news
Programming Leftovers
-
Sandor Dargo ☛ C++26: Ordering of constraints involving fold expressions
You have two overloads of g(). One requires A<T> for each element in a pack, the other requires C<T> — where C is a stricter concept that subsumes A. Both apply to the types you’re passing. The compiler should pick the more constrained version. But instead it complains about an ambiguous call.
This is a limitation of how C++20 and 23 handle constraints that use fold expressions — fixed in C++26.
-
Himanshu Anand ☛ 30 Minutes from patch to exploit
In the first post I mentioned that a patch can be turned into a working exploit in 30 minutes. In this blog we will go though detailed analysis of it.
I picked five CVEs from the last three weeks all real and now patched. Impacting the software you probably run. I did patch diffs and an LLM and timed myself withput any insider knowledge and with no prior research on the targets, only public advisory, public commit and a model that can read code.
-
Jon Chiappetta: A Highly Modified ARCF Stream Cipher Implementation In C
So after spending a few years working first on a encrypted proxy solution and then moving to a encrypted tunnel solution, I’ve carried forward this highly modified version of the RC4 stream cipher, trying to tune it up and make improvements to it over time. This latest version includes the following features over the original version.
-
Shell/Bash/Zsh/Ksh
-
Juha-Matti Santala ☛ Tame your pesky little scripts
There are a couple of main ideas that have had a big impact on how I manage them and I've noticed that the amount of scripts and aliases I write has grown immensly after I adopted these.
-
-
Java/Golang
-
Blain Smith ☛ Tracing HTTP Requests with Go's net/http/httptrace
net/http/httptrace has been in the standard library since Go 1.7 and most Go developers I talk to have never used it. It exposes hooks for the points in an outgoing HTTP request that you usually cannot see from outside the transport: DNS resolution, connection acquisition, TLS handshake, the moment bytes go on the wire, the moment the first response byte comes back.
The interesting part is how it plugs in. There is no Tracer interface on http.Client, no middleware to register. You attach a ClientTrace to a context.Context and the transport pulls it back out via httptrace.ContextClientTrace at the points where it matters. I want to walk through that design choice first because it explains how the package composes with the rest of the stdlib, then build two things with it: a curl --trace-style CLI and a reusable http.RoundTripper that logs timings for every request.
-