frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

PHP 8.2.35

https://github.com/php/php-src/releases/tag/php-8.2.35
641•tuyuri•2h ago•249 comments

Today's PHP Security Release, and How We're Strengthening PHP Security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-...
98•ejohnso49•53m ago•39 comments

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/2026/10/21/announcing-duckdb-200
192•nnx•2h ago•23 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
115•abhisek•2h ago•53 comments

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
604•hkc•7h ago•262 comments

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://apnews.com/article/oregon-waterfall-for-sale-lawmakers-996de63462d49ec3ad9bee1629fb9488
47•surprisetalk•1h ago•26 comments

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
119•nr378•2h ago•66 comments

PHP2Shell: AI uncovers critical RCE in PHP

https://www.wiz.io/blog/php2shell-php-rce
355•danlark1•2h ago•117 comments

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/
12•simfinii•10h ago•8 comments

Cloudflare deploys protections against php2shell vulnerability

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
44•Maxious•2h ago•4 comments

What I learned from six months of being stupid on purpose

https://wvez.org/blog/learning-to-be-stupid/
8•wvez22•35m ago•2 comments

The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck

https://www.techdirt.com/2026/10/20/accident-or-not-the-no-kings-takedown-is-why-you-shouldnt-ren...
354•robtherobber•2h ago•257 comments

Using thousands of AI agents to uncover new leads in biological data

https://openai.com/index/scaling-ai-research-for-complex-biological-data/
47•raahelb•3h ago•14 comments

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://www.bbc.com/news/articles/cp814l80pw2o
12•bryanrasmussen•1d ago•0 comments

9 Mothers (YC P26) Is Hiring in Austin, TX

https://9mothers.com/careers
1•ukd1•4h ago

Your MCU Likely Escaped the eMudhra Intermediate CA Compromise

https://danielmangum.com/posts/mcu-emudhra-intermediate-ca-compromise/
7•hasheddan•37m ago•0 comments

Drupal is now light-years ahead of its reputation

https://dri.es/state-of-drupal-presentation-september-2026
33•scottfalconer•1d ago•61 comments

The Future of CSS

https://www.joshwcomeau.com/css/interop-2027/
542•soheilpro•14h ago•227 comments

C++ futures part 1: The mental model

https://devblogs.microsoft.com/oldnewthing/20261012-00/?p=112767/
31•ibobev•1d ago•8 comments

OpenAI models are coming to Google Cloud

https://openai.com/index/openai-models-google-cloud/
23•armcat•3h ago•0 comments

Way to Play Super Mario 64: On Apple Vision Pro

https://www.pagetable.com/303
136•frizlab•2d ago•51 comments

Show HN: ULDA – Client-side encryption with a simple JavaScript API

https://demo.ulda.io/
4•nonsence•1d ago•0 comments

LayerFS: The filesystem for AI coding agents

https://layerfs.ai/
58•l2dy•4h ago•31 comments

Show HN: Sumi.css – CSS Framework

https://github.com/vladocar/Sumi.css
31•bepero•3h ago•7 comments

Muse exposes users' personal and business secrets when they share conversations

https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-wh...
312•gumby•15h ago•144 comments

Most advice is right for the person giving it

https://coached.com/essays/most-advice-is-right-for-the-person-giving-it/
123•rohanm93•3h ago•106 comments

Whatever Happened to Fire Escapes

https://practical.engineering/blog/2026/10/20/whatever-happened-to-fire-escapes
147•sohkamyung•6h ago•108 comments

The Decoherence Trap

https://maevyn.codes/decoherence
132•cassianoleal•2d ago•57 comments

The Lucrative World of Literary Scams

https://www.thedial.world/articles/news/ai-book-scams
50•samclemens•2d ago•6 comments

Delays for Pull Requests and Webhook deliveries

https://www.githubstatus.com/incidents/nms1dpzmh9d9
47•bearsyankees•1h ago•9 comments
Open in hackernews

Making code last a long time

https://twitter.com/jonathan_blow/status/1923414922484232404
28•robinhouston•1y ago

Comments

turtleyacht•1y ago
Make and maintain the virtual machine that runs your program, which executes custom instructions.

See uxn and justification: https://wiki.xxiivv.com/site/now_lie_in_it.html

And https://100r.co/site/story.html

kevmo314•1y ago
> The way you make code last a long time is you minimize dependencies that are likely to change and, to the extent you must take such dependencies, you minimize the contact surface between your program and those dependencies.

A lot of value is driven from those dependencies though. Zapier as a pointed example: Zapier sans dependencies is ... well I don't even know. So sure, you could avoid dependencies at all cost, but at some point you might end up deleting the reason someone else wants to use your code in the first place.

Of course, if you're writing code only for yourself that will totally work, but most professional software engineers are not -- it's a balance and it's not fair to say all they have to do is stop writing glue code.

j45•1y ago
Your example of Zapier dependence resonates - being sure to put a simple layer between your code and Zapier is the critical component.

The code makes the same call to a Zapier type command but it could be routed to Zapier today, and somewhere else in the future.

This can take a nominal amount of time longer than integrating Zapier directly.

It could be a couple more tables to setup and manage, or it can be done in the code somewhere.

caseyohara•1y ago
I've been working on the same product for ~13 years and I can confidently say the most important thing to ensure the longevity and long-term maintainability of a codebase is aggressive minimization of dependencies.

Engineering is all about compromises. If near-term velocity is more important to you than long-term evolution and maintainability, then go ahead and use all of the dependencies if it allows you to ship faster. But that is a form of technical debt that you will have to pay down eventually.

QuadrupleA•1y ago
What are you doing with Zapier that you couldn't do with your own code, or carefully curated small set of libraries? For networked services, the REST APIs of popular providers (Stripe, AWS, etc.) are usually kept backwards compatible for a long time.
henning•1y ago
I was about to comment how easy Zig makes it to make platform layers where the right code for an OS is compiled at compile-time and AFAIK there is no runtime cost, it's basically conditional compilation. But the Zig language itself is incredibly unstable and code you write now probably won't compile a year from now.
taylorallred•1y ago
This seems like another case where jblow's opinions are guided by his experience as a game dev. Games can be "finished" and never touched again. I think I mostly agree with him that software could be made to be timeless to some degree. But, in the world of web apps and saas, the culture is to offload much of the work to third party libraries/APIs which locks you into a never-ending cycle of dependency management. I don't know if this culture is totally necessary (maybe to ship fast and keep up with security updates?), but in a world where users expect software to be constantly improving you can't expect anything to be "done". Maybe you could get close if you built everything in-house, but even still you have to keep up with security flaws.
QuadrupleA•1y ago
From experience - if you look at the "security flaws" in detail that updates and patches address, an app with good dependency hygiene is rarely vulnerable to them, and doesn't need the purported fixes. So in those cases it's mostly a comforting mirage that your software is improving as you do "security updates" on your libraries and dependencies, except in rare cases.

And, security updates should not break your app! What breaks your app are feature changes, API changes, and the like, which is a breach of backwards compatibility and IMHO kind of lazy and hostile on the part of the library developers. It creates massive unnecessary work for developers, and unnecessary bugs and problems for millions of end users.

boznz•1y ago
Software in a closed ecosystem should run for the life of that ecosystem, an example would be Firmware on a non-connected device. eg the ECU in my car from 1991.
juancn•1y ago
I kind of agree. There's another world, where software lasts a really long time, it's a much better world, but just a few of us get to live in it.

Building tools for other engineers is where it's at, the library maintainers for long lived libraries, like libc or any collections library.

If you get a sorting algorithm in a mainstream language library, it will likely live forever (or forever-ish in software terms).

The harder the problem you solve (in the math sense) the more likely that if you craft that code properly and carefully, it will outlive you.

burnt-resistor•1y ago
Well, when I was in school, the goals were wide compatibility and portability. I was writing network C code in the 00's that could run without any changes on Windows, Linux, FreeBSD, HP-UX, AIX, SGI, SCO, and Solaris.

Code only "rots" when its dependencies rot from assholes who churn the language or break API promises. These low expectations lead to normalization of deviancy that churn without clear and present value is "okay", when it's merely job security or coding theater to appease others that everything must be touched and changed constantly or otherwise it's "broken".