Software

Radicle is a peer-to-peer, local-first code collaboration stack built on Git, and it just published two critical vulnerabilities in the network protocol its nodes speak. Every version released to date is affected. The team is shipping the disclosure ahead of the fix on purpose: no later patch can undo an exposure that already happened. The two flaws: Node-to-node traffic is neither encrypted nor authenticated — anyone able to observe the path between two nodes reads whatever they exchange, in plain text (reported 2026-06-24 by Konstantinos Maninakis) Peer authentication in the handshake is broken, so an attacker can present a Node ID that is not theirs; since private repositories are shared by allow-listing Node IDs, a faked allow-listed ID can fetch a private repository directly, without sitting on the path at all (reported 2026-08-12 by cryptocode) Alone, the impersonation flaw is hard — you have to know an allow-listed Node ID, and the allow-list is not public. Together they compound: a path attacker sees the Node IDs at both ends, both normally allow-listed, reads everything while watching, then uses a Node ID they observed to pull whole repositories on demand Integrity was never the problem. Git objects and signed references still verify at the storage layer, so nobody can forge code or identities — the failure is confidentiality What they tell users to do now: ...

Tailscale spent years on the obvious throughput work: TCP on Linux, wireguard-go past 10 Gb/s, segmentation offload for UDP traffic. The next round attacks the unglamorous parts — copies, queue depth, and a single-lane packet pipeline — and the numbers came from attacking memory overhead first. What actually changed: Most packets are ~1 KiB, but the kernel path (GRO) obliges Tailscale to accept up to 64 KiB, and wireguard-go only offered one 64 KiB buffer to unpack into — so every small packet got copied into its own oversized allocation On Linux and Android it now marks where each packet starts and ends inside the single large read instead of copying it out; small packets stay small, many share one allocation, and that alone bought roughly 5% in many configurations Packet queues were shortened after testing showed most of their depth went unused — less waiting, less memory The freed memory was handed to subnet routers and app connectors, which had been processing every stream through one ordered single-thread pipeline because a receiving app must never see its own packets reordered With headroom available, that became a multi-queue system: several independent lanes, sized to the machine rather than the peer count, each stream pinned to one lane so ordering holds while lanes run on different cores writev lets it describe scattered packet data to the kernel in one operation instead of copying and combining pieces first — fewer copies, fewer writes Netmap caching is the one that changes behaviour rather than throughput: a client stores its network map on disk, so when the control plane is unreachable — bad Wi-Fi, filtered hotel networks — the device can still establish peer connections and start working, then refresh when it gets through The interesting part is the shape of the argument. Performance work at this maturity is not algorithm work; it is deciding what memory you were holding out of habit and then spending the savings where contention actually lives. The released caveats are refreshingly plain: netmap caching needs persistent disk, requires one prior successful connection, can generate heavy disk traffic on very large tailnets, and is a bad idea on wear-sensitive storage like SD cards. ...

Jim Nielsen noticed he is visiting status pages more often — GitHub down, CI down, AI services down, Slack down — and that status pages are full of numbers like 100%, 99.72%, 99.09%, 98.98%. Those all look like grades in school. They are not. The numbers are not wrong. They are the wrong interface: Percentages near 100 are nonlinear, so 99.9% and 99.99% read as neighbours while the second is ten times less downtime The Richter scale makes the point: a 6.2 and a 7.8 do not look far apart and are not remotely the same thing Infrastructure people internalise this — “two nines, three nines” — because they swim in the numbers daily But the audience for a status page is no longer only infra people; it is increasingly everybody, including the customers deciding whether to keep paying Jason Gorman supplies the reliability half of the argument: 90% to 99% is as hard as getting to 90% in the first place, and 99% to 99.9% is just as hard again. Each nine costs roughly what the previous one cost, which is precisely why the percentage form hides how much is being bought. ...

Xe Iaso (Tigris) wanted a Git server backed directly by object storage. The obvious approach — pretend object storage is a filesystem and let stock git talk to a shim — works on toys and falls over on real repositories. This post is the performance analysis of why, and the on-disk format he built to fix it. The core mismatch is timing, not throughput: Filesystem reads are ~10 nanoseconds at most; an object-storage round trip is ~10 milliseconds at minimum That is “at least a million times slower because of how reality works” Git writes a file and immediately reads it back to compute a hash, which object storage cannot do — you cannot GetObject something whose PutObject has not finished Packfiles are mmapped, so the kernel does the paging for you. That model does not exist over HTTP Then a second problem, which is the one that forces a new format: ...

A USENIX ;login: article from July 2024 takes aim at a piece of conventional wisdom: that data-only attacks — exploits that never divert a program’s control flow, only corrupt the data it operates on — are too application-specific and too intricate to be a practical threat. The authors built a tool, Einstein, that generates them automatically, and got 944 confirmed exploits against nginx alone. The setup is worth restating. Roughly 70% of the security bugs Microsoft, Google and Mozilla report are memory-safety bugs, so attackers usually start with a way to overwrite memory. Historically that meant overwriting a code pointer and hijacking control flow — the path that DEP, CFI and CPI were built to close. ...

Mihai Dinculescu had a permanently dirty working tree, on purpose. His scratch files — markdown notes, agent plans, that kind of thing — were untracked and stayed untracked, because the only way he knew to ignore a file was .gitignore, and .gitignore gets committed. Pushing the silly filename he picked for his private notes into a shared repository felt unclean, so he did nothing and the files piled up. Then a coding agent asked, unprompted, whether it should add them to .git/info/exclude. His reaction was the useful part of the post: what is that? ...

Michael Heap was pulled onto a call about something that had gone wrong. Nothing catastrophic, but serious enough to include the SVP of engineering. He started explaining how it happened and was cut off: “Michael, I don’t want the details.” The reason, as the SVP gave it, was that the explanation would be perfectly reasonable, he would understand and empathise — and then it would happen again. The 125-comment thread on Hacker News spends most of its length arguing with that. ...

CERN is moving 2,200+ accelerator control computers to Debian 13 by the end of 2026. That announcement prompted Mohamed Elashri to revisit a decision from 2019: Fermilab and CERN ending Scientific Linux. His claim is not that Scientific Linux was technically better, and not that the labs could have controlled what Red Hat did afterwards. It is that the retirement priced only the visible cost of maintenance and ignored what the capability was worth. ...

Delta is Meta’s object store for the layer that has to come back first when everything else is down — build artifacts, distribution packages, bootstrap data. That constraint drives the whole design. For a system whose job is restoring the fleet, complexity is only justified when it buys reliability, and performance is explicitly secondary. It implements chain replication: servers arranged in a linear chain, writes entering at the head and reads served only by the tail. ...

The Secretary Problem says you cannot recall a rejected applicant, so optimal stopping means rejecting good people permanently by design. Aditya Athalye and one colleague hiring QA engineers in Pune for Clojure work simply ignored that constraint — and kept the door open. The loop they ran: Rejections came with an invitation to re-apply later, plus opt-in curriculum and weekly office hours for anyone wanting to learn Clojure A 24-hour turnaround promise to every candidate, with an open invitation to ping if it slipped Never ghost anybody — a quick no beats a “yes, but” three months later All screening by email, every email demanding a written answer about something relevant to that stage Coding assignments capped near fifteen minutes for the candidate’s level, then a mandated refactor with a different design Decisions fully async and written: two yes votes advance, one yes and one no is a reject, both logged in the ATS within 24 hours The first email listed deal-breakers in advance — mandatory Clojure, compensation ballpark, on-call expectations, review strictness Results: five hires from about 300 inbound, each productive within a month, all of them tenured four to ten years, several moving into backend and product. They also hired a strong engineer through the word of mouth of a candidate they had rejected but supported. ...

Thirty years in, JavaScript runs everywhere and is losing its own toolchain to Rust, Go and Zig. Maroun Baydoun, a senior web engineer in Berlin, argues the migration is mostly good engineering — and a trade-off that never makes it onto the benchmark chart. What is actually being exchanged: Node let the toolchain speak the same language as the code: linters, bundlers, formatters and test runners were readable and forkable by the developers who used them Rewrites in compiled languages remove that: the source stays open, but the contributor pool shrinks to people fluent in the new language “Written in Rust” drifts from implementation detail to selling point, and once the newcomer also tops the benchmarks, resisting it gets expensive Speed provides the technical argument, trendiness takes care of the rest His best observation is the recursion: we compile JavaScript with Rust so it can run inside an engine written mostly in C++. He calls it laying increasingly fast tracks for a steam train that likes to take its time — heavy investment in optimizing everything around JavaScript while JavaScript itself remains the destination. ...

Anton Zaides spent a two-day hackathon building a referral tool with a recruiting team, using a generator so the non-engineers could maintain it afterward. Day one: 90% done. Day two: nothing worked. He calls it the day-two collapse, and treats it as a communication problem as much as a technical one. Engineers have tried to explain this forever, usually badly. One of his former leaders was openly allergic to the words “refactor” and “infra work,” and after LLMs arrived the question became “can’t you just give this task to ChatGPT?” ...

Matt Schwager spent years inside Duo’s on-prem Access Gateway, which was built on simpleSAMLphp and the SAML protocol. His conclusion, 25 years after SAML shipped: it should be deprecated in favor of OIDC, and the reason is not one bad bug — it is the foundation. SAML was designed by an OASIS committee in 2002 by merging four competing XML security protocols (S2ML, AuthXML, X-TASS, ITML) into one specification. That origin predicts the trouble. ...

Gregory Gundersen memorized the first hundred digits of pi in about an hour, in one sitting, and his point is that there was no magic in it. The techniques came from Joshua Foer’s Moonwalking with Einstein, and what they did was convert a shapeless problem — how do you remember this? — into a bounded one with a process and a failure model. “Remembering became engineering.” The machinery is a person-action-object (PAO) index: 100 people, 100 actions, 100 objects, mapped to the numbers 00-99. ...

“Sure, AI helps you output more code, but won’t the quality suffer?” Iouri Khramtsov’s answer is that it will if you blindly merge the PRs — and that with a layered approach he has kept bugs flat, and sometimes reduced them, while increasing output 2-2x. Quality, in his telling, is a management property rather than a tooling property. The layers, in the order code passes through them: Requirements. Spec-driven development, with the AI reviewing the spec or tech design for gaps, edge cases, and unexpected interactions with existing code. He credits this one step for most of his bug drop. Unit tests at >95% coverage. Agents make TDD cheap, so there is no excuse to skip it. Order matters: settle the scenarios from the requirements, write the tests, then the implementation. Manual testing. Still no substitute for a human exercising the feature — and the reason his gains are 2-3x rather than 10x. End-to-end tests. The most important tests in the codebase, run on PRs, in staging, and in production after every deploy. Targeted AI quality passes. Security, duplicated or overcomplicated code, naming, logic review, AI-ese comments. Agents follow a complex AGENTS.md poorly but handle one narrow pass well, for 5-15 minutes each. Review, human and AI. Two different AI reviewers find different problems, so he runs both — plus a pruning pass, because AI review comments are frequently noise. Production monitoring. Error tracking that deduplicates, dashboards, session recordings; best case an agent diagnosing the error and opening the fix PR. Two things worth stealing. The AI is better at hunting problems than at following instructions, which argues for pipelines of small targeted checks over one large configuration file. And every one of these layers is cheaper to run than it was before agents, which is what makes “double the speed, keep the bugs” a tooling decision instead of a headcount one.

Linear’s CTO filed an issue titled “CI costs are high” and asked for faster CI while it was being fixed. The result, written up by Mufeez Amjad, is a rare CI postmortem with numbers: despite the test suite almost quadrupling in a year, PR wait time went from over 6 minutes to just over 5, and runner time per test roughly halved. The organizing idea is that CI cost is dominated by fixed per-job overhead — runner boot, checkout, dependency install, container provisioning. So the wins came from spending less of it: ...

mathmain@1.0.0 is an npm package that copies mathjs, with one extra call appended to the end of lusolve(). It passes the lower triangular matrix from an LU decomposition into a function named removeSolveValidation(), whose return value is assigned to an unused variable. That function is a decryption loader — and the password is derived from the caller’s own input, so there is no secret to find in the source. The encryption layout is deliberate: ...

Boris Cherny wrote a short note for his team and then posted it publicly: the six steps he runs on almost every problem and product, and why the loop is supposed to feel unstable while it works. Understand the information available Gather the missing information Define the problem Define a clear and simple approach to solving it Define a goal Act with urgency to achieve the goal New information arrives mid-flight, so steps three through five get rewritten and the loop repeats — many times, on complicated problems. He names the feeling directly: “this can feel thrashy.” The churn is healthy as long as everyone knows it is the process, because the only way to actually solve the problem is to update your priors when the data changes. ...

On 25 July 2026 a three-person research team took over OpenAI employees’ ChatGPT and Codex accounts, and from there reached internal repositories. Discovery to demonstrated repo access took under 72 hours, and neither of the two vulnerabilities involved is exotic. The chain: A heap buffer overflow in libheif, reached through ImageMagick, reached through a HEIC upload on community.openai.com Remote code execution on the Discourse forum A flaw in OpenAI’s single sign-on turned that forum into a path into ChatGPT and Codex accounts Those accounts had GitHub connected, which meant internal repositories The first half is the transferable bug: ...

In late 2025 the company behind MinIO abandoned it — which broke local S3 emulation in a lot of demos, plus the build pipelines that used it to validate S3 compatibility. Robin Moffatt wanted the simplest replacement, so he defined the criteria before touching a single candidate and then wired each one into a working stack. The test is a Docker Compose setup with DuckDB and an Iceberg REST Catalog, where a three-row insert has to land as Parquet and Avro in the bucket. The criteria: ...