frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

PHP 8.2.35

https://github.com/php/php-src/releases/tag/php-8.2.35
670•tuyuri•3h ago•264 comments

Today's PHP Security Release, and How We're Strengthening PHP Security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-...
127•ejohnso49•1h ago•53 comments

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/2026/10/21/announcing-duckdb-200
205•nnx•2h ago•23 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
128•abhisek•2h ago•54 comments

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
130•nr378•2h ago•70 comments

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
611•hkc•7h ago•267 comments

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://apnews.com/article/oregon-waterfall-for-sale-lawmakers-996de63462d49ec3ad9bee1629fb9488
52•surprisetalk•1h ago•31 comments

PHP2Shell: AI uncovers critical RCE in PHP

https://www.wiz.io/blog/php2shell-php-rce
365•danlark1•3h ago•123 comments

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://www.bbc.com/news/articles/cp814l80pw2o
21•bryanrasmussen•1d ago•0 comments

What I learned from six months of being stupid on purpose

https://wvez.org/blog/learning-to-be-stupid/
18•wvez22•46m ago•3 comments

Cloudflare deploys protections against php2shell vulnerability

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
55•Maxious•2h ago•5 comments

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/
13•simfinii•10h ago•9 comments

Your MCU Likely Escaped the eMudhra Intermediate CA Compromise

https://danielmangum.com/posts/mcu-emudhra-intermediate-ca-compromise/
9•hasheddan•48m ago•3 comments

Using thousands of AI agents to uncover new leads in biological data

https://openai.com/index/scaling-ai-research-for-complex-biological-data/
50•raahelb•3h ago•14 comments

Drupal is now light-years ahead of its reputation

https://dri.es/state-of-drupal-presentation-september-2026
37•scottfalconer•1d ago•63 comments

9 Mothers (YC P26) Is Hiring in Austin, TX

https://9mothers.com/careers
1•ukd1•4h ago

The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck

https://www.techdirt.com/2026/10/20/accident-or-not-the-no-kings-takedown-is-why-you-shouldnt-ren...
371•robtherobber•2h ago•285 comments

OpenAI models are coming to Google Cloud

https://openai.com/index/openai-models-google-cloud/
30•armcat•3h ago•1 comments

The Future of CSS

https://www.joshwcomeau.com/css/interop-2027/
548•soheilpro•15h ago•228 comments

Rust off Rails: The opinionated web stack for the AI era

https://rustoffrails.org/
5•mike1o1•18m ago•0 comments

C++ futures part 1: The mental model

https://devblogs.microsoft.com/oldnewthing/20261012-00/?p=112767/
31•ibobev•1d ago•8 comments

Way to Play Super Mario 64: On Apple Vision Pro

https://www.pagetable.com/303
140•frizlab•2d ago•52 comments

Show HN: ULDA – Client-side encryption with a simple JavaScript API

https://demo.ulda.io/
4•nonsence•1d ago•0 comments

Show HN: Sumi.css – CSS Framework

https://github.com/vladocar/Sumi.css
33•bepero•4h ago•8 comments

Muse exposes users' personal and business secrets when they share conversations

https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-wh...
314•gumby•16h ago•144 comments

AI agent fixed the bug, but what else did it change?

https://blog.trailofbits.com/2026/10/21/your-ai-agent-fixed-the-bug-but-what-else-did-it-change/
9•tob_scott_a•49m ago•1 comments

LayerFS: The filesystem for AI coding agents

https://layerfs.ai/
61•l2dy•4h ago•32 comments

The Decoherence Trap

https://maevyn.codes/decoherence
134•cassianoleal•2d ago•57 comments

Whatever Happened to Fire Escapes

https://practical.engineering/blog/2026/10/20/whatever-happened-to-fire-escapes
148•sohkamyung•6h ago•111 comments

The Lucrative World of Literary Scams

https://www.thedial.world/articles/news/ai-book-scams
52•samclemens•2d ago•6 comments
Open in hackernews

Why GADTs matter for performance (2015)

https://blog.janestreet.com/why-gadts-matter-for-performance/
83•hyperbrainer•1y ago

Comments

rbjorklin•1y ago
Does anyone have some hard numbers on the expected performance uplift when using GADTs? Couldn't see any mentioned in the article.
ackfoobar•1y ago
The example here is basically an 8-fold memory saving going from `long[]` from `byte[]` - while still retaining polymorphism (whereas in Java the two are unrelated types).

Hard to say exactly how much performance one would get, as that depends on access patterns.

misja111•1y ago
The reason that a byte array is in reality layed out as a (mostly empty) long array in Java, is actually for performance. Computers tend to have their memory aligned at 8 byte intervals and accessing such an address is faster than accessing an address that's at an offset of an 8 byte interval.

Of course it depends on your use case, in some cases a compact byte array performs better anyway, for instance because now you're able to fit it in your CPU cache.

john-h-k•1y ago
But you can load any byte by loading 8 bytes and shift (v cheap)
ackfoobar•1y ago
> a byte array is in reality layed out as a (mostly empty) long array in Java

Are you saying each byte takes up a word? That is the case in the `char array` in OCaml, but not Java's `byte[]`. AFAIK The size of a byte array is rounded up to words. Byte arrays of length 1-8 all have the same size in a 64-bit machine, then length 7-16 take up one more word.

https://shipilev.net/jvm/objects-inside-out/

cosmic_quanta•1y ago
Interesting, thanks for posting.

I share the author's frustration with the lack of non-compiler-related examples of GADT uses. It seems like such a powerful idea, but I haven't been able to get a feel for when to reach for GADTs in Haskell

wyager•1y ago
I often find them handy for locking down admissible states at compile time. Maybe ~10 years ago in a processor design class, I wrote some CPUs in Haskell/Clash for FPGA usage. A nice thing I could do was write a single top-level instruction set, but then lock down the instructions based on what stages of the processor they could exist at.

For example, something like (not an actual example from my code, just conceptually - may be misremembering details):

  data Instruction stages where
   MovLit :: Word64 -> Register -> Instruction '[Fetch, Decode, Execute, Writeback]
   -- MovReg instruction gets rewritten to MovLit in Execute stage
   MovReg :: Register -> Register -> Instruction '[Fetch, Decode, Execute]
   ...
And then my CPU's writeback handler block could be something like:

  writeback :: (Writeback `member` stages) => Instruction stages -> WritebackState -> WritebackState
  writeback (MovLit v reg) = ...
  -- Compiler knows (MovReg _ _) is not required here
So you can use the type parameters to impose constraints on the allowed values, and the compiler is smart enough to use this data during exhaustiveness checks (cf "GADTs Meet Their Match")
anyfoo•1y ago
Wow, someone else who (used to be) using Clash. I still use it for everything I can in my (hobby) FPGA projects. I'm not sure I've used GADTs, but I've certainly made use of other more "advanced" parts of the type system, like type families.

What you're doing here is pretty cool, I think I will start doing so, too. I have a number of places where I use "undefined" instead. (The "undefined" from the Clash Prelude, which translates into a "don't care" signal state.)

hyperbrainer•1y ago
Related: https://github.com/ocaml/RFCs/blob/881b220adc1f358ab15f7743d...
goldchainposse•1y ago
I know Jane Street love OCaml, but you have to wonder how much it's cost them in velocity and maintenance. This is a quant firm blogging about a programming language they're the most famous user of.
pjmlp•1y ago
It is thanks to the companies like Jane Street that believe there is something else beyond C, that we can have nice toys.

Remember if OCaml wasn't a mature programming language, maybe Rust would not have happened in first place.

kryptiskt•1y ago
Why do you assume it's a drag for them and not a competitive advantage? I don't know if it's such a terrible thing to use a slightly out of mainstream language, when the standard in the business is to accumulate tens of millions of lines of C++.
ackfoobar•1y ago
Agreed, indeed I believe they have mentioned that OCaml gets them to ship quicker because they are more confident with the correctness of changes.

But being outside of the mainstream may mean you need to occasionally debug more esoteric stuff: https://gallium.inria.fr/blog/intel-skylake-bug/ I'm sure Jane Street can afford doing that, but I'm not so sure if a small team can.

gjadi•1y ago
That was an interesting read, thanks. However I fail to see how it's an issue specific to ocaml. It was a bug in the Skylake processor triggered by a special pattern of instructions produced by gcc. Ocaml built with clang was ok because it doesn't used the same pattern. Did I miss something?
cryptonector•1y ago
What's not clear from reading TFA is whether the compiler monomorphizes TFA's `Compact_array` for the two special cases of it (array of bytes vs. array of anything else), but I'm assuming so. Perhaps if I was familiar with OCaml the answer would be blindingly obvious. What's happening here is that w/ GADTs you can have a _singular_ abstraction with multiple distinct implementations for specific types and others for generic types, and you don't have to think about it too much, except you have to remember to use these type hints in the interface definitions to get the compiler to do what you want.

> Yaron Minsky joined Jane Street back in 2002, and claims the dubious honor of having convinced the firm to start using OCaml.

That's pretty cool. And I guess Stephen Dolan ended up there due to his work on OCaml, which is pretty cool too. (I'd like to meet Stephen some day.)

wyager•1y ago
Clash is awesome, IMO by far the best extant HDL.

I semi-recently used it for this ADAT fiber optic audio codec https://github.com/YagerICS/adat-codec

anyfoo•1y ago
Awesome. I see you've made full use of Hedgehog as well.
ackfoobar•1y ago
If the JVM encountered the same bug other people would have discovered it before me. Most probably I won't even know the bug exists.
goldchainposse•1y ago
> Why do you assume it's a drag for them and not a competitive advantage?

Because despite them being very open about it, no one else does it, and every distinguished engineer who pushes a weird tech choice will justify and defend it.

cdaringe•1y ago
People that haven’t used ocaml think it’s weird. I picked it up casually in 2020. It might not be popular, but it’s certainly not weird. It’s actually quite fantastic. These days I rarely ever use it, but I wish I did!
keybored•1y ago
Concretely how do you think it’s holding them back? Just by being niche?
anyfoo•1y ago
There are many things to say about this, but one of those things is that I think you are making the assumption that an (e.g.) C programmer who does not want (or even cannot) get into OCaml would somehow be better for this highly specialized, high-performance, and high-correctness-affine use case, than someone who does. And I'd question that assumption.
fjwufjfa•1y ago
It's easier to reason in FP plus the python paradox [1] [2].

[1]: https://www.paulgraham.com/pypar.html

[2]: https://blog.janestreet.com/why-ocaml/

codr7•1y ago
For certain classes of programs, yes. I have a hunch finance is a pretty good fit.
AdieuToLogic•1y ago
I agree with your point about reasoning when employing Functional Programming (FP).

However, I very much disagree with Graham's 2004 assertion[0]:

  It's a lot of work to learn a new programming language. And 
  people don't learn Python because it will get them a job; 
  they learn it because they genuinely like to program and 
  aren't satisfied with the languages they already know.
It does not require "a lot of work to learn a new programming language" once a person has fluency with at least one. Actually, the difficulty of learning a new programming language is inversely proportional to how many programming languages the person has already learned. Especially if a new programming language is in the same paradigm category as those already known (Procedural, OOP, FP, etc.).

I was a professional software engineer in 2004, when the Graham post was written. To say, "people don't learn Python because it will get them a job ..." was bullshit then just as it is now. The remainder of the quoted sentence is unfounded extrapolation and has the value of same.

0 - https://www.paulgraham.com/pypar.html

lmm•1y ago
Jane Street has been one of the most successful financial firms of the last 10 years or so, going from a niche hedge fund to a big player. Sounds like OCaml has been working out for them. Certainly I know it's helped them hire a lot of excellent programmers.