Less than 1% of vulnerabilities discovered contributed to highest risk / Microsoft adds the ability to visualize the memory layout of C++ classes, structs, and unions

Plus, CNCF promotes OpenFeature project to incubation phase

Inside Dev For December 27, 2023

Here's a look at today's Dev briefing. Less than 1% of vulnerabilities discovered in 2023 were categorized as critical, according to Qualys report.  Microsoft added a new capability in Visual Studio 17.9.  CNCF promoted the OpenFeature project to the incubation phase.  Thank you.  Sudarshan p/sudarshan

1 The 2023 Threat Landscape Year in Review report published by Qualys Inc. revealed that a total of 26,447 vulnerabilities were reported in 2023. The report provides insights on the top vulnerability types, top MITRE ATT&CK tactics and techniques, most active threats, etc. More: Among the vulnerabilities disclosed this year, less than 1% (206) were considered critical vulnerabilities with a weaponized exploit. These high-risk vulnerabilities were used by ransomware, threat actors, and malware or had confirmed evidence of exploitation in the wild. The meantime actors took to exploit vulnerabilities this year was 44 days, while 25% of the high-risk vulnerabilities were exploited on the day of publication. Of the 206 high-risk vulnerabilities, 115 were exploited by named threat actors, 20 by ransomware, and 15 by malware and botnets.

2 Microsoft announced the addition of the Memory Layout view to visualize the memory layout of C++ classes, structs, and unions in Visual Studio 2022 version 17.9 Preview 1. In the previous version (17.8), Microsoft introduced a new feature that allowed C++ developers to view the resize and alignment of classes, structs, unions, base types, or Enums. More: The visualization tools provide C++ developers with valuable insights into the memory occupancy of data structures and their alignment in memory. Previously, developers had to write additional code or use the /d1 MSVC compiler switches to calculate the size and alignment for each element. Developers can access the Memory Layout visualization by hovering over type names in declarations or definitions to gather insights into individual data members' offsets and sizes. Microsoft believes the feature will improve code efficiency and comprehension for C++ developers and make it easier to work with memory management and data structures.

3 In a recently published article, DevClass highlighted a re:Invent presentation demonstrating the effective combination of Rust and serverless computing. Efi Merdler-Kravitz, head of engineering at CloudEx, showcased potential cost savings from the combination compared to Python. More: During the presentation, Merdler-Kravitz emphasized that Lambda functions with big runtimes, which leads to slower cold starts and higher memory requirements. Rewriting an entire Lambda function from Python to Rust might not be necessary. Instead, developers could leverage PyO3 to replace Python code with Rust. The approach presented by Merdler-Kravitz demonstrated a three times faster cold start and lower memory requirements, especially when operating with limited memory, like 256MB. An experimental Rust runtime is available for AWS Lamda to simplify running functions in Rust, and a related project called Cargo Lamda supports local development and testing with the Lamda emulator.

4 The Cloud Native Computing Foundation promoted the OpenFeature project to incubation status. The open-source specification offers developers a vendor-agnostic, community-driven API for feature flagging. More: The standardization of feature flags through OpenFeature offers unified tools and vendors to avoid vendor lock-in at the code level and provide a framework for building extensions and integrations. The open-source API contains SDKs for languages such as .NET, Java, PHP, Python, JavaScript, Go, and Ruby, servers and client providers for various languages, and FlagD, a feature flag daemon that enhances the OpenFeature ecosystem. OpenFeature is supported by vendors, including LaunchDarkly, Split, CloudBees, and Flagsmith. It claims to have experienced a 700% increase in repository stars, a 350% increase in forks, and a 627% increase in Slack channel members.

5 New Tools and Updates: WebKit announced WebGPU is now available for testing in Safari Technology Preview 185. Developers can enable WebGPU by turning on GPU Process: DOM Rendering and GPU Process: Canvas Rendering feature flags in the Feature Flags tab in Safari Preferences. WebKit also added new CSS, HTML, Web API, and Web Inspector features. GitHub has collaborated with Canva to scan its repositories for Canva tokens and detect and flag potential vulnerabilities in public repositories. GitHub will forward exposed tokens to Canva for rotation and user notification. Also, GitHub said GitHub Codespaces would promote the current beta host image configuration to stable on Jan. 16 as part of regular maintenance for hosts. QEMU version 8.2.0 includes new virtio-sound device emulation, hv-balloon for dynamic memory protocol device for Hyper-V guests, new Universal Flash Storage device emulation, and more.

6 📚 Tutorials: This tutorial discusses the need for the View Transitions API and its basic usage. Learn how to create a React native Christmas app UI. Here are nine best practices to write faster SQL queries. Find out how to use the Observation framework to handle data flow in iOS apps.

7 Quick Hits: Raising capital in 2024? Foundersuite is your secret weapon. Build a target list with our DB of 216,000+ investors, manage the raise with our CRM, run due dil with our data room.* Apple revised its Apple Developer Program License Agreement to support new policy changes. Microsoft is inviting papers for the Azure Cosmos DB Conf 2024 scheduled on April 16.  Frec Direct Indexing lets you achieve index-like performance but end up with more money through tax loss harvesting. See what the hype is all about.* *This is a sponsored listing.

Upcoming Events JAN 30 Join TruEra for an expert discussion about the impact of the EU AI Act on US and Canadian firms Virtual Register here * This is a sponsored event

Sudarshan Gopalakrishnan Analyst Sudarshan lives in Toronto, Canada, and is an engineering graduate. He is passionate about business, tech, entrepreneurship, and politics. FUN FACT: Sudarshan worked for the election campaign teams of two heads of state in India. When he is not busy with work, he enjoys hiking, playing cricket, and cooking. This newsletter was edited by Aaron Crutchfield

Discover more on inside.com/dev Thanks for reading today's issue of Inside Dev. Explore Explore

Share Email Share on X Open in Browser Open in Browser Open in Browser

Did someone forward this email to you? Get your free subscription here. Interested in sponsoring this newsletter? Connect with our sales team here. You received this email because you are subscribed to Inside Dev. Manage your subscription or unsubscribe here. 767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2023 Inside.com