news
Programming Leftovers
-
Rishi Baldawa ☛ Tickets Should Talk Back
Most tickets are still static records of a request. You fill out a form, hand it over to some future person, and hope you included enough detail. That made sense when the tracker was mostly a queue, but now the tracker can be somewhat sentient and leverage tools. It can look at the deployment history, fetch a trace, attempt a reproduction, and ask a question or two. The ticket does not have to be a flawless, one-time instruction. It can be a place where the reporter, the system, and whoever is doing the work improve their understanding together.
-
Kyle Reddoch ☛ When MSPs Should Push Back on Client IT and Security Requests
The distinction matters because a support request often arrives with a proposed solution already attached. An employee cannot install something, so the request is to make everyone a local administrator. A business application stops working, so the request is to disable endpoint protection. A departing employee’s mailbox needs to remain accessible, so someone asks to keep using that person’s credentials.
Each request starts with a legitimate need. The proposed change can still create unnecessary access, weaken accountability, or remove a control from far more of the environment than the problem requires.
-
Joe Wilson ☛ TIL: Your internal npm package name is a loaded gun
At some point a developer made a local package with that name. Monorepo, internal registry, some npm link they forgot about, whatever. The app’s package.json still asks for it by name.
And npm install doesn’t care where you meant that package to come from. It has a name and a version range, and it asks a registry. Misconfigured pipeline, loose .npmrc, a fresh CI runner nobody set up right — npm shrugs and goes to the public registry: “Got anything called chartjs-plugin-colors?”
Today the answer is “no.” That’s the whole defense.
-
Loris Cro ☛ The Zig Journey | Loris Cro's Blog
Coincidentally, this post might also help answer some questions from people who don’t really understand what is the point of Zig in light of {Go, Rust, Modula-2, Mojo, LLMs, …}.
-
ACM ☛ Fifty Years of Open Source Software Supply Chain Security: For decades, software reuse was only a lofty goal. Now it's very real.: Queue: Vol 23, No 1
As another example, developers in China often look for copies of Xcode on file-sharing sites hosted in China, which are faster to download. In 2015, security researchers discovered that attackers had posted a modified copy of Xcode and worked to make it the top Chinese-language search result for "Xcode download." This version, which researchers named XcodeGhost, had been nefariously altered to add malicious code to every iOS app it built. It was downloaded and used by many app developers, and the injected malware made it into at least two widely used apps.34 This is a software supply chain attack on the distribution mechanism rather than the original software, but, once again, it is not targeting open source software.
-
Python
-
Ruby ☛ Ruby 3.4.11 Released
Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes.
-
-
R / R-Script
-
Malte Grosser ☛ Data dictionaries for humans, agents and jumping frogs
How far can a bullfrog jump? Even with the data in hand, there is a detail worth checking: what counts as a jump? The collection notes explain that the competition scored the straight-line distance across three successive jumps. The researchers measured individual jumps from video and excluded short, continuous movements called “skitters”. Same event, different measurements. The dictionary should therefore explain that each recorded distance describes an individual jump and that skitters were excluded, with a link to the collection notes. Adding individual jump lengths does not generally reproduce the competition’s straight-line score. Someone analysing the data, including an AI agent, needs to know that distinction.
-
-
Java/Golang
-
Mike Gabriel: Looking for Golang + Fullstack Developer with interest in Civic Tech
Who?
Fre(i)e Software GmbH is looking for a senior Golang + fullstack developer who can handwrite code and act as meticulous code review partner for another senior developer in the company.
What?
Most of your work would result in Open Source contributions to the Voxit project [1], an online civic tech tool for digital participation.
-
-
Rust
-
Rust Weekly Updates ☛ This Week In Rust: This Week in Rust 670
Hello and welcome to another issue of This Week in Rust!
-