An anonymous reader quotes LWN: Python 3.8 is feature complete at this point, which makes it a good time to see what will be part of it when the final release is made. That is currently scheduled for October, so users don't have that long to wait to start using those new features.

The headline feature for Python 3.8 is also its most contentious. The process for deciding on Python Enhancement Proposal (PEP) 572 ("Assignment Expressions") was a rather bumpy ride that eventually resulted in a new governance model for the language. That model meant that a new steering council would replace longtime benevolent dictator for life (BDFL) Guido van Rossum for decision-making, after Van Rossum stepped down in part due to the "PEP 572 mess".

Out of that came a new operator, however, that is often called the "walrus operator" due to its visual appearance. Using ":=" in an if or while statement allows assigning a value to a variable while testing it... It is a feature that many other languages have, but Python has, of course, gone without it for nearly 30 years at this point. In the end, it is actually a fairly small change for all of the uproar it caused.

Todd Austin, a professor at the University of Michigan, is working on an approach known as Morpheus that aims to frustrate hackers trying to gain control of microchips by presenting them with a rapidly changing target. At a conference in Detroit this week organized by the U.S. Defense Department's Defense Advanced Research Projects Agency (DARPA), Austin described how the prototype Morpheus chip works. MIT Technology Review reports: The aim is to make it incredibly difficult for hackers to exploit key software that helps govern the chip's operation. Morpheus does this by repeatedly randomizing elements of the code that attackers need access to in order to compromise the hardware. This can be achieved without disrupting the software applications that are powered by the processor. Austin has been able to get the chip's code "churning" to happen once every 50 milliseconds -- way faster than needed to frustrate the most powerful automated hacking tools. So even if hackers find a vulnerability, the information needed to exploit it disappears in the blink of an eye.

There's a cost to all this: the technology causes a slight drop in performance and requires somewhat bigger chips. The military may accept this trade-off in return for greater security on the battlefield, but it could limit Morpheus's appeal to businesses and consumers. Austin said a prototype has already resisted every known variant of a widely-used hacking technique known as a control-flow attack, which does things like tampering with the way a processor handles memory in order to allow hackers to sneak in malware. More tests lie ahead. A team of U.S. national security experts will soon begin probing the prototype chip to see if they can compromise its defenses, and Austin also plans to post some of Morpheus's code online so that other researchers can try to find flaws in it, too.

Microsoft plans to explore using the Rust programming language as an alternative to C, C++, and others, as a way to improve the security posture of its and everyone else's apps. From a report: The announcement was made yesterday by Gavin Thomas, Principal Security Engineering Manager for the Microsoft Security Response Center (MSRC). "You're probably used to thinking about the Microsoft Security Response Center as a group that responds to incidents and vulnerabilities," Thomas said. "We are a response organization, but we also have a proactive role, and in a new blog series we will highlight Microsoft's exploration of safer system programming languages, starting with Rust." The end game is to find a way to move developers from the aging C and C++ programming language to so-called "memory-safe languages." Memory-safe languages, such as Rust, are designed from the ground up with protections against memory corruption vulnerabilities, such as buffer overflows, race conditions, memory leaks, use-after free and memory pointer-related bugs.

Former Supreme Court Justice John Paul Stevens passed away Tuesday evening of complications following a stroke he suffered on July 15. He was 99 years old. An anonymous Slashdot reader shares a lightly edited version of Ars Technica's 2010 story that originally marked his retirement from the Supreme Court: In April 2010, the Supreme Court's most senior justice, John Paul Stevens, announced his retirement. In the weeks that followed, hundreds of articles were written about his career and his legacy. While most articles focus on 'hot button' issues such as flag burning, terrorism, and affirmative action, Stevens' tech policy record has largely been ignored. When Justice Stevens joined the court, many of the technologies we now take for granted -- the PC, packet-switched networks, home video recording -- were in their infancy. During his 35-year tenure on the bench, Stevens penned decisions that laid the foundation for the tremendous innovations that followed in each of these areas.

For example, Stevens penned the 1978 decision that shielded the software industry from the patent system in its formative years. In 1984, Hollywood's effort to ban the VCR failed by just one Supreme Court vote; Stevens wrote the majority opinion. And in 1997, he wrote the majority opinion striking down the worst provisions of the Communications Decency Act and ensuring that the Internet would have robust First Amendment protections. Indeed, Justice Stevens probably deserves more credit than any other justice for the innovations that occurred under his watch. And given how central those technologies have become to the American economy, Stevens' tech policy work may prove one of his most enduring legacies. In this feature, we review Justice Stevens' tech policy decisions and salute the justice who helped make possible DRM-free media devices, uncensored Internet connections, free software, and much more. As the report mentions, Stevens was the Supreme Court's cryptographer. "Stevens attended the University of Chicago, graduating in 1941. On December 6 -- the day before the Japanese attacked Pearl Harbor -- Stevens enrolled in the Navy's correspondence course on cryptography."

"Stevens spent the war in a Navy bunker in Hawaii, doing traffic analysis in an effort to determine the location of Japanese ships," the report adds. "He was an English major, not a mathematician, but he proved to have a knack for cryptographic work."

Slashdot reader DevNull127 writes: Another very minor kerfuffle has broken out in the community for the Go programming language. When its official Twitter account asked for feedback on the new look of its web site, one developer suggested that it had been a mistake to add the Google logo to the lower-right of the home page. "A lot of people associate it with a commercial Google product."

Following the suggested procedure, he then created an issue on GitHub. ("Go is perceived by some as a pure Google project without community involvement. Adding a Google logo does not help in this discussion.") The issue received 61 upvotes (and 30 downvotes), eventually receiving a response from Google software engineer Andrew Bonventre, the engineering lead on the Go Team.

"Thanks for the issue. We spent a long time talking about it and are sensitive to this concern. It's equally important to make it clear that Google supports Go, which was missing before (Much like typescriptlang.org). Google pays for and hosts the infrastructure that golang.org runs on and we hope the current very small logo is a decent compromise." He then closed the issue.

The developer who created the issue then responded, "I get that you've discussed this internally. This is a great opportunity to discuss it with the community. I'm thankful to Google for financing the initial and ongoing development of Go but Google is not the only company investing [in] Go. I would like to move the Google logo into an separate section, together will the major stakeholders of the project."

In a later comment he added "I value Google's participation in Go and I'm not arguing to change that. Having the Google logo in the corner of each golang.org page suggests that this is a pure Google project when it is not..."

For some perspective, another Go developer had also suggested "animate the gopher's eyes on the website."

"Thanks, but we're not going to do this," responded the engineering lead on the Go Team. "We've discussed it before and it would be way too distracting."

Cloudflare has published a detailed and refreshingly honest report into precisely what went wrong earlier this month when its systems fell over and took a big chunk of the internet with it. The Register reports: We already knew from a quick summary published the next day, and our interview with its CTO John Graham-Cumming, that the 30-minute global outage had been caused by an error in a single line of code in a system the company uses to push rapid software changes. [...] First up the error itself -- it was in this bit of code: .*(?:.*=.*). We won't go into the full workings as to why because the post does so extensively (a Friday treat for coding nerds) but very broadly the code caused a lot of what's called "backtracking," basically repetitive looping. This backtracking got worse -- exponentially worse -- the more complex the request and very, very quickly maxed out the company's CPUs.

The impact wasn't noticed for the simple reason that the test suite didn't measure CPU usage. It soon will -- Cloudflare has an internal deadline of a week from now. The second problem was that a software protection system that would have prevented excessive CPU consumption had been removed "by mistake" just a weeks earlier. That protection is now back in although it clearly needs to be locked down. The software used to run the code -- the expression engine -- also doesn't have the ability to check for the sort of backtracking that occurred. Cloudflare says it will shift to one that does. The post goes on to talk about the speed with which it impacted everyone, why it took them so long to fix it, and why it didn't just do a rollback within minutes and solve the issue while it figured out what was going on.

You can read the full postmortem here.

Last year, Oracle filed a lawsuit against the U.S. government complaining about the procurement process around the Pentagon's $10 billion, decade-long JEDI cloud contract. "They claimed a potential conflict of interest on the part of a procurement team member (who was a former AWS employee)," reports TechCrunch. "Today, that case was dismissed in federal court." From the report: In dismissing the case, Federal Claims Court Senior Judge Eric Bruggink ruled that the company had failed to prove a conflict in the procurement process, something the DOD's own internal audits found in two separate investigations. Judge Bruggink ultimately agreed with the DoD's findings: "We conclude as well that the contracting officer's findings that an organizational conflict of interest does not exist and that individual conflicts of interest did not impact the procurement, were not arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law. Plaintiff's motion for judgment on the administrative record is therefore denied."

Today's ruling opens the door for the announcement of a winner of the $10 billion contract, as early as next month. The DoD previously announced that it had chosen Microsoft and Amazon as the two finalists for the winner-take-all bid.

Security engineer Ivan writes: For some reason Apple allows "subscription scam" apps on the App Store. These are apps that are free to download and then ask you to subscribe right on launch. It's called the freemium business model, except these apps ask you to subscribe for "X" feature(s) immediately when you launch them, and keep doing so, annoyingly, over and over until you finally subscribe. By subscribing you get a number of "free days" (trial) and then they charge you weekly/monthly/yearly for very basic features like scanning QR Codes.

I've been trying to monitor apps that have these characteristics: 1. They have In-App purchases for their subscriptions. 2. They have bad reviews, specially with words like "scam" or "fraud". 3. Their "good" reviews are generic, potentially bot-generated. This weekend I focused on 5 apps from 2 different developers and to my surprise they are very similar, not only their UI/UX but also their code is shared and their patterns are absolutely the same. A side from being classic subscription scam apps, I wanted to examine how they work internally and how they communicate with their servers and what type of information are they sending.

Amazon announced Thursday that it will spend up to $700 million over the next six years retraining 100,000 of its US employees, mostly in technical skills like software engineering and IT support. From a report: Amazon is already one of the largest employers in the country, with almost 300,000 workers (and many more contractors) and it's particularly hungry for more new talent. The company currently has more than 20,000 vacant US roles, over half of which are at its headquarters in Seattle. Meanwhile, the US economy is booming, and there are now more open jobs than there are unemployed people who can fill them, according to the Bureau of Labor Statistics. "The purpose isn't really to create a job ladder from fulfillment center to CEO, but rather to meet employees where they are and to create opportunities for them to build on the skills that they have," Ardine Williams, Amazon's vice president of workforce development, said in an interview Thursday morning. Amazon joins a number of other companies who have announced multimillion-dollar investments in retraining in recent years, as a tightening labor market and technological change forces businesses to evolve. Amazon has already spent thousands of dollars on worker retraining in its Career Choice program, which helps hourly associates pay for degree programs in other, high-demand fields. CEO Jeff Bezos said in a shareholder letter last year that more than 12,000 US employees have participated in the program since it began in 2012. Amazon said they will expand the program Thursday.

theodp writes: TechCrunch reports that Google kicked off the 2019 Computer Science Teachers Association (CSTA) Conference in style with the announcement of Code with Google, a new coding resource for teachers which collects Google's own free course curriculum on teaching computer science and coding. Google also announced a $1 million grant to the teachers group alongside the unveiling of Code with Google. To hear Google tell it, Code with Google -- much like bacon -- makes everything better. An English and Language Arts teacher, blogs Google Education VP Maggie Johnson, "didn't know much about computer science, but wanted her students to get familiar with coding because it can help with other skills, such as critical thinking and collaboration. So she tried a [Google] CS First activity where students coded different endings [video] to the story they read in class. Melissa says that, in a short time, 'the kids were problem solving, troubleshooting, and helping one another. It was incredible to hear the conversations about coding and the other concepts we were learning in the room.'" Johnson is also on the Board of tech-bankrolled Code.org, which reported it had spent $91.4 million (thru Dec. 2018) to get CS into K-12 schools (Google is a $3+ million Code.org Gold Sponsor). Not too surprisingly, one of the CSTA 2019 keynotes will be delivered by employees of Platinum Conference Sponsor Google, including a former CSTA Executive Director (CSTA is currently led by Code.org's former Director of State Government Affairs -- it's a small K-12 CS world!).

Slashdot reader volvox_voxel shares an excerpt from the latest blog post from software engineer Ken Shirriff, who is well known for his work on restoring some of the rarest computing hardware to its working condition: We've been restoring an Apollo Guidance Computer1. Now that we have the world's only working AGC, I decided to write some code for it. Trying to mine Bitcoin on this 1960s computer seemed both pointless and anachronistic, so I had to give it a shot. Implementing the Bitcoin hash algorithm in assembly code on this 15-bit computer was challenging, but I got it to work. Unfortunately, the computer is so slow that it would take about a billion times the age of the universe to successfully mine a Bitcoin block. He wasn't kidding about how long it would take to successfully mine a Bitcoin block. "The Apollo Guidance Computer took 5.15 seconds for one SHA-256 hash," writes Shirriff. "Since Bitcoin uses a double-hash, this results in a hash rate of 10.3 seconds per Bitcoin hash. Currently, the Bitcoin network is performing about 65 EH/s (65 quintillion hashes per second). At this difficulty, it would take the AGC 4x10^23 seconds on average to find a block. Since the universe is only 4.3x10^17 seconds old, it would take the AGC about a billion times the age of the universe to successfully mine a block."

Netflix Hangouts is a new Chrome extension that tries to make it easier to get away with watching Netflix while you're supposed to be working. Just go to the show you want to catch up on during work hours, and press the extension's icon in your Chrome menu to bring up a fake four-person conference call. Then you can sit back and watch the show in the window's bottom right feed while three fake colleagues get down to business. The Verge reports: The extension was developed by Mschf Internet Studios, which has produced a few internet curiosities like this over the years. There was the Slack channel that offered $1,000 in prize money for the first person to correctly guess each word of the day (it was shut down by Slack after just a week), a man who ate various foods as disgusting ice cream toppings, and who could forget Tabagotchi, the lovable virtual avatar that slowly died as you opened more and more tabs? Netflix Hangouts is the latest in a long line of services designed to let you slack off at work.

Mozilla is funding a project for bringing the Julia programming language to Firefox and the general browser environment. From a report: The project received funding part of the Mozilla Research Grants for the first half of 2019, which the browser maker announced on Friday. In April, when Mozilla opened this year's submissions period for research grants, the organization said it was looking for a way to bring data science and scientific computing tools to the web. It said it was specifically interested in receiving submissions about supporting R or Julia at the browser level. Both R and Julia are programming languages designed for high-performance numerical, statistical, and computational science.

Mozilla engineers have worked in previous years to port data science tools at the browser level, as part of Project Iodide. Previously, as part of this project, Mozilla engineers ported the Python interpreter to run in the browser using WebAssembly. "This project, Pyodide, has demonstrated the practicality of running language interpreters in WebAssembly," Mozilla engineers said.

Matt Klein, a member of the Go steering committee recently apologized for the angst caused to some people by "the try() kerfuffle... Change is hard, but sometimes it's for the best."

Tech columnist Mike Melanson covers the kerfuffle over the newly-proposed feature, while trying "not to over-dramatize what is happening." There is disagreement and conflicting views, but working through those views is how the open source sausage is made, is it not? Of course, in the Go community, how the core team receives those opposing views may be a point of soreness among some who vehemently opposed the vgo package versioning for Go and felt that, in the end, it was rammed through despite their objections. As one Gopher points out, it is better to debate now than summarily accept and then later deprecate...

As Go makes its way to Go 2.0, with Go 1.14 currently taking center stage for debate, there is, again, as Klein points out, some kerfuffle about a newly proposed feature called try(), which is "designed specifically to eliminate the boilerplate if statements typically associated with error handling in Go." According to the proposal, the "minimal approach addresses most common scenarios while adding very little complexity to the language" and "is easy to explain, straightforward to implement, orthogonal to other language constructs, and fully backward-compatible" as well as extensible for future needs.

Much of the disagreement around try() comes in the form of whether or not the resultant code is more or less readable than current implementations of error handling. Beyond that, however, some say that even if try() were accepted, it has faults that would prevent them from recommending or even allowing its use among their teams. Meanwhile, another point of contention is offered in an open letter to the Go team about try by William Kennedy who often writes about Go, and focuses on not style or function, but rather whether or not a solution is needed at all. According to Kennedy, "the perceived error handling complaints are perhaps overblown and these changes are not what the majority of Go developers want or need" and that try() may be a solution searching for a problem, and even the cause of more problems than it solves."Since this new mechanic is going to cause severe inconsistencies in code bases, disagreements on teams, and create an impossible task for product owners to enforce consistent guidelines, things need to be slowed down and more data needs to be gathered," Kennedy writes.

He goes on to point out those very sensitivities that may have lingered from previous discussions in the Go community. "This is a serious change and it feels like it's being pushed through without a concerted effort to understand exactly what those 5% of Go developers meant when they said they wanted improved error handling...."

The Indian Institute of Technology (IIT) Madras has released the software development kit (SDK) for its open-source Shakti processor. Shakti is based on the open-source RISC-V instruction set architecture and was funded by the Indian Ministry of Electronics and Information Technology. The institute promised that a development board will also be released soon. Tom's Hardware reports: The RISE group at IIT Madras started working on the Shakti project in 2016 with a plan to release a family of six classes of processors, each serving a different market. The group promised that the reference processors will be competitive with commercial offerings in terms of area, performance and power consumption. Now India, like China and the European Union, are showing interest in designing their own processors, rather than relying on ones designed by U.S. manufacturers. With the release of the Shakti SDK, developers can begin to develop applications for the Shakti processors, even before they're commercialized.

An anonymous reader quotes a report from The Register: Ahead of its first day in a U.S. federal claims court in Washington DC, Oracle has outlined its position against the Pentagon's award of the Joint Enterprise Defense Infrastructure (JEDI) cloud contract to Amazon Web Services. Big Red's lengthy filing questions the basis of Uncle Sam's procurement procedure as well as Amazon's hiring of senior Department of Defense staff involved in that procurement process. Oracle's first day in court is set for 10 July. The JEDI deal could be worth up to $10 billion over 10 years. The Department of Defense handed the contract to AWS after deciding that only Amazon and Microsoft could meet the minimum security standards required in time.

Oracle's filing said that U.S. "warfighters and taxpayers have a vested interest in obtaining the best services through lawful, competitive means... Instead, DoD (with AWS's help) has delivered a conflict-ridden mess in which hundreds of contractors expressed an interest in JEDI, over 60 responded to requests for information, yet only the two largest global cloud providers can clear the qualification gates." The company said giving JEDI, with its "near constant technology refresh requirements", to just one company was in breach of procurement rules. It accused the DoD of gaming the metrics used in the process to restrict competition for the contract. Oracle also accused Amazon of breaking the rules by hiring two senior DoD staff, Deap Ubhi and Anthony DeMartino, who were involved in the JEDI procurement process. Ubhi is described as "lead PM." A third name is redacted in the publicly released filing. The DoD, which is expected to make an offer to settle the case in late August, said in a statement: "We anticipate a court decision prior to that time. The DoD will comply with the court's decision. While the acquisition and litigation processes are proceeding independently the JEDI implementation will be subject to the determination of the court."

The 50-page filing can be found here (PDF).

An anonymous reader shares a report: As part of this year's annual Steam Summer Sale, Valve is hosting a new "Grand Prix" promotion that gives participants a chance at free games if they complete certain daily "quests" on the platform. But confusion over how the promotion works seems to be leading Steam users to delete some low-cost indie games from their Steam wishlists in a misguided attempt to maximize the value of their potential winnings. "We lost 1,500 wishlists in the first 24 hours of the sale," No More Robots Director Mike Rose told Ars regarding the four indie games the publisher sells on Twitter. "Usually you lose, like, 20 in a day."

No More Robots is far from alone. Mode 7 Games' Paul Kilduff-Taylor tweeted a graph showing wishlist deletions spiking to over 1,100 following the start of the sale on Tuesday. SixtyGig Games's Raymond Doerr showed a similar increase in deletions for his game at the same time, outpacing a smaller rise in additions and purchases from the wishlist. There are now enough anecdotal examples of this effect across multiple indie games, all starting on the first day of the sale, to suggest this marked increase is something more than random chance.

Tekla Perry writes: When WYSIWIG pioneer Charles Simonyi went to space, he couldn't but help notice the awkward user interface on the rocket's control panel. It was a case of legacy systems, not wanting to change training and documentation, and an emulator that ran Unix on a 386 chip, he reported during a recent discussion on space software held at the Computer History Museum. "They liked the older chips because of radiation resistance and the feature set," he pointed out, noting how operation of the virtual interface was trickier than it seemed. "There are rows and columns," he said, "and you move the cursor over the button and use another button to push the virtual button."

"On the right side," he said, "there are these windows that are numbers you type in by pushing virtual buttons below them. You use the cursor keys to go to the virtual buttons then push an entry button that is virtual." He added: "You can see that even as the technology changes, they want to keep as many things the same as possible."

Oracle has sent the following email to customers of DYN service: Since Oracle acquired Dyn in 2016 (and subsequently acquired Zenedge), the engineering teams have been working diligently to integrate Dyn;s products and network into the Oracle Cloud Infrastructure. With the completion of this upgrade to Oracle Cloud Infrastructure. Oracle is announcing the end-of-life for the free Standard DNS service in favor of the enhanced, paid subscription version on the Oracle Cloud Infrastructure platform. On May 31, 2020, the 'EOL Date', the Standard DNS will be retired and will no longer be available. The following capabilities are not currently supported in Oracle Cloud Infrastructure DNS: Webhop (HTTP redirect), Dynamic DNS, Zone transfer to external nameservers, and DNSSEC.

For years, companies like Oracle and IBM invested heavily to build new markets in China for their industry-leading databases. Now, boosted in part by escalating U.S. tensions, one Chinese upstart is stepping in, winning over tech giants, startups and financial institutions to its enterprise software. From a report: Beijing-based PingCAP already counts more than 300 Chinese customers. Many, including food delivery giant Meituan, its bike-sharing service Mobike, video streaming site iQIYI and smartphone maker Xiaomi are migrating away from Oracle and IBM's services toward PingCAP's, encapsulating a nation's resurgent desire to Buy China. PingCAP's ascendancy comes as the U.S. cuts Huawei off from key technology, sending chills through the country's largest entities while raising questions about the security of foreign-made products. That's a key concern as Chinese companies modernize systems in every industry from finance and manufacturing to healthcare by connecting them to the internet.