xz backdoor
A malicious backdoor was discovered in xz library that implements LZMA compression.
xz, among many other places, is used, indirectly, in sshd.
My attempt to explain what happened.
Dmitry Kudryavtsev
Senior Software Engineer / Tech Lead / Consultant
Hey, I’m Dmitry, a senior software engineer. I have more than 14 years of professional experience in web development, as well as some experience in low level and game development. Apart from writing code, I write two blogs (this one and Jiko Kaizen). I give occasional talks, and mentor about software engineering.
My favorite languages are TypeScript and Rust, and favorite technologies are NodeJS and Astro. This blog is a platform to share my knowledge and experience as well as write about Software Industry, Software Engineering, and Productivity.
On the interweb, I’m known as @skwee357.
Consider subscribing to my newsletter to stay updated when I publish new articles, as well as getting occasional curation of interesting news from the industry. Feel free to reach out to me or read more about me.
If you are interested in partnership, hiring me, or using my skills—please refer to my consulting page.
Follow me on one of the below social networks to stay in touch about my work and updates about this blog.
Latest Posts
The Curse of the Senior Software Engineer
#1 post (45.1K+ views)
While looking for a job recently, I stumbled upon an interesting phenomen that I consider to be a curse for senior software engineers.
Serving Astro with Rust
#3 post (8.9K+ views)
I wanted to turn one of my side projects into a statically generated website. But the backend was written in Rust. So I decided to combine them.
Rendering emails with Svelte
Join me on an adventure to build a superb email preview and rendering for MJML and handlebars using SvelteKit.
How to stay junior forever
A step by step guide for staying junior forever
The Bloat in Software Engineering
An evening rant about the unnecessary bloat in Software Engineering
I spent €200 on Google Ads so you won't have to
For the past month I was running a Google Ads campaign for the first time. In this article, I'll cover everything I learned by doing this.
Using AsciiDoc to write my two books
In the past six months, I wrote and self-published two books related to Software Engineering. Let me share with you the workflow and tools I used to do so.
6 lessons from building 6 projects, while nomading for 6 months
For the past 6 months, I've been nomading in Central America. During this time, I built 6 side projects. Here is everything I've learned from this incredible experience.
Web app localization. In Rust.
Doing localization is complicated. Many websites, even big ones, get it wrong. Let me share how I did it. In Rust of course.
Building a Web App in Rust
Featured post (5.6K+ views)
After more than 6 years of building web applications in NodeJS, I finally published one in Rust. Here is what I learned in the process.
Typescript Monorepo with NPM workspaces
Featured post (6.3K+ views)
During the development of my recent project, I decided to split some components to their own packages, and used npm workspaces for that.
On APIs and their responses
Since the dawn of the web, humans created CRUD APIs. And we were instructed that modification verbs should return the modified resource in response. But, should they?
On types and JavaScript drama
Earlier this week, the entire JavaScript community was in shambles over a controversial decision in a popular open-source project.
Own your content
For the past years, we've witnessed a rise of new type of social media platforms.
Platforms that compete for the ownership of your content.
And the attention of your consumers.
How to auto-generate OpenGraph images
OpenGraph metadata is an important part of your blog or website. It can affect whether users will open your website or not.
Why engineers should focus on writing
#2 post (30.4K+ views)
All engineers are good writers... of code. But I believe that in order to a become better engineer–you should improve your writing skills.
An Essay on Burnout
I denied burnout as a concept, until life decided to teach me the hard way. So here I am, burnt out. How did I get there?
The need for a more semantic web
The web has come a long way. From the early static pages, through the evolution of reactivity, and towards the biggest knowledge pool for all of humanity.
Inheritance, Composition, and everything in–between
There are many concepts in the OOP paradigm. Inheritance is the most known, and it allows us to model software as relations between objects.
How to get into programming in 2023
New year is a good time to create a resolution. What if your resolution is a career change to software engineering?
The missing ingredients from your monitoring alerts
There is one thing engineers hate the most—waking up at night and troubleshooting production incidents. What if I told you I know how to make it less painful?
Living side-by-side with an AI
2022 is, undoubtedly, the year of the AI. It started with DALL-E, then GitHub Copilot, and now—ChatGPT. AI is here to stay, whether you like it or not, and we ought to find a way to live with it.
Cursor based pagination
Traditional pagination existed for many years. But it’s not useful for platforms with huge amount of user generated content. Luckily, there is an alternative solution for such systems.
ChatGPT, AI, and the future of tech
Unless you’ve been living under a rock, you probably heard about OpenAI releasing ChatGPT for a free research preview.
How technology affects our day-to-day lives
During this time and age, we default to technological solution to every problem. Often times - without taking into considereation what effect those solutions might have on our day-to-day lives.
Why you should adopt Makefile in all of your projects
GNU Make. A software that is, most likely, older than you. It’s so simple, so standard, and so ignored. I’m here to provide a case in favor of make and Makefiles.
4 Ways to Minimize your Dependencies in Node.js
We all know the joke about how node_modules is the heaviest object in the universe.
Implementing Promisable setTimeout
setTimeout() is the most powerful execution control function. Sadly - it's not async. Lets turn it into one.
Legacy is where companies go to die
Legacy. The one word engineers cringe when they hear. Nobody wants to work with legacy code or legacy systems. And yet someone has to. Can we do something about it?
It's better to be (type)safe than sorry
Take a good look at the following function and try to understand what it's doing.
function do_magic(a, b) {
return a + b;
}
The Software Industry is Broken
The dire state of the software industry, leaves us with hopes for a better future. Why we ended up like this?
NodeJS Native Module vs WASM
In my previous post about [[supercharge-nodejs-with-rust|Native Rust Modules for NodeJS]], people asked me how neon bindings would compare to WASM. Let's check!
JetBrains Fleet Preview - First Impression
Last week JetBrains launched their new Fleet IDE and I've been lucky enough to get the Preview version. What do I think about it?
How to be a Great Technical Interviewer
The path to becoming a great technical interviewer is full of doubts, tough decisions, and self-discovery. But I believe every engineer should try to walk it.
Supercharge Your NodeJS With Rust
Node isn't the fastest framework out here. It's not the slowest either, v8 is doing wonders to its speed, but nevertheless, if we setup an unfair battle between Node and say Rust; Node will lose.
Wrap your gifts not your dependencies
We’ve all been there. Its time to introduce a new package / dependency to our code base, be it a HTTP request library, a logger or something else, and the question we ask ourselves “Should I wrap it?”
Context Switch - The only operation that kills productivity
In computing, a context switch is the process of storing the state of a process or of a thread, so that it can be restored and execution resumed from the same point later. This allows multiple processes to share a single CPU, and is an essential feature of a multitasking operating system.
— Wikipedia
React.JS Localization v0.2
In my last post I've discussed ReactJS localization. Now lets find the proper way to do localization.
Validating Requests With a Simple Middleware for Express
There are two aspects of good API design: (1) a control of what it accepts, and (2) taking a brief look will help you understand what it does.
The land of undocument react.js: The Context
A different approach for localizing react.js app
Using jquery/globalize to localize your React.js applications.