Programming Leftovers

posted by Roy Schestowitz on Oct 15, 2026

• Daniel Stenberg ☛ A curl audit by Aisle

  In the curl project we have nothing but positive experiences from having cooperated closely with Aisle all this time. Aisle has found more CVEs in curl than any other group or individual ever did before, and Aisle employees have authored several dozens of commits in curl already.

• [Repeat] Daniel Stenberg ☛ A UAF turned RCE

  In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

  This post explains the bug, what the problem can lead to, and something about why it happened and what we have done to make it harder to introduce a problem like this in curl again in the future.

• Sebastian ☛ yet another place where a linux man page is inaccurate

  ok hi so a couple days ago i put out your c is not standard c. and it originally had a section that looked like this (entire section pasted here, since it's now gone from the original post): [...]

• Sandor Dargo ☛ C++26 Ranges: Four New Views

  C++20 shipped a powerful ranges library, but the set of view adaptors had some obvious gaps. Want to get the output as a container? No luck. At least C++23 helped with that. Want to iterate over two vectors as one sequence? Write your own. Want to avoid redundant evaluations in a transform | filter pipeline? Write a workaround. Want a quick index sequence matching a range’s size? Spell out iota with an ugly cast.

• James Cherti ☛ batchfetch - Efficiently clone or pull multiple Git repositories in parallel

  But why use Batchfetch? Because it is extremely fast, cloning repositories quickly by running Git operations in parallel. It intelligently detects whether a git fetch is needed, further speeding up the process of downloading data from repositories. Additionally, it allows specifying the revision (for Git), ensuring that the cloned repository matches the exact version you require.

• Dirk Eddelbuettel ☛ Dirk Eddelbuettel: qlcal 0.1.4 on CRAN: Fresh Upstream Updates

  The twenty-second release of the qlcal package arrivied at CRAN yesterday, and has been built for r2u as well as on r-universe.

• Rlang ☛ maestro 1.4.0 adds custom pipeline metrics

  The 1.4.0 release of maestro is out, and with it comes the ability to record custom metrics from your pipelines.

• Steinar H Gunderson ☛ Steinar H. Gunderson: Decompilation patterns, part 11: Irregular switch

  Here's one that m2c usually gets right itself, but sometimes cannot: [...]

• Linux Foundation for Proprietary Software Companies

  • PR Newswire ☛ Linux Foundation Launches BUILD Foundation to Sustain Large-Scale, Multi-Language Build and Test Systems

    The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the operational launch of the BUILD Foundation with initial members ASML, Canva, Datadog, EngFlow, Figma and Spotify. The Foundation gives the Bazel ecosystem the leadership and sustained investment needed to take on challenges no single organization can solve alone.

• Shell/Bash/Zsh/Ksh

  • James Cherti ☛ Reducing shell prompt latency caused by fasd in Bash, zsh, or sh

    The fasd command-line tool (and its maintained fork, efasd) tracks access to files and directories to provide fast navigation in Linux and UNIX shells such as sh, bash, or zsh.

  • James Cherti ☛ Prioritizing fasd directories in bash, sh, and zsh shells (e.g., pinned and project directories)

    In my setup, I maintain a plain-text list of all my project root directories in ~/.pinned-dirs (one path per line) and use a fasd backend to inject those paths into every fasd query with maximum priority.. While I use this for project directories, the same method works for pinning configuration paths, documentation folders, or mount points.

  • University of Toronto ☛ Consider verbose 'usage' messages for infrequently used scripts

    If you use a script regularly and it has the kind of command line options that you might get slightly wrong (as this one does), a terse usage message is a good way to jog your memory without overwhelming you with a wall of text when you get something wrong. You can also pretty much guess what some of these things mean from context, like '-e MAC' (in context for this script, explicitly giving an Ethernet address) and '-n' (which we certainly hope is for a dry-run option, since '-n' is relatively standard for this).

• Rust

  • Niko Matsakis: What agents mean for Rust (and vice versa)

    As someone who has made a career of programming language design, I definitely have moments of existential dread about the rise of LLMs. I started coding in 5th grade on an x86¹ that ran at 5MHz, had something like a 5MB hard-disk and 512K of RAM². Computers were really, really different back then. But honestly, programming wasn’t.