Programming Leftovers

posted by Roy Schestowitz on Jul 28, 2026

• Cyble Inc ☛ GitLab Vulnerability Enables RCE Through Oj Parser Flaws

  The vulnerabilities included an unchecked nesting-stack write in Oj::Parser.usual.parse and an unsafe 16-bit key-length narrowing issue that leaked a heap pointer. Individually, the bugs appeared limited, offering only a repeated one-byte write primitive and a fixed 29-byte memory disclosure.

  However, by carefully manipulating heap allocation, the exploit gained control of a callback pointer and bypassed Address Space Layout Randomisation (ASLR), enabling arbitrary code execution as the “git” system user.

• Vikash Patel ☛ API Design for Backend Systems

  A practical, opinionated guide to designing backend APIs. Covers request and response schema, offset and keyset pagination, BFF, server-driven UI, caching, versioning, naming, the new HTTP QUERY verb, WebSocket vs SSE, API security (auth headers, server-to-server auth, webhook receivers), and bulk data load APIs. Built around Relay, the same AI proxy system from the multi-tenant SaaS post, with REST and JSON as the running example and Go code throughout.

• Farid Zakaria ☛ Seriously, what is the large code-model even for?

  In a previous post, I documented how I hit simple performance bottlenecks that made me believe that the code-model is largely theoretical in practice. In those cases, the fixes were evident and relatively small; however their omission was a hint at how no one uses the code-model because without them the performance penalty was a non-starter.

• Cédric Bonhomme ☛ Challenging Claude's creativity with IFS fractals and OCaml

  Sixteen years ago, during a functional programming course, I wrote a small OCaml program that draws fractals with iterated function systems (IFS). It is one of my oldest repositories still alive, and it has barely changed since 2010. I have a long standing affection for both OCaml and fractals: I even published a small work about fractals back in 2008. So when I recently got my hands on Claude Fable 5, Anthropic’s new model, I thought this dusty little project would make a perfect playground. Not to fix bugs or refactor code, but to challenge its creativity: could it invent new IFS fractals?

• Mike McQuaid ☛ Open Source Must Be Fun (Or It Will Die) | Mike McQuaid

  I was on a call with a bunch of people involved in other prominent open source projects a few weeks ago. The organiser jokingly asked us to raise our hands if the previous six months had been better than what came before. I raised my hand. No one else did. Why? I’ve maintained Homebrew, the package manager for everywhere, for nearly 17 years. I’ve worked on it the vast majority of weeks in that time and I’ve never burned out. I’m having more fun than ever.

  The current narrative around open source is depressing. Apparently it’s “dying”.

  AI drive-by issues, pull requests and security reports are overwhelming maintainers. Rising security expectations (thanks Mythos) require maintainers to do even more work. Open source funding is hard to secure and insufficient.

  Some of this is happening, but I’m sure as hell not seeing it in Homebrew. Another Homebrew maintainer told me:

  "I’m having more fun than ever before."

• R / R-Script

  • Rlang ☛ June 2026 Top 40 New CRAN Packages

    Four hundred twelve new packages were submitted to CRAN in June. Here are my Top 40 picks in nineteen categories: Bioarchaeology, Biology, Climate Studies, Computational Methods, Ecology, Epidemiology, Finance, Functional Data Analysis, Machine Learning, Medical Statistics, Networks, Pharmacokinetics, Probability, Programming, Psychometrics, Risk Analysis, Statistics, Time Series, and Utilities.

  • Dirk Eddelbuettel ☛ Dirk Eddelbuettel: #057: Conditionally Quieten Compilers

    Welcome to post 57 in the R⁴ series.

    R packages with compiled codes can use the file src/Makevars to set compilation flags. We often rely on this to set libraries, include directories or compilation options. When using external libraries, be it header-only or via headers and linking, we are often experiencing ‘compilation noise’ when these libraries tickle warnings under generally-recommended flags such as -Wall -pedantic. Two packages I maintain are clearly repeat offenders here: Eigen, and BH. Both cam generate pages and pages of compiler output. This is generally not great as it may hide genuine warnings from our own code.

• Python

  • Adam Johnson ☛ Python: inspect interleaved unittest.mock calls with attached mocks

    When you use a unittest.mock mock, you often make assertions on the calls it received, such as through the mock_calls list. But sometimes you want to assert on the order of calls across multiple mocked functions, for example to check that steps in a process happen in the right sequence.

    To do this, use attached mocks, which let you collect calls from multiple mocks into a single timeline. A parent mock has multiple child mocks attached to it, and its mock_calls list records calls from all of its children together, interleaved in the order they actually happened. Sometimes that attachment happens automatically, and sometimes you have to set it up yourself.

  • Adam Young: Teaching Python using a Caesar Cipher

    
    A Caesar cipher is a letter for letter exchange from a clear text to a encrypted text by shifting a set distance in the alphabet. Thus, if your set distance is 2, the letter A becomes C, the letter X becomes Z. To encrypt the last letters of the alphabet, you wrap around to the beginning, so Y becomes A and Z becomes B.

    Caesar is commonly respelled to Ceasar, which I have done for this article. Use the spelling of your choice.
    
    This is a fairly easy algorithm to code, and makes for a decent early class in python. Here are the steps I would go through to teach someone: [...]

• Raku

  • Rakulang ☛ Rakudo Weekly 2026.28/29/30 Thank you!

    After having done the Rakudo Weekly for a year, Steve Roe indicated that they needed a break from doing the Rakudo Weekly, and from Raku more generally.

• Java/Golang

  • SANS ☛ Java Spring Boot "heapdump" scans, (Mon, Jul 27th)

    Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be familiar with a similar concept, core dumps, which are produced by binaries to expose a memory image at the time the software crashes. "heapdumps" are the Java analog to "core-dumps". The heapdump often includes secrets used by the application to connect to backend systems. API keys, database passwords, and other sensitive data may be exposed in the heapdump.