Brief items

Plans to "break up" big tech just creates a few more data silos and effectively locks in some pre-selected (slightly smaller) giants, thanks to network effects. What the Data Transfer Project does is flip the equation. It makes it so that more competition can thrive without taking away the network effects that make the internet so powerful. It's the most interesting, and most compelling approach to generating actual competition among internet services.

I still hope that the project goes even further in knocking down silos and opening up for competition, but it's already quite encouraging. Of course, it got almost no attention at all because anti-trust is sexy, whereas companies opening themselves up to competition through technological means is apparently boring.

Seeing that some people out there in the world have installed and are using a package that I maintain in Debian makes me happy. I think we shouldn't underestimate the pure psychological value of that, even if it's hard to attribute specific meaning to the statistics.

CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check size. For x86-64, memcmp on an object size larger than SSIZE_MAX has undefined behavior. On x32, the size_t argument may be passed in the lower 32 bits of the 64-bit RDX register with non-zero upper 32 bits. When it happened with the sign bit of RDX register set, memcmp gave the wrong result since it treated the size argument as zero. Reported by H.J. Lu.

CVE-2019-9169: Attempted case-insensitive regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read. Reported by Hongxu Chen.