Programming Leftovers

posted by Roy Schestowitz on Sep 16, 2026

• It's FOSS ☛ Rune Goes Open Source, Looks to Share Revenue With Contributors

  The Go-based IDE is now available under GPLv3, and contributors keep the rights to their work.

• SQ Magazine ☛ GitLab CVE-2026-85706 Exploited, CISA Adds to KEV

  The Cybersecurity and Infrastructure Security Agency confirmed on September 11 that hackers are actively exploiting a maximum-severity flaw in GitLab’s development platform, adding the bug to its Known Exploited Vulnerabilities catalog and giving federal agencies until September 14 to patch.

• Gwen Lofman ☛ tidal-innards

  tidal is a music sequencer, implemented as a haskell library. It supports live manipulation of patterns in a Read-Eval-Print Loop or REPL. It is one of the original tools for livecoding: a type of performance art where the artist writes and shares code live that produces music, visuals, poetry, coreography and more.

• Fortran Lang ☛ Celebrating 70 years of Fortran — Fortran Programming Language

  One month from today (15th October) marks seventy years since the first Fortran manual was published, making it an extremely well established programming language for scientific computing.

  Over Fortran’s seven decades of usage, it has supported critical infrastructure and technological advances in a range of scientific fields such as nuclear engineering, weather and climate forecasting, and materials science. Fortran continues to be the go-to language in these domains and others.

  To celebrate Fortran’s outstanding contributions to advancing science and engineering, the Institute of Computing for Climate Science (ICCS) will be hosting a ‘Celebrating 70 years of Fortran’ event at the Science and Industry Museum in Manchester, United Kingdom, on 1st December 2026.

• Daniel Lemire ☛ Subnormal floating-point numbers are expensive… on Intel processors

  We represent floating-point numbers using the IEEE standard. For very small numbers, the standard uses special subnormal numbers. Unfortunately, they have a reputation of making operations slow. Thus video game programmers and machine learning specialists sometimes avoid computing with subnormal numbers for performance.

  How slow are they? Let me measure. I wrote a small C++ benchmark with a few kernels over arrays of 16384 values (small enough to fit in cache): [...]

• R / R-Script

  • rOpenSci ☛ rOpenSci | Happy Birthday rOpenSci — My Journey from First-Time Developer to Current Opportunities

    My first time hearing about rOpenSci was, interestingly, at a bird conference. At an ornithological conference in 2023, I was chatting with my bird friend / colleague Steffi LaZerte, who highly recommended that I apply for the rOpenSci Champions program given my strong interest in developing R packages. I mentioned my concerns and hesitation about whether I am “qualified” to make an R package, which at that time sounded like what professional developers do. She simply asked, “Can you write functions in R?” “Yes, I can.” “Then you are good to go! R packages are simply putting functions together in an organized way!” So here we go, I took the motivation and sent out my application for the 2024 rOpenSci cohort. A few months later, I was selected as one of the 20 participants around the world; I remember the strong excitement when I received the confirmation letter from rOpenSci. I was probably even more excited than when I got my PhD admission!

  • R Studio Data Lab ☛ Grubbs' Test in R: grubbs.test() Explained with a Real Example

    Run Grubbs' test in R with grubbs.test() from the outliers package. Real mtcars example (G, U, p-value), when it applies, and what to do next.

• Python

  • Andrew Nesbitt ☛ Shadowing the Standard Library

    I was reading Johann Rehberger’s write-up of an attack on a coding agent last week. The payload is a file called struct.py inside a zip archive. The agent unpacks the archive, writes its own small Python decoder in the extracted directory, and runs it. The decoder does import base64, base64 internally does import struct, and Python resolves that to the attacker’s file because the script’s directory is the first entry on sys.path. Module-level code runs on import. The poisoned module re-exports the real _struct API so decoding still produces valid output and execution continues, and the payload relaunches itself with python3 -I so the second interpreter starts with a clean module path.