frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

CVE-2026-111943: Compromised Intermediate Certificate Authority

https://nvd.nist.gov/vuln/detail/cve-2026-111943
203•keks24•3h ago•55 comments

Faster than earcut: triangulating 3.7M map polygons in 489 ms

https://globus.software/blog/2026/10/16/cutting-map-polygons/
76•molind•3h ago•16 comments

Jailbreaking the Switch 2

https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/
158•ledoge•4h ago•52 comments

What Is Gridifcation

https://musicalform.substack.com/p/what-is-gridifcation
14•gumby•3d ago•1 comments

WorldTUI: I trained a 360M model to pretend to be a terminal

https://simedw.com/2026/10/21/world-model-terminal/
309•alphax314•10h ago•92 comments

The recently proposed o(n log n) integer multiplication algorithm [pdf]

https://web.maths.unsw.edu.au/~davidharvey/research/subnlogn.pdf
230•craigcitro•10h ago•173 comments

Several Linux kernel vulnerabilities accidentally posted to public mailing list

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
76•mrkn1•1h ago•17 comments

Security Disclosure

https://blog.railway.com/p/security-disclosure-wednesday-october-21st
503•passenger•14h ago•293 comments

Xbox wants you to pay 24 to 40 cents per hour to stream games you bought

https://arstechnica.com/gaming/2026/10/xbox-wants-you-to-pay-24-to-40-cents-per-hour-to-stream-ga...
51•entryleveljobsc•57m ago•49 comments

Startup taps underwater volcano as energy source in "proof point" test

https://arstechnica.com/science/2026/10/startup-taps-underwater-volcano-as-energy-source-in-proof...
29•wffurr•2d ago•12 comments

Claude Duet

https://claude.com/product/claude-duet
439•kuberwastaken•17h ago•401 comments

No more icons in every menu by default

https://blog.jim-nielsen.com/2026/icons-in-every-menu/
368•riffraff•2d ago•218 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
544•abhisek•22h ago•175 comments

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitatio...
30•cubefox•48m ago•2 comments

Rust Style Guide

https://google.github.io/styleguide/rustguide.html
332•kaycebasques•17h ago•195 comments

GitLab critical patch release

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
366•artooro•17h ago•86 comments

Using LLM for confidence scoring is a bad idea

https://rumple.github.io/blog/2026/10/20/asking-llm-for-confidence.html
122•jimauthors•1d ago•66 comments

OpenAI CLI

https://github.com/openai/openai-cli
160•armcat•7h ago•82 comments

The Robot I Didn't Expect to Build

https://spectrum.ieee.org/agility-robotics-digit-5-redesign
22•bojackh•2d ago•18 comments

PingCap TiDB Leaks

https://fulcrumsec.vg/pingcap/
374•swyx•1d ago•62 comments

What Is the Karakoram Anomaly?

https://nsidc.org/learn/ask-scientist/karakoram-anomaly-it-real
48•thunderbong•2d ago•9 comments

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://www.bbc.com/news/articles/cp814l80pw2o
236•bryanrasmussen•2d ago•51 comments

Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
598•cbg0•18h ago•342 comments

Code is clay now

https://www.albertodenia.com/writing/code-is-clay-now
198•albertodenia•2d ago•131 comments

OpenAI models are coming to Google Cloud

https://openai.com/index/openai-models-google-cloud/
304•armcat•23h ago•126 comments

Eigenmoon: linear algebra puzzles by moonlight

https://eigenmoon.vercel.app/
6•jessicarumbelow•2d ago•3 comments

Beyond the &

https://lwn.net/Articles/1096028/
81•PaulHoule•1d ago•9 comments

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/2026/10/21/announcing-duckdb-200
432•nnx•22h ago•58 comments

mitmproxy adds --emudhra option

https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b
523•ahlCVA•12h ago•125 comments

Today's PHP security release, and how we're strengthening security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-...
759•ejohnso49•20h ago•374 comments
Open in hackernews

Elliptical Python Programming

https://susam.net/elliptical-python-programming.html
184•sebg•1y ago

Comments

benob•1y ago
TIL that in python, 1--2==3
seplox•1y ago
It's not a python thing. 1-(-2), distribute the negative.
qsort•1y ago
In most C-like languages that would be a syntax error. E.g. in C and C++ as a rule you tokenize "greedily", "1--2" would be tokenized as "1", "unary decrement operator", "2", which is illegal because you're trying to decerment an rvalue.

Python doesn't have "--", which allows the tokenizer to do something else.

nyrikki•1y ago
In C, that is really because Unary minus (negation) has precedence over binary operations.

    +a - b; // equivalent to (+a) - b, NOT +(a - b)
    -c + d; // equivalent to (-c) + d, NOT -(c + d)

https://en.cppreference.com/w/cpp/language/operator_arithmet...

    +-e; // equivalent to +(-e), the unary + is a no-op if “e” is a built-in type
     // because any possible promotion is performed during negation already
The same doesn't apply to, !! Which is applied as iterated binary operations (IIRC)

I am pretty sure the decriment operator came around well after that quirk was established.

seanhunter•1y ago
Peter van der Linden’s book “Expert C Programming” (which is awesome btw) says that one of them (Kernighan, Richie or maybe Ken Thompson I forget) realised early on that the c compiler had the wrong operator precedence for bit twiddling and unary and boolean operators but “at that stage we had a few thousand lines of C code and thought it would be too disruptive to change it”
j2kun•1y ago
Also worth noting that `1 - -2` works and produces 3 in C because the space breaks the operator.
plus•1y ago
For those who are curious, `...` is a placeholder value in Python called Ellipsis. I don't believe it serves any real purpose other than being a placeholder. But it is an object and it implements `__eq__`, and is considered equal to itself. So `...==...` evaluates to `True`. When you prefix a `True` with `-`, it is interpreted as a prefix negation operator and implicitly converts the `True` to a `1`, so `-(...==...)` is equal to `-1`. Then, you add another prefix `-` to turn the `-1` back into `1`.

`--(...==...)--(...==...)` evaluates to `2` because the first block evaluates to 1, as previously mentioned, and then the next `-` is interpreted as an infix subtraction operator. The second `-(...==...)` evaluates to `-1`, so you get `1 - -1` or `2`.

When chaining multiple together, you can leave off the initial `--`, because booleans will be implicitly converted to integers if inserted into an arithmetic expression, e.g. `True - -1` -> `1 - -1` -> `2`.

> There should be one-- and preferably only one --obvious way to do it.

This article is obviously completely tongue-in-cheek, but I feel the need to point out that this sentence is not meant to be a complete inversion of the Perl philosophy of TIMTOWTDI. The word "obvious" is crucial here - there can be more than one way, but ideally only one of the ways is obvious.

pletnes•1y ago
Numpy actively uses … to make slicing multidimensional arrays less verbose. There are also uses in FastAPI along the lines of «go with the default».
abuckenheimer•1y ago
excellent explanation, to add to this since I was curious about the composition, '%c' is an integer presentation type that tells python to format numbers as their corresponding unicode characters[1] so

'%c' * (length_of_string_to_format) % (number, number, ..., length_of_string_to_format_numbers_later)

is the expression being evaluated here after you collapse all of the 1s + math formatting each number in the tuple as a unicode char for each '%c' escape in the string corresponding to its place in the tuple.

[1] https://docs.python.org/3/library/string.html#format-specifi...

elijahbenizzy•1y ago
Ok do this but for JavaScript
voidUpdate•1y ago
https://en.wikipedia.org/wiki/JSFuck
mariocesar•1y ago
If you're curious, the code in ellipsis results in executing:

    print('hello, world')
mturmon•1y ago
Thank you!

I noticed some ** and * in the thing sent to eval(), which (given that the building blocks are small integers) seemed related to prime factorizations.

The initial %c is duplicated 21 times (3*7, if I read correctly), and then string-interpolated (%c%c%c...) against a long tuple of integers. These integers themselves are composed of products of factors combined using * and **.

There is also one tuple "multiplication" embedded within that long tuple of integers -- (a,b)*2 = (a,b,a,b). That is for the 'l' 'l' in "hello".

It's all very clever and amusingly mathy, with a winking allusion to the construction of natural numbers using sets. It made me Godel.

callamdelaney•1y ago
I think we're really starting to over crowd pythons syntax and I'm not a fan.
noddleah•1y ago
you're telling me you never program in python elliptically??
acbart•1y ago
Pretty sure this would have been possible in Python 2.6. The Ellipsis object has been around for a very long time.
MadVikingGod•1y ago
This behavior can be replicated with any class that has two special methods: __neg__ that returns -1 and __sub__ that accepts ints and returns 1-other.

For example if you make this class:

  class _:
       def __neg__(self):
           return -1
       def __sub__(self, other):
           return 1-other
You get similar behavior:

  >>> --_()
  1
  >>> _()--_()
  2
Fun python for everyone.
maxloh•1y ago
You can do this on JavaScript too.

  alert(1)
  // equals to:
  [][(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[+!+[]]]+[+!+[]]+([]+[]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[!+[]+!+[]]])()
https://jsfuck.com/
nomel•1y ago
Expanding on this a little, I will be replacing all occurrences of 2 with two blobs fighting, with shields:

    >>> 0^((...==...)--++--(...==...))^0
    2
rmah•1y ago
>> There should be one-- and preferably only one --obvious way to do it.

Except for package management, of course. There, we need lots and lots of ways.

blooalien•1y ago
And apparently string formatting which should have an ever growing number of ways to handle it. :shrug: