frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Railway Security Disclosure

https://blog.railway.com/p/security-disclosure-wednesday-october-21st
254•passenger•2h ago•118 comments

mitmproxy adds --emudhra option

https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b
40•ahlCVA•35m ago•6 comments

There isn't an easy exploit for this PHP vulnerability

https://eliastaylor.com/noexploit/
51•zkldi•1h ago•7 comments

Today's PHP security release, and how we're strengthening security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-...
654•ejohnso49•8h ago•325 comments

GitLab Critical Patch Release

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
229•artooro•5h ago•57 comments

Google's Rust Style Guide

https://google.github.io/styleguide/rustguide.html
177•kaycebasques•5h ago•107 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
420•abhisek•10h ago•131 comments

No More Icons in Every Menu by Default

https://blog.jim-nielsen.com/2026/icons-in-every-menu/
139•riffraff•1d ago•99 comments

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
827•hkc•15h ago•398 comments

Why Windows 11 still ships with Windows 95's memory manager hidden inside it

https://www.windowslatest.com/2026/10/19/why-windows-11-still-ships-with-windows-95s-memory-manag...
122•khalidkhair•2d ago•88 comments

Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
327•cbg0•6h ago•203 comments

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://www.bbc.com/news/articles/cp814l80pw2o
142•bryanrasmussen•1d ago•25 comments

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
228•nr378•10h ago•152 comments

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/2026/10/21/announcing-duckdb-200
356•nnx•10h ago•43 comments

Κ = 0.003 for integer multiplication crossed

https://github.com/CrocSwap/integer-mult-bounds/pull/4441
6•aleph_minus_one•1h ago•1 comments

Claude Duet

https://claude.com/product/claude-duet
297•kuberwastaken•5h ago•254 comments

Code is clay now

https://www.albertodenia.com/writing/code-is-clay-now
69•albertodenia•2d ago•35 comments

OpenAI models are coming to Google Cloud

https://openai.com/index/openai-models-google-cloud/
224•armcat•11h ago•98 comments

EA is shutting down BioWare

https://www.theverge.com/games/1015647/ea-is-shutting-down-bioware
497•aaronbrethorst•6h ago•296 comments

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://apnews.com/article/oregon-waterfall-for-sale-lawmakers-996de63462d49ec3ad9bee1629fb9488
166•surprisetalk•9h ago•79 comments

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/
52•simfinii•17h ago•20 comments

The Rise and Fall of the Plasma Screen

https://www.construction-physics.com/p/the-rise-and-fall-of-the-plasma-screen
21•surprisetalk•2d ago•13 comments

Chain of Thought for Humans

https://www.boristhebrave.com/2026/10/18/chain-of-thought-for-humans/
5•ibobev•2d ago•0 comments

New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic

https://www.oist.jp/news-center/news/2026/9/18/new-form-plastic-pollution-discovered-shores-vulne...
93•giuliomagnifico•8h ago•33 comments

PHP 8.2.35

https://github.com/php/php-src/releases/tag/php-8.2.35
958•tuyuri•10h ago•532 comments

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/
101•hayd•3h ago•26 comments

Qpack amplification attacks against HTTP/3 servers

https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
12•kozika•1h ago•1 comments

Airbnb bans making guests do dishes and take out the trash

https://www.theverge.com/tech/1015844/airbnb-chores-house-rules-update
23•babelfish•49m ago•9 comments

CleanFrame: A quieter home screen for Samsung The Frame

https://github.com/nthnclrk/CleanFrame
18•ingve•3h ago•2 comments

Using thousands of AI agents to uncover new leads in biological data

https://openai.com/index/scaling-ai-research-for-complex-biological-data/
126•raahelb•10h ago•81 comments
Open in hackernews

Elliptical Python Programming

https://susam.net/elliptical-python-programming.html
184•sebg•1y ago

Comments

benob•1y ago
TIL that in python, 1--2==3
seplox•1y ago
It's not a python thing. 1-(-2), distribute the negative.
qsort•1y ago
In most C-like languages that would be a syntax error. E.g. in C and C++ as a rule you tokenize "greedily", "1--2" would be tokenized as "1", "unary decrement operator", "2", which is illegal because you're trying to decerment an rvalue.

Python doesn't have "--", which allows the tokenizer to do something else.

nyrikki•1y ago
In C, that is really because Unary minus (negation) has precedence over binary operations.

    +a - b; // equivalent to (+a) - b, NOT +(a - b)
    -c + d; // equivalent to (-c) + d, NOT -(c + d)

https://en.cppreference.com/w/cpp/language/operator_arithmet...

    +-e; // equivalent to +(-e), the unary + is a no-op if “e” is a built-in type
     // because any possible promotion is performed during negation already
The same doesn't apply to, !! Which is applied as iterated binary operations (IIRC)

I am pretty sure the decriment operator came around well after that quirk was established.

seanhunter•1y ago
Peter van der Linden’s book “Expert C Programming” (which is awesome btw) says that one of them (Kernighan, Richie or maybe Ken Thompson I forget) realised early on that the c compiler had the wrong operator precedence for bit twiddling and unary and boolean operators but “at that stage we had a few thousand lines of C code and thought it would be too disruptive to change it”
j2kun•1y ago
Also worth noting that `1 - -2` works and produces 3 in C because the space breaks the operator.
plus•1y ago
For those who are curious, `...` is a placeholder value in Python called Ellipsis. I don't believe it serves any real purpose other than being a placeholder. But it is an object and it implements `__eq__`, and is considered equal to itself. So `...==...` evaluates to `True`. When you prefix a `True` with `-`, it is interpreted as a prefix negation operator and implicitly converts the `True` to a `1`, so `-(...==...)` is equal to `-1`. Then, you add another prefix `-` to turn the `-1` back into `1`.

`--(...==...)--(...==...)` evaluates to `2` because the first block evaluates to 1, as previously mentioned, and then the next `-` is interpreted as an infix subtraction operator. The second `-(...==...)` evaluates to `-1`, so you get `1 - -1` or `2`.

When chaining multiple together, you can leave off the initial `--`, because booleans will be implicitly converted to integers if inserted into an arithmetic expression, e.g. `True - -1` -> `1 - -1` -> `2`.

> There should be one-- and preferably only one --obvious way to do it.

This article is obviously completely tongue-in-cheek, but I feel the need to point out that this sentence is not meant to be a complete inversion of the Perl philosophy of TIMTOWTDI. The word "obvious" is crucial here - there can be more than one way, but ideally only one of the ways is obvious.

pletnes•1y ago
Numpy actively uses … to make slicing multidimensional arrays less verbose. There are also uses in FastAPI along the lines of «go with the default».
abuckenheimer•1y ago
excellent explanation, to add to this since I was curious about the composition, '%c' is an integer presentation type that tells python to format numbers as their corresponding unicode characters[1] so

'%c' * (length_of_string_to_format) % (number, number, ..., length_of_string_to_format_numbers_later)

is the expression being evaluated here after you collapse all of the 1s + math formatting each number in the tuple as a unicode char for each '%c' escape in the string corresponding to its place in the tuple.

[1] https://docs.python.org/3/library/string.html#format-specifi...

elijahbenizzy•1y ago
Ok do this but for JavaScript
voidUpdate•1y ago
https://en.wikipedia.org/wiki/JSFuck
mariocesar•1y ago
If you're curious, the code in ellipsis results in executing:

    print('hello, world')
mturmon•1y ago
Thank you!

I noticed some ** and * in the thing sent to eval(), which (given that the building blocks are small integers) seemed related to prime factorizations.

The initial %c is duplicated 21 times (3*7, if I read correctly), and then string-interpolated (%c%c%c...) against a long tuple of integers. These integers themselves are composed of products of factors combined using * and **.

There is also one tuple "multiplication" embedded within that long tuple of integers -- (a,b)*2 = (a,b,a,b). That is for the 'l' 'l' in "hello".

It's all very clever and amusingly mathy, with a winking allusion to the construction of natural numbers using sets. It made me Godel.

callamdelaney•1y ago
I think we're really starting to over crowd pythons syntax and I'm not a fan.
noddleah•1y ago
you're telling me you never program in python elliptically??
acbart•1y ago
Pretty sure this would have been possible in Python 2.6. The Ellipsis object has been around for a very long time.
MadVikingGod•1y ago
This behavior can be replicated with any class that has two special methods: __neg__ that returns -1 and __sub__ that accepts ints and returns 1-other.

For example if you make this class:

  class _:
       def __neg__(self):
           return -1
       def __sub__(self, other):
           return 1-other
You get similar behavior:

  >>> --_()
  1
  >>> _()--_()
  2
Fun python for everyone.
maxloh•1y ago
You can do this on JavaScript too.

  alert(1)
  // equals to:
  [][(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[+!+[]]]+[+!+[]]+([]+[]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[!+[]+!+[]]])()
https://jsfuck.com/
nomel•1y ago
Expanding on this a little, I will be replacing all occurrences of 2 with two blobs fighting, with shields:

    >>> 0^((...==...)--++--(...==...))^0
    2
rmah•1y ago
>> There should be one-- and preferably only one --obvious way to do it.

Except for package management, of course. There, we need lots and lots of ways.

blooalien•1y ago
And apparently string formatting which should have an ever growing number of ways to handle it. :shrug: