What happened in Falco this week?
Of course, we are super busy with the 0.34.0 release, but still, we have some goodies for you!
Libs:

• A new libscap cleanup was merged! https://github.com/falcosecurity/libs/pull/845
• Some small bugfixes happened too! https://github.com/falcosecurity/libs/pull/850
• Given 850, a new 0.10.3 tag was made and will be used by Falco 0.34.0 :slightly_smiling_face:
• Modern probe does now use CORE relocations when reading struct sizes: https://github.com/falcosecurity/libs/pull/848
• io_uring family of syscall support was merged for modern probe! https://github.com/falcosecurity/libs/pull/844
• update-syscalls job, that was part of test-infra prow before, is now moved to libs repo, where it should really belong: https://github.com/falcosecurity/libs/pull/847

Falco:

• Revert some issues with recent changes to falco-driver-loader: https://github.com/falcosecurity/falco/pull/2388
• application_rules.yaml was deprecated and will be no more shipped by Falco by default: https://github.com/falcosecurity/falco/pull/2389
• A falcoctl config will be shipped and installed by Falco: https://github.com/falcosecurity/falco/pull/2390
• As said earlier, libs were bumped to 0.10.3: https://github.com/falcosecurity/falco/pull/2392
• And falcoctl to 0.3.0: https://github.com/falcosecurity/falco/pull/2401
• Moreover, some other small bugfixes happened: https://github.com/falcosecurity/falco/pull/2398, https://github.com/falcosecurity/falco/pull/2399

Falcoctl:

• Default config for artifact follow command was dropped: https://github.com/falcosecurity/falcoctl/pull/241
• Lots of documentation effort! https://github.com/falcosecurity/falcoctl/pull/238, https://github.com/falcosecurity/falcoctl/pull/245, https://github.com/falcosecurity/falcoctl/pull/248
• Added an in-memory cache mechanism for index files: https://github.com/falcosecurity/falcoctl/pull/244
• Added a beautiful ascii art :rolling_on_the_floor_laughing: https://github.com/falcosecurity/falcoctl/pull/249
• Oh, and we released driverkit 0.11.1 too! https://github.com/falcosecurity/driverkit/releases/tag/v0.11.1

What to expect next?

• Of course, Falco 0.34.0 is expected to land on monday, or well, during the next week!
• Charts updates for Falco 0.34.0 (modern bpf probe and falcoctl support!): https://github.com/falcosecurity/charts/pull/453
• A new rule, to detect drop and execute pattern in containers: https://github.com/falcosecurity/rules/pull/20
• Kernel-crawler job moved to github action instead of prow job (it is already merged :wink: we will see if on monday gha actually works ahah)
• A new maintainer in libs!! https://github.com/falcosecurity/libs/pull/859
• Fixed some clang15 related verifier issues: https://github.com/falcosecurity/libs/pull/858 (thanks :arch: for letting us spot these issues!)
• Unification between the 3 drivers for some syscalls: https://github.com/falcosecurity/libs/pull/856, https://github.com/falcosecurity/libs/pull/861
• more libs cleanups: https://github.com/falcosecurity/libs/pull/853, https://github.com/falcosecurity/libs/pull/851
• new libs tests: https://github.com/falcosecurity/libs/pull/838
• libs fixes... : https://github.com/falcosecurity/libs/pull/862, https://github.com/falcosecurity/libs/pull/860
• fixed Falco engine evttype indexing corner cases: https://github.com/falcosecurity/falco/pull/2397
• fix for falco-driver-loader for some debian kernels: https://github.com/falcosecurity/falco/pull/2377 (needs testing! Please help us!)
• Adaptive syscall set from ruleset in Falco! https://github.com/falcosecurity/falco/pull/2361
• Dynamic builder images for driverkit: https://github.com/falcosecurity/driverkit/pull/244

Thanks to everyone who contributes opening issues, PRs, or just chatting here 
See you next friday, once Falco 0.34.0 will be released (don't quote me on that though! :laughing:)

Oh, and of course, it seems like chatGPT is gonna help us soon :rocket:  https://kubernetes.slack.com/archives/CMWH3EH32/p1675366778308939