Programming Leftovers

posted by Roy Schestowitz on Sep 19, 2025

• Trail of Bits ☛ Use mutation testing to find the bugs your tests don't catch

  Instead of simply measuring your coverage, you should actually test your tests. This is where mutation testing comes in, a technique that reveals the blind spots in your test suite by systematically introducing bugs and checking if your tests catch them. At Trail of Bits, we’ve been using mutation testing extensively in our audits, and it’s proven invaluable. In this post, we’ll show you how mutation testing uncovered a high-severity vulnerability in the Arkis protocol that was missed by traditional testing and would have allowed attackers to drain funds. More importantly, we’ll show you how to use this technique to find similar hidden vulnerabilities in your own code before attackers do.

• Modus Create LLC ☛ Managing dependency graph in a large codebase

  In the previous post, we explored the concepts of the dependency graph and got familiar with some of its applications in the context of build systems. We also observed that managing dependencies can be complicated.

  In this post, we are going to take a closer look at some of the issues you might need to deal with when working in a large codebase, such as having incomplete build metadata or conflicting requirements between components.

• Kirill A Korinsky ☛ The OpenBSD build machine with a high number of CPU cores

  This brief article provides a footnote for an actual state of using OpenBSD as build machine with a high number of CPU cores.

• Adolfo Ochagavía ☛ Configuration files are user interfaces

  We have all been there. Your software keeps growing and you feel the need to make it customizable. It is too soon for a full-blown UI with all the bells and whistles, so your pragmatic instinct suggests a text-based configuration file. Yes, that’s exactly it!

  You rejoice knowing the software’s configuration will be trivial to version control. Your pragmatic instinct is satisfied as well; the door remains open to creating a proper UI later, since it would be merely a graphical view of your configuration’s structured data. The future is bright!

  Now, which language should you pick for your glorious configuration file? It needs to be user-friendly, so people can inspect it and modify it with ease. JSON springs immediately to your mind, but the abundance of brackets and the lack of comments give you pause. TOML maybe? You are afraid it might be too minimal for your needs. Rolling your own language? Too impractical.

• CVE-2025-58767: DoS vulnerability in REXML

  There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2025-58767. We strongly recommend upgrading the REXML gem.

  Parsing invalid XML containing multiple XML declarations may cause increased execution time and memory usage. Please update REXML gem to version 3.4.2 or later.

• Sebastian Wick: Integrating libdex with GDBus

  Writing asynchronous code in C has always been a challenge. Traditional callback-based approaches, including GLib’s async/finish pattern, often lead to the so-called callback hell that’s difficult to read and maintain. The libdex library offers a solution to this problem, and I recently worked on expanding the integration with GLib’s GDBus subsystem.

  The Problem with the Sync and Async Patterns

  Writing C code involving tasks which can take non-trivial amount of time has traditionally required choosing between two approaches: [...]

  /blockquote>

• Perl / Raku

  • Perl ☛ Geizhals Preisvergleich Donates USD 10,000 to The Perl and Raku Foundation

    Today The Perl and Raku Foundation is thrilled to announce a donation of USD 10,000 from Geizhals Preisvergleich. This gift helps to secure the future of The Perl 5 Core Maintenance Fund.

• Java

  • The New Stack ☛ Java 25: Oracle Makes Java Easier To Learn, Ready for AI Development

    The centerpiece is JDK Enhancement Proposal (JEP) 512 Compact Source Files and Instance Main Methods, which eliminates the intimidating public static void main(String[] args) that has confused beginners for decades. Students can now start with: [...]

• R / R-Script

  • rOpenSci ☛ All the Ways to Programmatically Edit or Parse R Markdown / Quarto Documents

    If life gives you a bunch of Markdown files to analyse or edit, do you warm up your regex muscles and get going? How about using more specific tools instead? In this post, we shall give an overview of programmatic ways to parse and edit Markdown files: Markdown, R Markdown, Quarto, Hugo files, you name it.