Programming Leftovers

posted by Roy Schestowitz on Oct 28, 2026

• Nathan Naveen ☛ The Relationship Between Threads and Processes

  When I started writing eBPF, I didn’t really understand how processes, threads, and thread groups were related. During that time, most of the eBPF code I wrote didn’t make much sense. But after learning how processes and threads relate, everything started clicking.

  So, when you start a program, Linux creates a task and gives it an ID, for example, ID 1234. That task is the main thread, and its thread ID matches the task ID, so the thread ID (tid) is 1234. And because it is the only thread created so far, the process ID (pid) is also 1234. And the thread group ID (tgid) is also going to be 1234 because the thread group is just a different name for the process.

• Jan Schaumann ☛ This is not sustainable

  The current situation is not sustainable: 0-days are dropping left and right, pre-notifications and embargoes are broken for marketing purposes, AI companies compete first on who commits the most crimes and then pretend to sell you protection in the form of a DoS on the Open Source community. "Nice project you got there. Be a shame if somebody dropped an 0-day on it."1

  Companies are not staffed for this, and no matter what the industry wants to tell you, you can't AI your way out of this. Vulnerability discovery has fundamentally changed, disclosure processes are effectively broken, and patch management has been a losing proposition for years now. Severe vulnerabilities are identified and disclosed at a pace that defenders are unable to keep up with.

• Henrique Dias ☛ Post-Mortem on Command Execution in File Browser

  Back in July, I made the decision to finally archive File Browser, and I won’t go over it again. In this post I want to address one category of features of File Browser that was the root of many of the security advisories that have been disclosed in the past year: command execution.

  When you hear that, bells start ringing immediately, since it sounds way too much like “remote code execution”, a very well known category of security vulnerabilities. I’m not a security specialist, so take all my opinions with a grain of salt.

• Elliot C Smith ☛ Flavors of Ambition

  Given the week the software world has had, we could aim to be ambitiously more secure. Unhackable.

  Given the default of most models is more code, we could aim to solve the problems with fewer features.

  Given how hard it is to find well priced RAM and other computer hardware, we could aim to be significantly more resource efficient.

• Den Odell ☛ Design Systems Should Be Fast by Default

  If a design system’s components are slow to interact with, so are any apps built with them. I timed large dropdowns and checkbox lists in some popular design systems, worked out how to make the slow ones faster, and wrote tests that fail when they’re too slow.

• Anna Liberty ☛ Four Months of Zig

  It has been about four months since I returned to Zig after being absent for a few years. In this time, I have written some software in Zig and reengaged with the community, online and in person. I decided to share some of that experience, including what I have liked about Zig so far and what I haven't. I'll include some comparisons to Rust along the way since that was my previous go-to language.

• The New Stack ☛ “The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response

  PHP2Shell exploits are confirmed in the wild, yet 93.6% of systems remain exposed. Worse, many run PHP versions that will never get a patch.

• Shell/Bash/Zsh/Ksh

  • Dan Langille ☛ Quieting a jail’s mail, and a prompt that wasn’t mine

    Then I stopped guessing and asked zsh to trace its own startup. The env -u PS1 starts it with a clean slate. The -x trace prefixes each line with the file and line number it came from: [...]