Programming Leftovers

posted by Roy Schestowitz on Nov 05, 2026

• Mailing list ARChives ☛ 'Re: OpenBSD Forum:'

  When folks started leaving Usenet for dedicated web forums I think my communities fractured and lost their direction.

• Larry Bank ☛ How to read codes from (many) IR remote controls with as little code as possible

  Inexpensive infrared (IR) remote controls have been ubiquitous in our lives for many many years. This is because the technology is inexpensive and works so well that it fades into the background. The IR signal gets 'sprayed' (transmitted/reflected/received) so effectively in most indoor environments that you rarely have to care in which direction the LED is pointing and it somehow 'just works'. The clever inventors of the technology discovered that by modulating the digital data on a 36 to 40KHz carrier wave, it would have a high signal to noise ratio (be detectable with a relatively weak transmitter in very noisy conditions). The wavelength of IR chosen (940nm) was useful because it is just beyond visible light, but not too far beyond the properties of light that it still reflects well off of ordinary surfaces. The reason for this article, and the software project I created, is to harness these ubiquitous controls to restore functionality to my MacBook that Apple took away several generations ago - to use an IR remote control to drive Mac media playback (e.g. watch a movie with the Mac connected to your TV) from the comfort of your sofa. After seeing the complicated (and sometimes expensive) projects and products to accomplish this, I decided to learn some of the gritty details and create it for myself. As an eternal optimizer, I also wanted to see the minimum amount of code needed to accomplish the task.

• NVISO Labs ☛ Detection-as-Code Part 2: Preparing and Executing Migration

  In Part 1, we described the starting position and roadmap for introducing Detection-as-Code in an existing environment, this second part explains how we executed that roadmap.

  Some of the content in this part of the series is rather technical. If you are not a technical reader, feel free to skim this part, but do not miss Part 3, which returns to conceptual and strategic topics.

• Sandor Dargo ☛ C++26: std::constant_wrapper

  C++26 adds std::constant_wrapper (P2781R9 by Hana Dusíková, Matthias Kretz, Zach Laine; refined by P3978R3 by Kretz, Kamiński) and its shorthand std::cw<V> to close this gap. It wraps any structural type — not just integers — in a type that carries the value as a non-type template parameter, preserving its compile-time nature across function calls.

• Tom's Hardware ☛ PHP vulnerability post-mortem reveals bug was known two years ago — Small team of maintainers knew of the issue before it was made public, as new PHP2Shell chained exploit ravages servers

  The root cause of the vulnerability was an ancient architectural decision in the PHP engine's error handling. When a PHP process runs out of memory, it'll call the longjmp() C function, which means "immediately jump the execution to another place, no questions asked." Using longjmp() without a very good reason is generally unadvisable, though that by itself wasn't the problem.

• Dark Reading ☛ Critical Rails Bug Threatens to Derail Vulnerable Servers

  Rails, or Ruby on Rails, is a Web application framework built on Ruby. The framework's Active Storage component handles file uploads and can use the ImageMagick image processing suite to analyze uploaded images. And unfortunately, a flaw enables attackers to write arbitrary files to a Web server via ImageMagick.

• SANS ☛ The Classics Return: Vulnerable E-Mail Scripts - SANS ISC

  The comment at the top says it all: This is not meant for production use, and even on a development site, it should likely be deployed only briefly for debugging. The script takes any "To" address from the "email" GET parameter and exfiltrates/displays part of the server configuration. It can be useful to scan your own hosts for some of these URLs as an additional control, but you really want to catch these issues during application deployment.

• Rust

  • Rust Weekly Updates ☛ This Week In Rust: This Week in Rust 676

    Hello and welcome to another issue of This Week in Rust!

• R / R-Script

  • Jumping Rivers ☛ SAS to R: Why R, and Where Your Migration Budget Should Go

    If you’re moving regulated analysis from SAS to R, two things are worth knowing up front. R is a choice you can defend: regulators don’t tell you which software to use, and R has already been through FDA review in public pilot submissions. And the language itself is the cheap part. Most of the cost and risk comes from six other places, and most of those are about planning, not programming.

    Part one asked whether SAS is still worth keeping. This post covers why R, and where to put your budget and attention once you commit.