frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

CVE-2026-111943: Compromised Intermediate Certificate Authority

https://nvd.nist.gov/vuln/detail/cve-2026-111943
203•keks24•3h ago•54 comments

Faster than earcut: triangulating 3.7M map polygons in 489 ms

https://globus.software/blog/2026/10/16/cutting-map-polygons/
75•molind•3h ago•16 comments

Jailbreaking the Switch 2

https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/
158•ledoge•4h ago•52 comments

What Is Gridifcation

https://musicalform.substack.com/p/what-is-gridifcation
14•gumby•3d ago•1 comments

WorldTUI: I trained a 360M model to pretend to be a terminal

https://simedw.com/2026/10/21/world-model-terminal/
309•alphax314•10h ago•92 comments

The recently proposed o(n log n) integer multiplication algorithm [pdf]

https://web.maths.unsw.edu.au/~davidharvey/research/subnlogn.pdf
230•craigcitro•10h ago•173 comments

Several Linux kernel vulnerabilities accidentally posted to public mailing list

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
76•mrkn1•1h ago•17 comments

Security Disclosure

https://blog.railway.com/p/security-disclosure-wednesday-october-21st
503•passenger•14h ago•293 comments

Xbox wants you to pay 24 to 40 cents per hour to stream games you bought

https://arstechnica.com/gaming/2026/10/xbox-wants-you-to-pay-24-to-40-cents-per-hour-to-stream-ga...
50•entryleveljobsc•56m ago•49 comments

Startup taps underwater volcano as energy source in "proof point" test

https://arstechnica.com/science/2026/10/startup-taps-underwater-volcano-as-energy-source-in-proof...
29•wffurr•2d ago•12 comments

Claude Duet

https://claude.com/product/claude-duet
439•kuberwastaken•17h ago•400 comments

No more icons in every menu by default

https://blog.jim-nielsen.com/2026/icons-in-every-menu/
368•riffraff•2d ago•218 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
544•abhisek•22h ago•175 comments

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitatio...
30•cubefox•48m ago•2 comments

Rust Style Guide

https://google.github.io/styleguide/rustguide.html
332•kaycebasques•17h ago•195 comments

GitLab critical patch release

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
365•artooro•17h ago•86 comments

Using LLM for confidence scoring is a bad idea

https://rumple.github.io/blog/2026/10/20/asking-llm-for-confidence.html
122•jimauthors•1d ago•66 comments

OpenAI CLI

https://github.com/openai/openai-cli
160•armcat•7h ago•82 comments

The Robot I Didn't Expect to Build

https://spectrum.ieee.org/agility-robotics-digit-5-redesign
22•bojackh•2d ago•18 comments

PingCap TiDB Leaks

https://fulcrumsec.vg/pingcap/
374•swyx•1d ago•62 comments

What Is the Karakoram Anomaly?

https://nsidc.org/learn/ask-scientist/karakoram-anomaly-it-real
48•thunderbong•2d ago•8 comments

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://www.bbc.com/news/articles/cp814l80pw2o
236•bryanrasmussen•2d ago•51 comments

Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
598•cbg0•18h ago•342 comments

Code is clay now

https://www.albertodenia.com/writing/code-is-clay-now
198•albertodenia•2d ago•131 comments

Eigenmoon: linear algebra puzzles by moonlight

https://eigenmoon.vercel.app/
6•jessicarumbelow•2d ago•3 comments

OpenAI models are coming to Google Cloud

https://openai.com/index/openai-models-google-cloud/
304•armcat•23h ago•126 comments

Beyond the &

https://lwn.net/Articles/1096028/
81•PaulHoule•1d ago•9 comments

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/2026/10/21/announcing-duckdb-200
432•nnx•22h ago•58 comments

mitmproxy adds --emudhra option

https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b
523•ahlCVA•12h ago•124 comments

Today's PHP security release, and how we're strengthening security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-...
759•ejohnso49•20h ago•374 comments
Open in hackernews

Falsify: Hypothesis-Inspired Shrinking for Haskell (2023)

https://www.well-typed.com/blog/2023/04/falsify/
90•birdculture•1y ago

Comments

sshine•1y ago
How does Hedgehog and Hypothesis differ in their shrinking strategies?

The article uses the words "integrated" vs. "internal" shrinking.

> the raison d’être of internal shrinking: it doesn’t matter that we cannot shrink the two generators independently, because we are not shrinking generators! Instead, we just shrink the samples that feed into those generators.

Besides that it seems like falsify has many of the same features like choice of ranges and distributions.

_jackdk_•1y ago
This is the key sentence:

> The key insight of the Hypothesis library is that instead of shrinking generated values, we instead shrink the samples produced by the PRNG.

Hedgehog loses shrink information when you do a monadic bind (Gen a -> (a -> Gen b) -> Gen b). Hypothesis parses values out of the stream of data generated by the PRNG, so when it "binds", you are still just consuming off that stream of random numbers, and you can shrink the stream to shrink the generated values.

Here is a talk that applies the Hypothesis idea to test C++: https://www.youtube.com/watch?v=C6joICx1XMY . Discussion of PBT implementation approaches begins at 6:30.

thesz•1y ago
This is fascinating!

If I understand correctly, they approximate language of inputs of a function to discover minimal (in some sense, like "shortest description length") inputs that violate relations between inputs and outputs of a function under scrutiny.

evertedsphere•1y ago

    newtype Parser a = Parser ([Word] -> (a, [Word])
missing a paren here
moomin•1y ago
I’m honestly completely failing to understand the basic idea here. What does this look like for generating and shrinking random strings,
chriswarbo•1y ago
One straightforward approach would be:

- Generate a random number N for the size (maybe restricted to some Range)

- Generate N `Char` values, by using a random number for each code point.

- Combine those Chars into a string

falsify runs a generator by applying it to an infinite binary tree, with random numbers in the nodes. A generator can either consume a single number (taken from the root node of a tree), or it can run two other generators (one gets run on the left child, the other gets run on the right). Hence the above generator would use the value in the left child as N, then run the "generate N Chars" generator on the right child. The latter generator would run a Char generator on its left child, and an 'N-1 Chars' generator on its right child; and so on.

To shrink, we just run the generator on a tree with smaller numbers. In this case, a smaller number in the left child will cause fewer Chars to be generated; and smaller numbers in the right tree will cause lower code-points to be generated. falsify's tree representation also has a special case for the smallest tree (which returns 0 for its root, and itself for each child).

mjw1007•1y ago
I've found in practice that shrinking to get the "smallest amount of detail" is often unhelpful.

Suppose I have a function which takes four string parameters, and I have a bug which means it crashes if the third is empty.

I'd rather see this in the failure report:

("ldiuhuh!skdfh", "nd#lkgjdflkgdfg", "", "dc9ofugdl ifugidlugfoidufog")

than this:

("", "", "", "")

gwern•1y ago
Really? Your examples seem the opposite. I am left immediately thinking, "hm, is it failing on a '!', some sort of shell issue? Or is it truncating the string on '#', maybe? Or wait, there's a space in the third one, that looks pretty dangerous, as well as noticeably longer so there could be a length issue..." As opposed to the shrunk version where I immediately think, "uh oh: one of them is not handling an empty input correctly." Also, way easier to read, copy-paste, and type.
dullcrisp•1y ago
Their point is that in the unshrunk example the “special” value stands out.

I guess if we were even more clever we could get to something more like (…, …, "", …).

gwern•1y ago
The special value doesn't stand out, though. All three examples I gave were what I thought skimming his comment before my brain caught up to his caveat about an empty third argument. The empty string looked like it was by far the most harmless part... Whereas if they are all empty strings, then by definition the empty string stands out as the most suspicious possible part.
tybug•1y ago
shae•1y ago
I care about the edge between "this value fails, one value over succeeds". I wish shrinking were fast enough to tell me if there are multiple edges between those values.
The Hypothesis explain phase [1][2] does this!

  fails_on_empty_third_arg(
      a = "",  # or any other generated value
      b = "",  # or any other generated value
      c = "",  
      d = "",  # or any other generated value
  )
[1] https://hypothesis.readthedocs.io/en/latest/reference/api.ht...

[2] https://github.com/HypothesisWorks/hypothesis/pull/3555

chriswarbo•1y ago
> As opposed to the shrunk version where I immediately think, "uh oh: one of them is not handling an empty input correctly."

I agree that non-empty strings are worse, but unfortunately `("", "", "", "")` wouldn't only make me think of empty strings; e.g. I'd wonder whether duplicate/equal values are the problem.

chriswarbo•1y ago
> I'd rather see this in the failure report:

> ("ldiuhuh!skdfh", "nd#lkgjdflkgdfg", "", "dc9ofugdl ifugidlugfoidufog")

I would prefer LazySmallcheck's result, which would be the following:

    (_, _, "", _)
Where `_` indicates that part of the input wasn't evaluated.
yorwba•1y ago
A minimal reproducing example cannot guarantee that you'll correctly diagnose a bug just by looking at the example (because multiple potential bugs could cause the same example to fail) but it can guarantee that when you step through the code to understand what's happening, you won't have to deal with huge amounts of irrelevant data.

Maybe an alternative shrinking procedure could directly minimize the number of instructions that need to be executed to hit a failure...

edsko•1y ago
(Author of falsify here.) You are absolutely correct that the empty string isn't always the best counter-example. The goal of shrinking is to shrink to the _simplest_ possible value (this is true for all approaches to shrinking). What constitutes "simple" is very much domain specific. It would certainly be possible to write a generator that would shrink to, say, "foo", as the canonical "simplest" example of a simple string. Indeed, since we are working in a lazy language, you could (with a bit of effort) shrink to `undefined` if the other arguments are not used at all.
mjw1007•1y ago
I agree it can be domain-specific, but I think it's more common than not that empty containers, and the number zero, are corner cases rather than typical values.

So I think it would be a decent quality-of-life improvement to make generators of the sort you suggest easily available, and have the tutorial docs use them from the start.