news
Programming Leftovers
-
Bruce Schneier ☛ AIs Compress Exploit Timeline
Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it.
-
Anil Madhavapeddy ☛ Just a rumour of a bug is enough to find a security exploit these days | Anil Madhavapeddy
I released a security fix for OCaml's cohttp 6.3.0 today, fixing a path traversal issue. The patch itself was straightforward and in normal times, the security procedure would have been to fix it privately, inform affected users, and then issue a public advisory. This time around though, I noticed probes in my live webserver logs with the exact bug pattern just minutes after opening the PR to fix the issue.
What's worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we're going to need to change the way we deal with security responses in open source.
-
Andrew Nesbitt ☛ Package Manager Trends
I’m on holiday this week, so I’m phoning it in and doing a roundup of the trends I’ve seen across sixteen weeks of This Week in Package Management. Those posts are built from about eighty RSS feeds and whatever I’ve boosted on Mastodon. The short version: the same defensive features keep shipping in tool after tool, and the same three bug classes keep getting fixed.
-
Julia Programming Language ☛ Julia 1.13 Highlights
Julia version 1.13 has been released. We want to thank all the contributors to this release and all the testers who helped find regressions and issues in the pre-releases. Without you, this release would not have been possible.
The full list of changes can be found in the NEWS file, but here we'll give a more in-depth overview of some of the release highlights.
-
LWN ☛ Julia 1.13 released
Version 1.13 of the Julia programming language has been released. Highlights include faster precompilation of packages, improvements to Julia's REPL, and Juliaup, a graphical interface for the Julia version manager. A full list of changes can be found in the release notes. LWN covered Julia 1.12 in November 2025.
-
Dirk Eddelbuettel ☛ Dirk Eddelbuettel: RDieHarder 0.2.8 on CRAN: Minor Maintenance
An new maintenance version 0.2.8 of the random-number generator tester RDieHarder Bauer and myself along with other contributors) is now on CRAN and available via r2u.
integration was updated a few times, newer nags from R are addressed in Rd files and the vignette, and we also updated a few URLs in the vignette and README.me. No new code, no new features. -
Python
-
Hugo van Kemenade ☛ Soft-deprecating re.match()
And with a more explicit replacement, we’ve soft-deprecated re.match() in Python 3.15:
"We do not plan to remove the older match() name, as it has been used in code for over 30 years. It has been soft deprecated: code supporting older versions of Python should continue to use match(), while new code should prefer prefixmatch()."
Use re.prefixmatch() if you only really meant to use the half-anchor; otherwise use re.search() or re.fullmatch().
-