DEV Community

Cover image for WeeklyReview#202636
Mathieu Kerjouan
Mathieu Kerjouan

Posted on

WeeklyReview#202636

#weekly #review #link #followup

Summer is over, after 2 months of hot weather in France, it's time to restart all the projects. Most of them have been slowed down, it's now a good time to do a quick list of my targets. Firstly, one target is to find an incubator for my future company. One of my idea is to leave France and go to Switzerland, the startup scene and the economy is way better than what we have in France right now, or move back to Denmark (like it would have been done 6 years ago, but cancelled due to the crisis), or take a one-way flight to Japan. The cultural change will be hardcore, and I would like to avoid that for now due to my poor level of Japanese.

Anyway, let have a first look at the incubators available in Switzerland, here a non-exhaustive list of incubators found on the web:

This list is far from complete, and some informations must be collected (e.g. mission/focus, eligibility, structure, time commitment, cost, terms, track record, reputation, network, contacts...). More VCs and incubators can be found on incubator list. Not sure if the database is complete though, but ~244 entities are listed in Switzerland. To check as well:

It's not even done. Creating a company in Switzerland is probably a bit different due to the cantons (small regions) where the taxes and rules are kinda different. Before looking on that point, perhaps reading few articles on that can help:

Another idea is to start the concept in France and then relocate it in Switzerland. I don't think it will be easy, but it will perhaps less risky. If the project does not work in France, it will probably not work in Switzerland.

Now, it's time to work (again) on the PoC and think a bit about the business plan/pitch. I think also looking for an incubator close to my current living place could also be a great choice if I can't go to Switzerland for some reasons.

This week was really dedicated to understand how the Dart file management was working. In fact, it started by a small example using CBOR (minimalist local data store), but it was hard to find something one the web about this part of Dart. So, writing a more complete article on this part of the language was kinda important.

Another article on Elixir/Phoenix should be ready for the next week.

Coding

📝 The Depths of JavaScript: Minesweeper in 247 Bytes: even if you don't like JavaScript (like me), you should recognize elite code when you see it. Coding a minesweeper in 247 bytes is cool.

🏗️ simslim project: Run a lot more iOS simulators on one Mac by turning off the background daemons a simulator doesn't need. A freshly booted iOS simulator starts around 180 background services: Siri, Spotlight indexing, photo analysis, News, wallpaper posters, iCloud sync, and so on. None of it matters when you're using the simulator for development, testing, or CI. simslim switches those services off, which cuts each simulator's memory roughly 4x. On the same laptop you go from a handful of simulators to a screenful.

🏛️ 6.851: Advanced Data Structures (Spring'21): a list of advanced data structures, the lectures are available for free.

📑 Open Data Structures: a book listing data structures in pseudocode, java and c++.

📖 The Art of EyeProlog - ISO Prolog with inspectable proof: a complete book about EyeProlog, from beginners to expert. The amount of exercises and examples is awesome (the answers are available as well).

🏗️ Jigsaw project: a proof of concept for a layout tiling library for Phoenix Liveview. It is inspired by BSP-style desktop tiling layouts such as Hyprland's Dwindle layout, but applies the same model to arbitrary Phoenix LiveView content.

📝 Everyone Says Assembly Is Untyped—Everyone Is Wrong: an article on Odin inline assembly feature design, and comparing it to other languages.

Memory Allocation Strategies - Part 1: a series of article on Memory Allocation, including garbage collector, automatic reference counting, and ownership semantics.

📝 C Is Not a Low-level Language: Your computer is not a fast PDP-11.: a post explaining why C is not a low-level language. C was created on PDP-11 and was mapping on some of its native instructions. It's interesting to see the hardware, especially the CPU, was designed also to run fast C code. I quote the last paragraph:

There is a common myth in software development that parallel programming is hard. This would come as a surprise to Alan Kay, who was able to teach an actor-model language to young children, with which they wrote working programs with more than 200 threads. It comes as a surprise to Erlang programmers, who commonly write programs with thousands of parallel components. It’s more accurate to say that parallel programming in a language with a C-like abstract machine is difficult, and given the prevalence of parallel hardware, from multicore CPUs to many-core GPUs, that’s just another way of saying that C doesn’t map to modern hardware very well.

▶️ ** The Best Programming Exercise Was the One I Hated the Most **: a video by The Palindrome, the post is also available on his blog. It talks about writing code on paper, and why it's important to do it.

📝 How to use Lua for flexible configurations in Erlang and Elixir: an example of Lua code running on the BEAM using luerl.

System

📝 Mount Mayhem at Netflix: Scaling Containers on Modern CPUs: I thought Netflix was massively using FreeBSD (probably on the network side), but it seems they are using Linux and Kubernetes as well. Anyway, in short: (1) disabling hyperthreading improves containers launch (avoid shared resources competition), (2) learn how your CPU is dealing with its cache, (3) run benchmarks to have metrics, evaluate the changes (see global-lock-bench project) and find the issue (here it's a global lock), (4) test newest kernels and update the application to use modern syscall.

📝 Multikernel Linux Tree Released: Runs Multiple Kernels On Bare Metal Without a Hypervisor: a way to run multi-linux kernel on one host. One kernel can have its own CPU, RAM and GPU. See also the announce from lklm.

🏗️ abuuda project: A fast fediverse server in Elixir and Phoenix that speaks Mastodon's protocols. Always at least 12x faster than Mastodon. Drop-in replacement for it. Based on the official website, way more faster than Mastodon.

🏗️ PawnIO project: PawnIO is a scriptable universal kernel driver, allowing hardware access to a wide variety of programs. It uses the Pawn scripting language and the PawnPP interpreter. When installed, any software implementing PawnIO modules can use the driver to access or control hardware supported by one of the official modules.

▶️ FreeBSD - using LLMs for fun and profit: a new series about FreeBSD. I hate the LLMs part, but who knows, perhaps someday people will stop using that and learning the old way will become cool again.

📝 Virtual Memory From First Principles: Virtual memory is a complex topic on computer science. This very long article goes very deep there, by listing all the features the virtual memory must accomplish. I like the way it's explaining, using a dialog between the kernel and the allocator. A must read. It also covers some part of virtual memory I did not know, like NUMA. I will try to re-read it soon, because it contains so many details...

Database

🏗️ dragonflydb project: a modern replacement for Redis and Memcached. Fully compatible with Redis and Memcached APIs, Dragonfly requires no code changes to adopt. Compared to legacy in-memory datastores, Dragonfly delivers 25X more throughput, higher cache hit rates with lower tail latency, and can run on up to 80% less resources for the same sized workload.

Security

🏗️ Ghidra project: a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux.

📝 I fight bots in my free time: after reading Anubis was easy to bypass in a tweet on X/twitter, I started to investigate a bit. Indeed, CVE-2026-62314 allowed an attacker with a crafted header to bypass the check and this bug has been fixed since. The 1.22.0 <= version < 1.26 are impacted by this issue and a workaround exists. CVE-2025-24369 is another issue where the check can be bypassed when asking a difficulty 0 challenge. At this time, 5 security issues are displayed on their Github Security Policy page. To me, Anubis seems to be a good open-source tool, but like all open-source software, using the latest version is sometime the best to do. More information about Anubis can be read on lwn.net or ycombinator.

📖 From Day Zero to Zero Day, A Hands-On Guide to Vulnerability Research: perhaps a good alternative to the marvelous the book of Erickson, Hacking The Art of Exploitation? Another book to read.

Security/cryptography

🏗️ ultralight-AES project: A minimal, readable implementation of AES-128 in ECB mode: the whole cipher, encrypt and decrypt, in about 85 lines of plain C. One file, no dependencies, no lookup tables pasted in from somewhere else.

📝 Is Argon2 actually better than Bcrypt?: Argon2 is better than Bcrypt. Bcrypt is a the older way to store password using a PBKDF. It's not even a surprise, Argon2 won its place in 2015, Argon2id is also specified in RFC 9106. On the other hand, bcrypt function has been firstly published in 1999, in a totally different environment (parallelism was hard, memory was costly, and not a lot of people got access to FPGAs/ASICs). I don't even know if bcrypt was specified somewhere, outside of the paper announcing it. In doubt, if you don't know what to choice, you can follow the OWASP rules:

Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1. For legacy systems using bcrypt, use a work factor of 10 or more and with a password limit of 72 bytes. [...] The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available.

Security/BlueTeam

📝 Building a Pocket Wi-Fi Threat Detector: an article about the Travel WiFi Canary project. Here the description from github: Monitors the 2.4 GHz WiFi environment and lights the RGB LED when it observes patterns associated with common wireless threats: evil-twin access points, deauthentication attacks, Pwnagotchi wardrivers, WiFi Pineapple hardware, security downgrades, and beacon floods.

📑 Influence of Logging Frameworks on Bind9: logs are the main bottleneck in an IPS pipeline. To fix that, they have created FIPS IPC. To check and test.

Security/RedTeam

🌐 AGNITracker: a tool to find subdomains. One can find more information by reading the documentation. Not sure if the following API will stay alive for a long period of time, but here one open end-point to do search for sub domains:

$ curl -qs "https://app.agniops.in/v1/search?domain=${domain}"
Enter fullscreen mode Exit fullscreen mode

📝 How I Bypassed Claude Opus’s CBRN-E Safeguards: the stories around LLMs jailbreaks amaze me every time. This is publication is explaining another process to bypass the protections on anthropic LLM.

🏗️ Awesome Large Language Models for Vulnerability Detection: A curated list of papers, projects, and agent skills on using LLMs for vulnerability detection and discovery.

🏗️ airgorah project: A WiFi security auditing software mainly based on aircrack-ng tools suite, and written in Rust.

🏗️ Erebus project: Erebus is a modern initial access wrapper aimed at decreasing the development to deployment time, when preparing for intrusion operations. Erebus comes with multiple techniques out of the box to craft complex chains, and assist in bypassing the toughest security measures.

📝 Bluetooth Hacking and Security: The WhisperPair Exploit and Bluehood Surveillance: an article showing how to use whiperpair exploit (android) and recover the connection key. It also introduces bluehood scanner.

Embedded

📝 Pogo Pin (ポゴピン) Probe: every single time I saw a post in Japanese talking about embedded systems or electronics, it proves Japanese hobbyists are different. Anyway, the idea here is to create a Pogo Pin-like cable ready for production. I did not understand everything though, my level of Japanese is not ready for that yet.

📝 Op-Amp Wonders: Circuit Secrets Revealed!: reminds me when I was in electronics. Painful souvenirs.

🏗️ cpu-fpga-board project: NEC PC-9800 C-Bus FPGA Board Design

📝 OpenTrailPaper transforms LILYGO T5 E-Paper S3 Pro devkit into a DIY e‑paper bike computer: e-paper devices are so great! Here a great example of what one can do with an ESP32 and one e-ink screen.

📝 How to Implement a Software-Based Debounce Algorithm for Button Inputs on a Microcontroller: a succinct article about debounce algorithm using arduino-like board, and you know what, they are also mentioning FSM.

Update/Upgrade

🔄 QSB-117: Intel CPU firmware vulnerabilities: many fixes regarding Intel CPU microcode

🔄 OpenSSL 4.0.2 Released with Important Security and Bug Fixes: [...] a heap buffer overflow in CMS key unwrapping (CVE-2026-63072), excessive memory use buffering DTLS records (CVE-2026-54874), and a client-side memory leak in OCSP response checking (CVE-2026-54876).

🔄 Erlang/OTP 29.0.6 released: many bugs fixes, including one CVE. CVE-2026-75538 can remotely crash an Erlang node using a crafted TCP packet

Mathematics

📑 The Algebra of Grand Unified Theories: just because.

📑 GAME THEORY, An open access textbook with 165 solved exercises: mathematical introduction to game theory.

Hardware

📝 Blink Codes and Beep Codes for Intel® NUC: I recently acquired few NUCs to have my own CI/CD building pipeline at home (we will talk about that later). I don't need crazy things, and while looking for refurbished ones, few of them are being sold as dead. Most of the computers have some visual or sound patterns to explain the problem. This link is listing few of them. I learnt it can be customized (Power Button LED and Ring LED Settings on Intel® NUC Kits). A more accurate document can be downloaded, containing a summary of all the codes available. I created a public gist to store those informations in case the document is removed in the future.

Misc

📝 Crafting “Crafting Interpreters”: author timeline and advice. One of the title section is a great summary: "Writing is suffering", this is how I feel when I start a new article or a book project (I never ended one of them). Anyway, great feedback. Must read.

🏗️ Plaintext editor: a simple text editor created and announced by JP Aumasson.

📑 0xPass: A Secure Protocol for Universal Cross-Chain Accounts: a description of the 0xPass platform.

📝 Canada revokes dozens of crypto firms’ registrations: Anti-money laundering authorities in Canada have revoked registrations of nearly three dozen cryptocurrency businesses [...] Many of these businesses specialize in converting cryptocurrency to physical cash. The Star story, part of ICIJ’s Coin Laundry investigation into dirty money in cryptocurrency, identified a single thoroughfare with 50 businesses advertising crypto services, most of which appeared to be operating unlawfully.

📑 Evaluating Large Language Models in Scientific Discovery

Without Root access right?

I am using OpenBSD. We Are Not the Same

JSON & TOON vs CBOR

Erlang with ETS and Mnesia

Erlang Punch Saitama

How to exit vim

difference between 0, null and undefined

Cover Image by Katie Moum on Unsplash

Top comments (0)