Potential segfault in the time crate

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

• time::UtcOffset::local_offset_at
• time::UtcOffset::try_local_offset_at
• time::UtcOffset::current_local_offset
• time::UtcOffset::try_current_local_offset
• time::OffsetDateTime::now_local
• time::OffsetDateTime::try_now_local

The affected functions in time 0.1 (all versions) are:

• at
• at_utc

Non-Unix targets (including Windows and wasm) are unaffected.

Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return None on the affected operating systems. This has the effect of returning an Err on the try_* methods and UTC on the non-try_* methods.

Users and library authors with time in their dependency tree should perform cargo update, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3. series.

Workarounds

No workarounds are known.

References

time-rs/time#293

See advisory page for additional details.

dotenv is Unmaintained

dotenv by description is meant to be used in development or testing only.

Using this in production may or may not be advisable.

Alternatives

The below may or may not be feasible alternative(s):

• dotenvy

See advisory page for additional details.

The current licence file states the project is: GNU Affero General Public License v3.0. In the documentation you mention Apache 2.0

Potential segfault in localtime_r invocations

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

• time-rs/time#293

See advisory page for additional details.

Sage is the software stack of a much bigger project called "Enhancing Human Intelligence" which has had 3 publications so far.

• Enhancing Human Intelligence: Episode One
• Enhancing Human Intelligence: Episode Two
• Enhancing Human Intelligence: 2024 Update

It consists of several sub-systems including sage-ai (which is a multimodal action model with several AI agents), a decoder system that interprets brain signals into natural language, dual learning system, etc. All of these sub-system should be tightly integrated within Sage.

As the project evolves so does the scope of the Sage system. The initial goal of Sage was to be an open source knowledge graph with AI features such as Graph Neural Networks, Graph Embeddings, Semantic search etc in order to understand the world and relationships around real world objects/entities. However, there has been technological advancements that makes this approach obsolete.

Rather than have Sage be an Open source knowledge graph, Sage will now be a BCI system that decodes human brain signals into natural language, interprets them, processes the signals with sage-ai and perform actions based on the signals or natural language input.

Features of Sage

• Use decoded natural language/IR as input to sage-ai
• Perform actions suggested by sage-ai's response
• 🔬 Decode brain signals into natural language or intermediate representation
• 🔬 Filter response to be encoded as signals to be transmitted into the brain
• 🔬 Dual Learning System

A lot of Sage's sub-system is still in the research phase 🔬.

Such system would be built iteratively. The goal is to have sage v0.1.0 be a system that can work with natural language and perform actions based on the contents of the language using many tools that will be provided by Sage and SageAI.