Programming Leftovers

posted by Roy Schestowitz on Jul 23, 2026

• Hackaday ☛ Compile Here, Run Everywhere: Crosstool-Ng

  In a recent post, I mentioned that I wanted to build some tools for a stripped-down Linux running on a 3D printer with a MIPS CPU. I had two options: build a toolchain to cross-compile, or use Zig, which, in theory, has built-in toolchains for MIPS. I had to jump through hoops to get Zig to work, and I did mention Crosstool-Ng, so you might wonder why I didn’t start there. Turns out, it had its own set of hoops to work through.

• Sandor Dargo ☛ The Portable Way to Extract Date and Time from a File's mtime in C++

  Fair question. You call std::filesystem::last_write_time(), you get back a time point, and you want the calendar components. How hard can it be?

  Harder than it should be. The answer touches three layers of portability problems — different epochs, different conversion APIs, and incomplete standard library implementations. Let’s dig in.

• Niels Provos ☛ Security at Machine Speed Is the Wrong Race

  The prospect of autonomous exploitation predates current language models. At DEF CON in 2016, DARPA held the Cyber Grand Challenge, an all-machine hacking competition in which autonomous systems discovered, proved, and repaired software vulnerabilities in real time. The Cyber Grand Challenge systems operated in a constrained environment against purpose-built targets and demonstrated that machines could reason about vulnerable software, generate working exploits, and react to one another without human assistance. The security community has had a decade to plan for the day when this capability would work across ordinary software and infrastructure.

• Alisa Sireneva ☛ log is non-monotonic in PHP and Lua

  If a>b>1 and x>1, you can prove that loga⁡x<logb⁡x. (As a reminder, loga⁡x denotes the value t such that x=at.) This is very intuitive if you think about it: for “normal” numbers, the greater a, the smaller t you will need to get the same x.

  Yet if you ask PHP what it thinks, it will tell you you’re wrong in a couple rare cases: [...]

• Gustav Wengel ☛ The Value of Domain Knowledge in Software

  Something that I think is often overlooked by many software developers is the value of domain knowledge, i.e. understanding the industry you’re in and the mindset of the end-users of your software.

  I actually think that explicitly spending time to acquire domain knowledge might be one of the best uses of your time as a software developer for a few reasons: [...]

• LWN ☛ QBE 1.3: metaprogramming, performance, and cross-platform support

  QBE, a compact compiler backend developed by Quentin Carbonneaux, is a lightweight alternative to larger compiler backends such as LLVM and GCC. Designed to be small enough for a single developer to understand, QBE uses a static single-assignment (SSA) intermediate representation (IR), supports the C ABI, and serves as the backend for projects such as Hare and the cproc C11 compiler. Frontends emit the textual form of QBE's IR directly; QBE then takes care of register allocation, optimization, and native-code generation, producing assembly for the target architecture.

  QBE is MIT-licensed, and has had 38 contributors, although Carbonneaux is by far the most prolific. On June 2, 2026, version 1.3 was released. Described in the release notes as the most significant update since 1.0 in 2022, the release adds roughly 7,000 lines of code while removing 1,500. It introduces a number of architectural changes aimed at improving the performance of code compiled with QBE, simplifying backend development via metaprogramming, and expanding platform support.

• Perl / Raku

  • Arne Sommer ☛ Similar RGB List with Raku

    Some observations about the «similar words map», used to translate the words in list1 to list2. (And yes, I have chosen to call list3 a «translation list»): [...]

• Python

  • LWN ☛ PyPI now rejects new files after 14 days

    Python Software Foundation security developer-in-residence Seth Larson has announced that the Python Package Index (PyPI) will now reject new files that are uploaded to releases older than 14 days. The restriction is to prevent the poisoning of old releases if publishing tokens or workflows of PyPI projects are compromised.

  • Jeff Geerling ☛ Open Sauce and GPS time were my summer Hey Hi (AI) Antiseptics

    In the midst of our Hey Hi (AI) slop revolution, traveling to the West coast for Open Sauce this past weekend was the perfect antiseptic for rising costs, summer heat, and online divisiveness.

    It's ironic, then, that I used Claude to vibe code my Tufty GPS Time Badge.

    Partly due to time constraints, and partly because I wanted to see if I could complete a personal project end-to-end, without editing a line of code, I throw my requirements at Claude and ultimately came up with this 2141-line MicroPython app for Pimoroni's Badgeware ecosystem.

  • Seth Michael Larson ☛ PAL GameCube haul from Kraków, Poland (EuroPython 2026)

    While I was in Kraków, Poland during EuroPython 2026 I was able to sneak away from sprints and buy a few PAL region GameCube games for my collection. This was on Sunday, which means that many stores are closed until Monday... except for one! “Game Over” was open and the owner was very friendly and chatted with me as I browsed the selection.

  • Adam Johnson ☛ Django: introducing django-crawl - Adam Johnson

    I recently migrated one of my client projects from the legacy django-csp package to Django 6.0’s built-in Content Security Policy (CSP) support (release note). This security header is a powerful tool for preventing unwanted content from being loaded on your site, so configuration correctness is paramount. The migration was fairly straightforward, but a few pages had complicated overrides, so I wanted to be sure that no CSP headers had been changed by my swapping of CSP implementations.

  • Python Package Index ☛ Releases now reject new files after 14 days - The Python Package Index Blog

    The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

    Users should not yet rely on this behavior as there are no defined semantics for "releases no longer accepting new files" or APIs available to confirm the state of the release. Instead, these semantics will be defined once "Upload 2.0 API" and "Staged Previews" have been standardized by PEP 694.

• Rust

  • Rust Weekly Updates ☛ This Week In Rust: This Week in Rust 661

    Hello and welcome to another issue of This Week in Rust!