[-] Kissaki@programming.dev 5 points 3 days ago

; thank you OpenAI nee Microsoft.

What does this nee formulation mean, or is this a typo?

[-] Kissaki@programming.dev 5 points 3 days ago

Looking into the mentioned unforgivable vulnerabilities and stubborn weaknesses published by CISA:

Unforgivable Vulnerabilities (PDF)

Given the above criteria, following are some candidates for unforgivable vulnerabilities that satisfy all (or most) of the criteria for an unforgivable vulnerability. […]

  1. Buffer overflow using long strings of "A" characters in:
    • a. Username/password during authentication
    • b. File or directory name
    • c. Arguments to most common features of the product or product class
  2. XSS using well-formed <script> tags, especially in the:
    • a. Username/password of an authentication routine
    • b. Body, subject, title, or to/from of a message
  3. SQL injection using ' in the:
    • a. Username/password of an authentication routine
    • b. "id" or other identifier field
    • c. Numeric field
  4. Remote file inclusion from direct input such as:
    • a. include($_GET['dir'] . "/config.inc");
  5. Directory traversal using "../.." or "/a/b/c" in GET or SEND commands of frequently-used file sharing functionality (e.g., a GET in a web/FTP server, or a send-file command in a chat client)
  6. World-writable critical files:
    • a. Executables
    • b. Libraries
    • c. Configuration files
  7. Direct requests of administrator scripts
  8. Grow-your-own crypto
  9. Authentication bypass using "authenticated=1" cookie/form field
  10. TOCTOU race condition – symlink
  11. Privilege escalation launching "help" (Windows)
  12. Hard-coded or undocumented account/password
  13. Unchecked length/width/height/size values passed to malloc()/calloc()

Stubborn Weaknesses

| CWE-ID | Description | 2023 Rank | |


|


|


| | CWE-787 | Out-of-bounds Write | 1 | | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 2 | | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 3 | | CWE-416 | Use After Free | 4 | | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 5 | | CWE-20 | Improper Input Validation | 6 | | CWE-125 | Out-of-bounds Read | 7 | | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 8 | | CWE-352 | Cross-Site Request Forgery (CSRF) | 9 | | CWE-476 | NULL Pointer Dereference | 12 | | CWE-287 | Improper Authentication | 13 | | CWE-190 | Integer Overflow or Wraparound | 14 | | CWE-502 | Deserialization of Untrusted Data | 15 | | CWE-119 | Improper Restriction of Operations within Bounds of a Memory Buffer | 17 | | CWE-798 | Use of Hard-coded Credentials | 18 |

[-] Kissaki@programming.dev 1 points 3 days ago

It's not the exact thing; it just makes it worse. For many people, it's personality and psychology; they go the path of least resistance and don't care about much besides their main goals. Whether you embed it in capitalism or not, these fundamental causes remain.

Do you have an economic or social system in mind where it would be solved or better?

[-] Kissaki@programming.dev 8 points 5 days ago

"Click to Play" on the video - nah mate, you gotta auto-play those videos, and embed them in the article. Bonus points for the video being unrelated to the article.

I've seen it. I've experienced it. I hate it.

The bottom right videos were the previous iteration of that.

[-] Kissaki@programming.dev 10 points 5 days ago

“I think Nvidia is very much a community,

🤨

[-] Kissaki@programming.dev 1 points 5 days ago* (last edited 5 days ago)

to serve specific purposes

You're asking for specifics on their concerns while not providing the specifics that were already in place in your claim here.

They acknowledged and included reasons for the Cloudflare adoption in their original post.

[-] Kissaki@programming.dev 89 points 3 months ago

Also, nobody actually knows if human intelligence is just finer grained stochastic prediction as well.

An interesting but valid argument. It doesn't make AI better than it is, but any human contribution and change can and often is also faulty. People have gaps of knowledge, sometimes unwarranted confidence, other times lack of care, or just miss things. It's not like we're comparing the perfect human vs faulty AI.

If you don’t mind the security risk then you can of course use an older release.

I haven't read the original rage/drama but I can imagine if from other drama instances.

This post is certainly a good, founded response.

There's some valid concerns in AI usage, but unwarranted or inappropriate harsh criticism when it's an established trusted developer and engineer - if we assumed good practice before then we could assume continued good practice. Maybe LLM is one point of increasing skepticism, but criticism should be open, respectful, and fair.

They invested a lot of time and effort into a public good project. In that context, they deserve at least respectful and non-worst-assumptuous criticism.

10

GitHub issue [COMPROMISED] v2.6 Linux Ubuntu and AppImage release assets have been replaced (SOLVED, now restored) #1911

rentry doc (dunno publisher)

It has come to our attention that from 6th May to today (12th May) the AppImage and Ubuntu zip assets of Cemu 2.6 on our github were compromised by a pro-Russian threat actor.
If you are a Windows or MacOS user you are not affected. If you are a flatpak user you are also not affected.

This means that downstream projects like EmuDeck, which downloads and installs Cemu directly from GitHub Releases was also affected.

7
13
submitted 4 months ago* (last edited 4 months ago) by Kissaki@programming.dev to c/gamedev@programming.dev

s&box, from the creator of the popular Source Engine sandbox Garry's Mod, released three days ago. s&box is based on the Source 2 engine, and not only a sandbox but a game development and publishing platform, including publishing on Steam.

The news post one day after release openly covers the mixed ratings, public finances, doubling their play fund that pays creators, and public roadmap.

I was surprised to see they openly and transparently publish day-by-day finances.

The public performance stats are interesting too.

Refreshing. I wish more publishers would do these kinds of things with deliberate open communication and transparency.

Their metrics pages:

10
submitted 4 months ago* (last edited 4 months ago) by Kissaki@programming.dev to c/opensource@programming.dev

Syntax Highlighting

Edit v2 adds the Lightweight Syntax Highlighter. It has a ~40kB footprint for a dozen languages plus runtime, barely grows with each language added, and runs at >100MB/s.

The highlighter is based on a simple programming language that combines regular expressions with explicit control flow. It's designed such that the runtime can be easily ported to other languages, including JavaScript.

From 1.2.1 to 2.0.0, the edit binary size increased from 267 to 330 kB for win exe and 217 to 300 kB for linux binary.

What is edit? README intro:

A simple editor for simple needs.

This editor pays homage to the classic MS-DOS Editor, but with a modern interface and input controls similar to VS Code. The goal is to provide an accessible editor that even users largely unfamiliar with terminals can easily use.

19
Simplest hash functions (purplesyringa.moe)
19

Corridor Digital released an open-source greenscreen keyer/extractor, powered by AI, usable on consumer GPUs.

The video covers what happened after their initial release, community and professional responses, interviews with professionals about what can be improved, and finally a practical test/example in Davinci (Video Editor).

12

The Ergonomic, Safe and Familiar Evolution of C

C3 is a programming language that builds on the syntax and semantics of the C language, with the goal of evolving it while still retaining familiarity for C programmers.

Thanks to full ABI compatibility with C, it's possible to mix C and C3 in the same project with no effort. As a demonstration, vkQuake was compiled with a small portion of the code converted to C3 and compiled with the c3c compiler.

A simple and straightforward module system that doesn't get in the way, with defaults that makes sense.

[-] Kissaki@programming.dev 70 points 5 months ago* (last edited 5 months ago)

March 30, 2026 @ 10:45 AM EST: Martin Woodward, Vice President of Developer Relations at GitHub, confimed that Copilot was injecting product tips into pull requests but that the feature has been disabled following feedback.

They posted an update to the article about this recent update. After feedback, they decided to disable this feature.

14

EYG's type system builds upon a proven mathematical foundation by using row typing.

EYG programs are all independent of the machine they run on. Any interaction with the world outside your program is accomplished via an effect.

Any effect can be intercepted using a handler. This allows the response from the outside world to be replaced.

Other languages have the possiblity of closure serialisation, but EYG's runtime is designed to make them efficient.

Hot code reloading – If you change the code the behaviour will update immediatly if safe.

EYG has a prototyped strongly typed shell environment.

EYG is built to support multiple runtimes. […] In the future EYG will be available in many more places, e.g. arduino, CLI's and IPaaS. EYG makes this easy by having a carefully designed minimal AST.

Code example (from landing page):

let initial = 10
let handle = (state, message) -> !int_add(state, 1)
let render = (count) -> {
  let count = !int_to_string(count)
  !string_append("the total is ", count)
}
{render: render, handle: handle, init: initial}

GitHub Repository, Apache 2.0

2
Delve - Fake Compliance as a Service (deepdelver.substack.com)
20

About Deno:

Deno is an open-source JavaScript runtime for the modern web. Built on web standards with zero-config TypeScript, unmatched security, and a complete built-in toolchain.

14
submitted 6 months ago* (last edited 6 months ago) by Kissaki@programming.dev to c/programming_languages@programming.dev

Uiua () is a general-purpose array-oriented programming language with a focus on simplicity, beauty, and tacit code.

Uiua lets you write code that is as short as possible while remaining readable, so you can focus on problems rather than ceremony.

The language is not yet stable, as its design space is still being explored. However, it is already quite powerful and fun to use!

Uiua uses special characters for built-in functions that remind you what they do!

⚂ # Random number
⇡8 # Range up to
⇌ 1_2_3_4 # Reverse

cross-posted from: https://programming.dev/post/46403010

Sample with fibonacci:

⍥◡+9∩1 is the fibonacci in this language


Commenter maegul writes on the Programming community post:

I tried to go through the tutorial a year or so ago.

I can’t recall when, but there’s a point at which doing something normal/trivial in an imperative language requires all sorts of weirdness in Uiua. But they try to sell it as especially logical while to me they came off as completely in a cult.

It’s this section, IIRC: https://www.uiua.org/tutorial/More%20Argument%20Manipulation#-planet-notation-

When they declare

And there you have it! A readable syntax juggling lots of values without any names!

For

×⊃(+⊙⋅⋅∘|-⊃⋅⋅∘(×⋅⊙⋅∘)) 1 2 3 4

Which, if you can’t tell, is equivalent to

f(a,b,c,x) = (a+x)(bx-c)

With arguments 1, 2, 3, 4.

I wanted to like this, and have always wanted to learn APL or J (clear influences). But I couldn’t take them seriously after that.

7

The reasons behind this rise of the latency is mainly that systems have become more and more complex and developers often don't know or don't understand each part that can impact the latency.

This website has been made to help developers and consumers better understand the latency issues and how to tackle them.

[-] Kissaki@programming.dev 79 points 1 year ago* (last edited 1 year ago)

That's a read-only mirror, not a "move onto GitHub".

PRs get automatically closed, referring to the contrib docs.

[-] Kissaki@programming.dev 61 points 2 years ago
[-] Kissaki@programming.dev 60 points 2 years ago

I scale by dropping requests

[-] Kissaki@programming.dev 74 points 2 years ago

Turned into a skeleton in 10 minutes

view more: ‹ prev next ›

Kissaki

0 post score
0 comment score
joined 3 years ago
MODERATOR OF