This week: 20 top links from Lobste.rs.
This Week on Lobste.rs
Trending topics: security web python c zig
1. This is not sustainable security
submitted by binjip978 — 148 points (+117 this week) — 43 comments
The pace of vulnerability disclosure has outstripped any organization's ability to actually patch them — not because fixes are slow to develop, but because finding what's vulnerable in your environment, assessing the impact, and deploying at scale takes months, and you're getting hit with new critical issues every few days.
2. The Slurptop: A home-built luggable that runs on power tool batteries art hardware
submitted by hoistbypetard — 135 points (+116 this week) — 37 comments
Someone built a portable computer that runs on DeWalt power tool batteries, trading true portability for something you can actually carry and a power supply you probably already own.
3. Please don't mess with links web
submitted by gavinmorrow — 109 points (+101 this week) — 24 comments
A catalog of ways JavaScript ruins links — and the specific browser affordances (right-click, ctrl/shift+click, hover preview, keyboard navigation) that break when you replace <a> tags with onclick handlers or popups.
4. Why Is This Fingerprinting Script Creating Bioweapons? ai reversing
submitted by haze — 107 points (+97 this week) — 11 comments
A fingerprinting script at servicepipe.tech contained obfuscated function names like "computeRicinLethalDosageForWaterSupply" — deliberate anti-LLM obfuscation meant to block automated deobfuscation tools, though the author's own reverse-engineering suggests the actual payload may be less sinister than the labels imply.
5. Python's experimental JIT to be removed python
submitted by val — 95 points (+90 this week) — 30 comments
The Python steering council rejected PEP 836, effectively ending the experimental JIT that landed in CPython 3.13 — the issue wasn't the JIT itself, but that it arrived without proper vetting and the authors couldn't pin down concrete plans for maintenance, compatibility testing, platform support, and security.
6. POSIX wordexp(3) is dangerous c security
submitted by yossarian — 85 points (+84 this week) — 20 comments
wordexp(3) executes shell commands by default, and even with WRDE_NOCMD, musl and macOS have known bypasses that let command substitution patterns slip through their filtering.
7. Ghostty 1.4.0 release
submitted by BD103 — 85 points (+80 this week) — 22 comments
Ghostty 1.4.0 adds full Kitty graphics support with animation and relative placement, cuts scrollback memory usage by 70–90% through compression, and patches security holes in paste protection and terminal output handling that could crash the app or run commands without confirmation.
8. CSS-Tricks has a new owner web
submitted by seb — 112 points (+78 this week) — 2 comments
Geoff Graham just bought CSS-Tricks back from DigitalOcean and is running it independently full-time, banking on memberships, ads, and a beginner's course to keep the lights on while shifting the site toward more entry-level content.
9. Quad9 DNS Resolver to exit France law networking
submitted by mond — 112 points (+78 this week) — 11 comments
Quad9 is exiting France after a court ordered it to block DNS resolution for domains beIN claims infringe copyright — a requirement that would require tracking user location, violating Quad9's core privacy mission. They already tried geolocation blocking in Germany and got fined for contempt when someone used a VPN to circumvent it.
10. Vim Classic editors vim
submitted by datboi — 79 points (+77 this week) — 46 comments
A fork of Vim 8.x aimed at long-term maintenance, explicitly built without AI tools and launched in response to uncertainty around Vim's current development.
11. Docker is weird programming
submitted by nick4 — 103 points (+74 this week) — 48 comments
Building a container runtime from scratch reveals Docker's odd architecture: containers are really just processes wrapped in five Linux kernel features (namespaces, cgroups, networking), images are chroot'd directories, and runc has to work around Go's threading model and missing fork support with a C stub that runs syscalls before exec'ing your actual process.
12. Attention people who think UB is fine c c++
submitted by abareplace — 77 points (+70 this week) — 73 comments
The same undefined behavior compiles into three wildly different outcomes across compilers and optimization levels: silently executing unrelated functions, writing random values, or deliberately crashing. The author walks through concrete examples showing why "we know what will happen" is dangerously wrong.
13. Shitty Screenshare browsers web
submitted by Sean-Der — 76 points (+67 this week) — 33 comments
WHIP lets OBS and FFmpeg stream directly into video conferences with full control over bitrate, codec, and resolution instead of letting your browser compress everything into mud — and the author, who works on WHIP in OBS, built this site to pressure conference providers into supporting it.
14. Partial Order Precedence zig
submitted by liberty — 65 points (+63 this week) — 16 comments
Zig now requires parentheses for operator combinations that lack defined precedence—a ten-year-old proposal finally implemented. Only 353 lines across the codebase needed changes, and common arithmetic chains like x + y * z stay parenthesis-free since their precedence is unsurprising.
15. Indian government sites are serving revoked eMudhra certificates security
submitted by adityaathalye — 73 points (+62 this week) — 18 comments
A researcher found 773 Indian government domains still serving revoked eMudhra certificates days after October 19th—including four bodies under MeitY and the regulator that oversees eMudhra—while the government claimed impact was "very limited and for a very short interval," despite the compromised keys being recoverable for 18 months.
16. I want my Wednesday back php security
submitted by lucasluitjes — 118 points (+60 this week) — 32 comments
A security researcher breaks down the actual exploit chain for php2shell and finds that hitting production sites with load balancers and WAF protection would require days of brute-forcing across thousands of build combinations — meanwhile the "mass exploitation" warnings were based on attempted attacks, not successful ones.
17. Apple's git still trusts the compromised eMudhra certificates cryptography mac
submitted by galadran — 118 points (+59 this week) — 26 comments
Apple's developer tools—git, curl, python3—still trust eMudhra's compromised certificates eleven days after notification, while dozens of volunteer-run projects shipped fixes in days; an attacker on your network can intercept git clones, pulls, and your GitHub tokens.
18. The glorious @xkcdRandom Zig builtin compilers zig
submitted by wofo — 65 points (+58 this week) — 8 comments
Zig's developer experience is smooth enough that adding a joke builtin to the compiler takes just 22 lines and a few minutes—and the author documents the whole process of forking, modifying, and building to prove it works.
19. EMACS turns 50 emacs historical
submitted by facundoolano — 74 points (+57 this week) — 9 comments
Emacs turns 50 this year, and the MIT Technology Review traces how it evolved from a way to standardize commands in a customizable editor into the tool that helped spark the free software movement—starting with Stallman's decision to share it only if recipients agreed to send improvements back.
20. A fast and secure tar parser for the Rust ecosystem python rust
submitted by yossarian — 89 points (+53 this week) — 15 comments
Astral swapped out their tar parser for a new one that's twice as fast and eliminates parser differentials—cases where the same tarball could extract differently in uv versus pip, potentially letting attackers slip malicious files past security checks.
Pleopods is a weekly digest of the top links from Lobste.rs. Archive