud Memorystore: It's Managed `memcached`](https://cloud.google.com/blog/products/databases/memorystore-for-memcached-now-ga) — [memcached](https://memcached.org/) is a long standing memory object caching system that was originally created at LiveJournal(!) and Google Cloud Platform has its own managed memcached system called _Memorystore_ which is now generally available. Google Cloud [Optimize Images Within Your Existing Infrastructure with ImageKit.io](https://imagekit.io/blog/image-cdn-that-works-with-your-existing-infrastructure/?utm_source=Cooperpress&utm_medium=email&utm_campaign=StatusCode_newsletter&utm_content=Sponsoredlink_Optimizewithinexsistinginfrastructure) — Forget tedious integrations. Plug-in your S3 bucket & start delivering optimized images instantly in the next 10 mins. ImageKit.io sponsor [Google Cloud Products in Four Words or Less (2021 Edition)](https://cloud.google.com/blog/topics/developers-practitioners/back-popular-demand-google-cloud-products-4-words-or-less-2021-edition) — A fun cheat sheet with simple descriptions of the 100+ Google Cloud Platform services. Google Cloud [Inlets 3.0: Expose Your Local Endpoints to the Internet](https://github.com/inlets/inlets) — A ‘cloud native tunnel written in Go’ that combines a reverse proxy and WebSocket tunnels to expose local endpoints to the public Internet via an exit node. [v3.0.0](https://github.com/inlets/inlets/releases/tag/3.0.0) dropped recently. Alex Ellis [whereami: Uses WiFi Signals and ML to Predict Where You Are](https://github.com/kootenpv/whereami) — The idea is you ‘train’ the system from different locations (such as within your house or workplace) and then in future you can query (to a degree of confidence) where you currently are within the trained landscape. Pascal van Kooten [Lunatic: An Erlang-Inspired Runtime for WebAssembly](https://lunatic.solutions/) — I’m not sure about the name(!) but there’s a lot of activity around the WebAssembly runtime space (see [waSCC](https://wascc.dev/) or [Wasmer](https://wasmer.io/)) and it’s interesting to see Erlang’s ideas being brought into the mix. Lunatic, Inc. [The Most Expensive Version of Conway's Game of Life](https://github.com/nialloc/GameOfLife) — It’s the good old [Game of Life](https://en.wikipedia.org/wiki/Conway%27s_Game_of_Life) but in the most modern form imaginable.. running as a (rather expensive) smart contract on the Ethereum blockchain. nialloc [yacv: Yet Another Compiler Visualizer](https://ashutoshbsathe.github.io/yacv/) — A way to visualize parts of LL and LR parsers. Here’s a [visual demo on YouTube.](https://www.youtube.com/watch?v=BozB0O0__Qg) Written in Python. Ashutosh Sathe [RoadRunner 2.0: A High Performance PHP Application Server](https://roadrunner.dev/) — PHP, you say? This is a Go-based system that keeps PHP under control with a load balancer and process manager built in. [GitHub repo](https://github.com/spiral/roadrunner). SpiralScout 📭 **Got a new email?** You can [change your address here.](https://weekly.statuscode.com/edit_subscription/*|UID|*) --- **Bored of us?** [Click here to stop getting StatusCode Weekly.](https://weekly.statuscode.com/leave/*|UID|*) --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://weekly.statuscode.com/leave/*|UID|*)