This week: 20 top links from Lobste.rs.

This Week on Lobste.rs

Trending topics: security web python c zig

1. This is not sustainable security

submitted by binjip978 — 148 points (+117 this week) — 43 comments

The pace of vulnerability disclosure has outstripped any organization's ability to actually patch them — not because fixes are slow to develop, but because finding what's vulnerable in your environment, assessing the impact, and deploying at scale takes months, and you're getting hit with new critical issues every few days.

2. The Slurptop: A home-built luggable that runs on power tool batteries art hardware

submitted by hoistbypetard — 135 points (+116 this week) — 37 comments

Someone built a portable computer that runs on DeWalt power tool batteries, trading true portability for something you can actually carry and a power supply you probably already own.

3. Please don't mess with links web

submitted by gavinmorrow — 109 points (+101 this week) — 24 comments

A catalog of ways JavaScript ruins links — and the specific browser affordances (right-click, ctrl/shift+click, hover preview, keyboard navigation) that break when you replace <a> tags with onclick handlers or popups.

4. Why Is This Fingerprinting Script Creating Bioweapons? ai reversing

submitted by haze — 107 points (+97 this week) — 11 comments

A fingerprinting script at servicepipe.tech contained obfuscated function names like "computeRicinLethalDosageForWaterSupply" — deliberate anti-LLM obfuscation meant to block automated deobfuscation tools, though the author's own reverse-engineering suggests the actual payload may be less sinister than the labels imply.

5. Python's experimental JIT to be removed python

submitted by val — 95 points (+90 this week) — 30 comments

The Python steering council rejected PEP 836, effectively ending the experimental JIT that landed in CPython 3.13 — the issue wasn't the JIT itself, but that it arrived without proper vetting and the authors couldn't pin down concrete plans for maintenance, compatibility testing, platform support, and security.

6. POSIX wordexp(3) is dangerous c security

submitted by yossarian — 85 points (+84 this week) — 20 comments

wordexp(3) executes shell commands by default, and even with WRDE_NOCMD, musl and macOS have known bypasses that let command substitution patterns slip through their filtering.

7. Ghostty 1.4.0 release

submitted by BD103 — 85 points (+80 this week) — 22 comments

Ghostty 1.4.0 adds full Kitty graphics support with animation and relative placement, cuts scrollback memory usage by 70–90% through compression, and patches security holes in paste protection and terminal output handling that could crash the app or run commands without confirmation.

8. CSS-Tricks has a new owner web

submitted by seb — 112 points (+78 this week) — 2 comments

Geoff Graham just bought CSS-Tricks back from DigitalOcean and is running it independently full-time, banking on memberships, ads, and a beginner's course to keep the lights on while shifting the site toward more entry-level content.

9. Quad9 DNS Resolver to exit France law networking

submitted by mond — 112 points (+78 this week) — 11 comments

Quad9 is exiting France after a court ordered it to block DNS resolution for domains beIN claims infringe copyright — a requirement that would require tracking user location, violating Quad9's core privacy mission. They already tried geolocation blocking in Germany and got fined for contempt when someone used a VPN to circumvent it.

10. Vim Classic editors vim

submitted by datboi — 79 points (+77 this week) — 46 comments

A fork of Vim 8.x aimed at long-term maintenance, explicitly built without AI tools and launched in response to uncertainty around Vim's current development.

11. Docker is weird programming

submitted by nick4 — 103 points (+74 this week) — 48 comments

Building a container runtime from scratch reveals Docker's odd architecture: containers are really just processes wrapped in five Linux kernel features (namespaces, cgroups, networking), images are chroot'd directories, and runc has to work around Go's threading model and missing fork support with a C stub that runs syscalls before exec'ing your actual process.

12. Attention people who think UB is fine c c++

submitted by abareplace — 77 points (+70 this week) — 73 comments

The same undefined behavior compiles into three wildly different outcomes across compilers and optimization levels: silently executing unrelated functions, writing random values, or deliberately crashing. The author walks through concrete examples showing why "we know what will happen" is dangerously wrong.

13. Shitty Screenshare browsers web

submitted by Sean-Der — 76 points (+67 this week) — 33 comments

WHIP lets OBS and FFmpeg stream directly into video conferences with full control over bitrate, codec, and resolution instead of letting your browser compress everything into mud — and the author, who works on WHIP in OBS, built this site to pressure conference providers into supporting it.

14. Partial Order Precedence zig

submitted by liberty — 65 points (+63 this week) — 16 comments

Zig now requires parentheses for operator combinations that lack defined precedence—a ten-year-old proposal finally implemented. Only 353 lines across the codebase needed changes, and common arithmetic chains like x + y * z stay parenthesis-free since their precedence is unsurprising.

15. Indian government sites are serving revoked eMudhra certificates security

submitted by adityaathalye — 73 points (+62 this week) — 18 comments

A researcher found 773 Indian government domains still serving revoked eMudhra certificates days after October 19th—including four bodies under MeitY and the regulator that oversees eMudhra—while the government claimed impact was "very limited and for a very short interval," despite the compromised keys being recoverable for 18 months.

16. I want my Wednesday back php security

submitted by lucasluitjes — 118 points (+60 this week) — 32 comments

A security researcher breaks down the actual exploit chain for php2shell and finds that hitting production sites with load balancers and WAF protection would require days of brute-forcing across thousands of build combinations — meanwhile the "mass exploitation" warnings were based on attempted attacks, not successful ones.

17. Apple's git still trusts the compromised eMudhra certificates cryptography mac

submitted by galadran — 118 points (+59 this week) — 26 comments

Apple's developer tools—git, curl, python3—still trust eMudhra's compromised certificates eleven days after notification, while dozens of volunteer-run projects shipped fixes in days; an attacker on your network can intercept git clones, pulls, and your GitHub tokens.

18. The glorious @xkcdRandom Zig builtin compilers zig

submitted by wofo — 65 points (+58 this week) — 8 comments

Zig's developer experience is smooth enough that adding a joke builtin to the compiler takes just 22 lines and a few minutes—and the author documents the whole process of forking, modifying, and building to prove it works.

19. EMACS turns 50 emacs historical

submitted by facundoolano — 74 points (+57 this week) — 9 comments

Emacs turns 50 this year, and the MIT Technology Review traces how it evolved from a way to standardize commands in a customizable editor into the tool that helped spark the free software movement—starting with Stallman's decision to share it only if recipients agreed to send improvements back.

20. A fast and secure tar parser for the Rust ecosystem python rust

submitted by yossarian — 89 points (+53 this week) — 15 comments

Astral swapped out their tar parser for a new one that's twice as fast and eliminates parser differentials—cases where the same tarball could extract differently in uv versus pip, potentially letting attackers slip malicious files past security checks.

Pleopods is a weekly digest of the top links from Lobste.rs. Archive