Programming Leftovers

posted by Roy Schestowitz on Oct 23, 2026

• Ruby ☛ Ruby 4.0.8 Released

  Ruby 4.0.8 has been released.

  Please see the GitHub releases for further details.

• Buttondown LLC ☛ NYC, New Webinar, Differential Testing

  Been a while! Man, it's so much harder to write essays for a newsletter when I have a full time job writing essays for a company.

• Modus Create LLC ☛ Adopting Nickel in CodeCommons

  Complex architectures with multiple services require a lot of configuration. There are a lot of knobs to be tuned, and that configuration needs to be persisted in configuration files. These come in a large variety of formats - widely accepted standards such as YAML or TOML, ecosystem-specific formats such as key-value pairs in the Apache data engineering world, or ad-hoc custom configuration formats. At the same time, errors in configuration files can lead to hard to detect and frustrating bugs: invalid or missing field values can lead to late crashes after minutes of start-up, silent fallbacks to unwanted defaults due to incomplete or unknown configuration error handling in external packages, etc.

  Nickel is a programmable configuration language developed by Tweag that aims to provide safe and validated configurations with ease. You’ll learn more about the most important Nickel features later, but if you’re impatient, you can read more about it on Nickel’s website or in our Nickel series on this blog.

• Earthly ☛ The eMudhra compromise: getting every service to a verified fix

  The hardest part of responding to eMudhra may be finding every piece of software that needs an update. Across a large engineering organization, that includes production services, old container images, and tools running inside CI.

  A patch is only useful where it gets applied. Platform teams need to identify potentially affected software, get the required updates into use, and verify that nothing was left behind.

• Jasper Tandy ☛ Jasper is blogging: PHPocalypse Day Two

  So that's the era we're in now. You maintain your site, keep your versions up-to-date, and that's going to begin to be pitched as less optional. Anything else is irresponsible now, and I've taken on the burden of support for too long. The last 48 hours have been quite unpleasant for us, and I'm not going to absorb that again.

• Don Marti ☛ the insecurity department

  Another day of Internet security getting on the front page. Yes, trillions of dollars worth of Internet companies are depending on a PHP Foundation with a budget of $730,534—free-ride much? but others have made that point better.

  The thing that bugs me about the security situation lately is, normally, when there’s a security problem, the natural reaction for the maintainers of the affected system is to ask: where else could something similar be happening?

• Dan Q ☛ There isn’t an easy exploit for this PHP vulnerability

  I don't think this PHP vulnerability is that exploitable. I think that 5 years ago people would've understood this, but now people are being deluded by their LLMs telling them they have an exploit when they don't.

  If you take a look at github right now, there are thousands, literally thousands, of "PoC" exploits for this vulnerability. One thing you'll notice about all of them though, is that they do not work against a vanilla PHP instance.

• Pen Test Partners ☛ PHP2Shell and what the Hey Hi (AI) headlines are missing

  On the 20th of October two critical vulnerabilities affecting the PHP engine were publicly disclosed, collectively known as PHP2Shell.

• Security Week ☛ Tech and Security Companies Respond to PHP2Shell Vulnerabilities

  Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.

• Security Week ☛ Signal Vulnerability Lets Malicious Callers Block Hang-Ups

  Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

• Federal News Network ☛ Pentagon sued over data breach affecting more than 3 million people

  The lawsuit argues that DoD knew about problems with its cybersecurity practices but continued to “intentionally disregard its cybersecurity responsibilities.”

• R / R-Script

  • rOpenSci ☛ rOpenSci | Collaborating between Bioconductor and R-universe on Development of Common Infrastructure

    For more than two decades, the Bioconductor project has been a cornerstone of the R ecosystem, providing high-quality, peer-reviewed tools for bioinformatics and computational biology. Its curated repository model, rigorous review standards, and tightly coordinated release process have helped establish Bioconductor as one of the most trusted distribution channels in scientific computing.

    However, the infrastructure that supports such a long-standing and large-scale project inevitably accumulates technical debt. Legacy build systems, bespoke tooling, and historically grown workflows add up to costly and unsustainable maintenance work. For this reason, Bioconductor is collaborating with R-universe to gradually modernize parts of its infrastructure, while accommodating the project’s scale, governance, and established processes. In turn, Bioconductor is helping R-universe expand and refine its features as we learn to serve the complex needs of the Bioconductor community.

  • A. Márcia Barbosa ☛ Automatically center a projection on the plotted map

    Following this previous post and this discussion on Mastodon, I wrote a function that wraps a combination of functions from the ‘terra’ package to project a SpatRaster or SpatVector layer while automatically centering the projection on that layer, to minimize visual distortion: [...]

• Python

  • Chris ☛ Script dependencies with Nix

    In the theme of NixOS enabling fearlessness, here’s a way I use Nix on other Linux distributions to sleep better at night: managing dependencies of simple scripts.

    This way of using Nix is for everyone, not just those willing to try NixOS. We’ll look at it first for a Python script, and then see how it can be adapted to any other language.