doodlesdev

Only available to Google AI Pro subscribers. Google AI Plus hasn't got Gemini 3.8 Flash nor Gemini 4 Argon.

I find Dan Luu's blog extremely good to read on mobile, with great typography. The website also works with Firefox Reader mode and loads pretty quickly due to using the system's font.

Crazy performance and compatibility claims here. How is it that I've never heard of this project before?

Interesting feature.

I very much like Steam features aimed at helping me discover new games, since I find that nowadays I'm having much more difficulty navigating through all of the option to find something interesting to play, as I'm not investing as much time gaming as I used to when I was younger.

Any fellow HNers have cool suggestions? I keep hearing about Factorio and Satisfactory here, but not much else.

Apparently it doesn't contain a binding to the C library, but it does contain some compatibility and shares design decisions with it. In other words, it's not a clean-room implementation from the spec, but rather it's a port. Since this RCE is triggered by a OOB access, it's unlikely to have made it into the crate, but it's good to keep these things in mind.

Most microVMs run on extremely stripped down versions of Linux or NetBSD. Not the same thing as relying on PAM, SystemD, namespaces and cgroups to protect your application

Funnily enough, regarding SoftTalker's point, just a few hours after my original comment, CVE-2026-110264 (a CVSS 10.0... worse than PHP's RCE) rolled in for GitLab, which would be prevented by using a memory safe language to write the interpreter instead of C.

I don't use any of those for anything running dynamically on the web or accepting untrusted user data. Unless it is a quick student project, there's rarely a reason to do that anymore. It's also not the same thing, both NodeJS and Python with ASGI handle less parts of web requests than PHP is meant to.

Meanwhile, there are different threat models to any type of web application, it's just that PHP has repeatedly failed us in any threat model, same as C in most threat models that don't involve compiling it to WASM or running it air-gapped.

Leaving memory unsafe runtimes and interpreters directly available to public web traffic is a liability I don't want for me and users don't deserve to face the consequences of it whenever they are trusting you with their data. Rust and Golang even with all of their design issues should be the baseline for internet facing software nowadays.

As for the Linux kernel, everything I run on it is inside a VM (or a microVM) instead of relying on containers exclusively, because I can't trust a C kernel to not have vulnerabilities.

This might be one of the funniest articles ever. "Drupal is now light-years ahed of its reputation", yet it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing.

It's time to abandon PHP and C-based software (i.e. PHP). The clock's ticking.

Crazy to think it's possible to access Opus 5 levels of intelligence for free. Of course, this is likely temporary, but something I believe a lot of students could make good use of.