Wochennotiz 2025.15

Posted on So 13 April 2025 in Blog

Die Woche hat einen lesenswerten Beitrag zum Umgang mit Open Source in der mexikanischen Verwaltung gebracht. Der Beitrag zeigt einerseits welche Möglichkeiten Verwaltungen haben und andererseits auch mit welchen Mitteln die kommerziellen Anbieter arbeiten. Und auch wie wichtig die Bildung und Schulung der Menschen ist. Kommerzielle Anbieter ködern schon die Schüler:innen mit kostenlosen Lizenzen. Eine Praxis, die man sich als Staat nicht leisten sollte.

Sonst kann man über die Woche sagen, dass Microsoft Microsoft-Dinge macht und bei Oracle nur zwei "obsolete" Server gehackt worden sind.

Ich habe mich die letzten Tage mit einem seltsamen pgbouncer-Problem herumgeschlagen. Aber zumindest eine (temporäre) Lösung gefunden.

Inhalt:

Postgres und die Datenwelt

Kleinere Container

Jeremy Schneider beschreibt sehr detailliert in einem Blogbeitrag, warum das (minimale) Container-Image von Postgres 18 um 34 % kleiner ist als das von Postgres 17. Sehr schön erklärt er auch die Gründe, warum es gut ist, wenn ein Container-Image mit möglichst wenig Abhängigkeiten kommt:

Generally speaking, the size of docker containers can vary widely. Minimizing dependencies and reducing container size has many benefits: less stuff to patch and update over time, fewer things that can get CVEs, fewer unnecessary utilities that can be leveraged by attackers, faster build times, less disk space usage, reduced network consumption and faster startup times in environments where containers are often migrated and rescheduled across fleets (moving to new hardware where those containers had never previously run, and thus images need to be downloaded).

Waiting for Postgres 18 – Docker Containers 34% Smaller

Postgres und AI

Hans-Jürgen Schönig hat in seinem Beitrag pgai: Importing Wikipedia into PostgreSQL die Postgres-Erweiterung pgai unter die Lupe genommen. Für die Arbeit mit AI ist natürlich ein passender Datensatz ganz praktisch. Das scheint man bei pgai auch bedacht zu haben:

Luckily, it also contains an easy way to load Wikipedia into the database.

Aus einer Idee wird ein Patch für Postgres

Abhishek schreibt in seinem Beitrag Postgres Protocol and a Side Quest wie aus einer Idee ein Patch geworden ist.

Now, wireshark supports decoding TLS connections using a key log file. Looking through documentation I realized that there is no way for a client to log the TLS keys using psql. So the natural next step was to add that support and try to get that accepted upstream in postgres.

Der Patch ermöglicht es nun psql einen zusätzlichen Parameter zu übergeben und damit die encryption secrets in einer Datei zu speichern. Das kann man dann verwenden, um mittels Wireshark verschlüsselte Verbindungen genauer zu untersuchen.

Postgres Release Monitor

Security und Privacy

Oracle Breach

Das Thema Oracle wurde schon vor zwei Wochen und auch letzte Woche behandelt. Aber auch diese Woche gibt es darüber etwas zu berichten. Sergiu Gatlan berichtet im Artikel Oracle says "obsolete servers" hacked, denies cloud breach von den neuesten Entwicklungen.

Das Wording von Oracle scheint sehr genau gewählt zu sein. Zumindest ist es wohl so, dass sie einen breach nicht mehr leugnen. Auch wenn es "nur" zwei obsolete Server waren.

Oracle finally confirmed in email notifications sent to customers that a hacker stole and leaked credentials that were stolen from what it described as "two obsolete servers."

However, the company added that its Oracle Cloud servers were not compromised, and this incident did not impact customer data and cloud services.

"Oracle would like to state unequivocally that the Oracle Cloud—also known as Oracle Cloud Infrastructure or OCI—has NOT experienced a security breach," Oracle says in a customer notification shared with BleepingComputer.

Verbesserungen bei Firefox

Im Beitrag Hardening the Firefox Frontend with Content Security Policies beschreibt das Firefox Security Team die jüngsten Verbesserungen.

We have rewritten over 600 JavaScript event handlers to mitigate XSS and other injection attacks in the main Firefox user interface. This mitigation will ship in Firefox 138. However, blocking the execution of scripts in the parent process is not the end - we will expand this technique to other contexts in the near future.

Nicht nur im Firefox selbst, sondern generell sind Content Security Policies eine empfehlenswerte Praxis. Allerdings gibt es viel Legacy-Code, der den Einsatz manchmal verhindert.

Microsoft Patch Tuesday

Microsoft stopft Lücken, die aktiv ausgenutzt werden. Für alle? Wenn man Bad luck, Windows 10 users. No fix yet for ransomware-exploited bug liest, dann weiß man bei der Nutzung von Windows 10 hat man Pech:

In a separate note, Microsoft explained the vulnerability is being exploited by a crew it has designated as Storm-2460, which uses the bug to deliver ransomware it’s dubbed PipeMagic. Victims have been found in the US, Spain, Venezuela, and Saudi Arabia.

The 7.8-rated flaw allows an attacker to elevate privileges up to system level thanks to a use-after-free() flaw in the aforementioned driver. The issue affects all versions of Windows Server up to 2025 and Windows 10 and 11. Windows Server and Windows 11 have been patched, but Windows 10 awaits a fix.

Zumindest am Anfang hatte man Pech. Denn wie ein späteres Update im Artikel bechreibt:

Microsoft has now issued a patch for Windows 10 users for the exploited CVE-2025-29824 vulnerability Redmond was warning about. Users of the operating system can get it here.

Alles in allem hat es trotzdem einen schalen Beigeschmack.

Data breach ticker

AI

Kaum Verbesserungen bei den Modellen?

Im Beitrag Recent AI model progress feels mostly like bullshit wird die These aufgestellt, dass es in letzter Zeit kaum Verbesserungen bei den Modellen gegeben hat.

Since 3.5-sonnet, we have been monitoring AI model announcements, and trying pretty much every major new release that claims some sort of improvement. Unexpectedly by me, aside from a minor bump with 3.6 and an even smaller bump with 3.7, literally none of the new models we've tried have made a significant difference on either our internal benchmarks or in our developers' ability to find new bugs. This includes the new test-time OpenAI models.

[...]

But in recent months I've spoken to other YC founders doing AI application startups and most of them have had the same anecdotal experiences: 1. o99-pro-ultra announced, 2. Benchmarks look good, 3. Evaluated performance mediocre. This is despite the fact that we work in different industries, on different problem sets. Sometimes the founder will apply a cope to the narrative ("We just don't have any PhD level questions to ask"), but the narrative is there.

Google

Zwei Beiträge zu Google fasse ich in dieser Kategorie zusammen. CNBC schreibt im Beitrag Google will let companies run its Gemini AI models in their own data centers:

Google’s gesture may be attractive to a new set of potential customers. Many companies, schools and governments still maintain their own data center hardware, although cloud services have become common in recent years. Even customers that adhere to the secret and top secret U.S. government classification levels will be able to use Gemini through an air-gapped version of Google Distributed Cloud that’s disconnected from the internet.

Und Alberto Romero schreibt in seinem Blogbeitrag Google Is Winning on Every AI Front, dass seiner Ansicht nach Google im AI-Rennen kaum zu schlagen sein wird

Let's not forget that Google is a consumer software company as much as an AI company. They build better models than OpenAI and Anthropic, but they do plenty of other things no one else can do.

Diverses

Infineon setzt auf RISC-V

derStandrad berichtet Infineon will in den nächsten Jahren stärker auf RISV-V setzen.

Die Entscheidung, die eigene Tricore-Architektur zugunsten von RISC-V aufzugeben, kommt einem Kurswechsel gleich. Infineon verabschiedet sich damit von einer seit über 25 Jahren genutzten Eigenentwicklung. "Das ist ein großer Schritt für uns", sagt Thomas Böhm, Leiter des Automotive-MCU-Geschäfts bei Infineon, gegenüber dem Handelsblatt. Man setze nun auf eine Architektur, die das Unternehmen für die kommenden ein bis zwei Dekaden tragen soll.

Lebenserwartung

Schlechte Nachrichten kommen dahingehend aus den USA. Wie Beth Mole in Wealthy Americans have death rates on par with poor Europeans berichtet:

It is true that money buys you a longer life in the US. In fact, the link between wealth and mortality may be stronger in the US than in any other high-income country. But, if you think American wealth will put life expectancy in league with Switzerland, you're dead wrong, according to a study in the latest issue of the New England Journal of Medicine.

The study, led by researchers at Brown University, found that the wealthiest Americans lived shorter lives than the wealthiest Europeans. In fact, wealthy Northern and Western Europeans had death rates 35 percent lower than the wealthiest Americans, whose lifespans were more like the poorest in Northern and Western Europe—which includes countries such as France, the Netherlands, and Switzerland.

Open Source in der mexikanischen Verwaltung

Auf lwn wurde der lesenswerte Artikel Lessons from open source in the Mexican government gepostet. Federico González Waite hat im Rahmen einer Konferenz seine Erfahrungen geschildert.

""So why open source for the government?"" One reason is to cut costs; Mexico is a financially small, developing country that is always looking to reduce costs, he said. Paying for licensing was costing a lot of money that could be used to do other things.

[...]

Another goal is for Mexico to become more self-sufficient, so that it is not locked-in by vendors of various sorts. In his most recent role, he was able to see what was happening all across the government. One common thread is that when agencies were asked why they were spending so much on a particular service, they claimed they had no choice, even though there are lots of other companies offering the same services. It turned out that various contracted companies had corruptly put the software licenses they bought for the government into their own names, leading to a lock-in for their services. Moving to open source can break those and other kinds of locks.

Auch das Datenbanksystem wurde getauscht:

Another part of the project was to move away from Oracle and to PostgreSQL. That change led to various threats and intimidation from the company when it learned of the change, González Waite said. ""They told me that the entire passport system of the country was going to fall down"" and that it would be his fault that Mexico could not let anyone into or out of the country. ""Guess what? That didn't happen.""

Postgres Security AI 2025