The ability to do shared-memory concurrency imposes a massive burden on the ecosystem, because everyone keeps having to ask "is this dependency thread-safe". Most languages should just stick to message passing and the actor model (99% of the time, it's a better way to build software anyway)
The first company to make CI configuration that *isn't* YAML will win $1,000,000,000,000
I did Compiler Explorer's monthly accounts, and for the first time in ages we only broke even. Usually we run at a small surplus (which I save) & we have a year contingency saved up. If you want to support us: * Buy stuff: shop.compiler-explorer.com * Patron/GH: "Other" menu on CE Please repost. thx
Compiler Explorer
The official Compiler Explorer shop! Come show your support for CE and get cool gear!
shop.compiler-explorer.com
This talk from @andrewnez.bsky.social grows more and more important as the days go on... it's a must watch! #Python #PyPI #PyConUS #PyConUS2026 #security
💡 Security Track Spotlight: In his talk “GitHub Actions Security in Python Packages” at #PyConUS 2026 @andrewnez.bsky.social shares findings from scanning thousands of workflows and practical ways to harden Python package releases. #security us.pycon.org/2026/schedul...
maybe a good time to update your workflows to *not* use pull_request_target with a checkout securitylab.github.com/resources/gi...
Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests
Combining the pull_request_target workflow trigger with an explicit checkout of an untrusted Pull Request is a dangerous practice that may lead to repository compromise.
securitylab.github.com
`pub(...)` was a mistake: `pub` should mean `pub(crate)` and there should be `export` or similar to mean current `pub`. Nothing else. If you need more than that, then your crate is too big.
“There’s a tidal wave coming. You can see it. We can all see it. Are you going to lay down and die, or are you going to do something about it?” Be ready to patch your systems, repeatedly, for at least the next 12 months.
What happens when amateur hackers have the tools to iterate through exploits at machine speed? I wrote about the neu script kiddies, what happens after Mythos, and how companies can prepare. www.theverge.com/ai-artificia.... with insight from @k8em0.bsky.social Dan Guido, Joshua Saxe, & Tim Becker.
🔎🔐 PyPI has completed its second external #security audit! Thanks to @sovereign.tech for funding, Trail of Bits for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python #PyPI
PyPI has completed its second audit - The Python Package Index Blog
We are proud to announce PyPI's second external security audit.
blog.pypi.org
the last two weeks have been ~exciting~ in terms of open source security! I've put together a post on Astral's blog about how we think about open source security: astral.sh/blog/open-so...
Open source security at Astral
Insights and guidance from our engineering team on how Astral secures its tools.
astral.sh
LLM-explanation is now live in @compiler-explorer.com - An example: compiler-explorer.com/z/rvvx7MxKq * LLMs make mistakes and are overconfident * We'll never force LLMs or AI on you, it's opt in (like clang-tidy, PVS Studio or other tools) * It is *beta* quality Initial results are promising(1/3)
Compiler Explorer - C++ (x86-64 clang 21.1.0)
// setup constexpr auto valid_chars = "0123456789abcdef"; bool is_valid_id(std::string_view maybe_id) { if (maybe_id.size() != 16) { return false; } if (maybe_id.find_first_not_of(valid_ch...
explain.compiler-explorer.com
it has been seven^W zero days since the last npm supply-chain attack
Honestly serious: JUST DON'T UPDATE PACKAGES RIGHT NOW. It is unclear to me yet, but this is looking pretty wide spread. Better be safe than sorry, just go touch some grass.
The macro expansion feature just got merged in rustdoc! If enabled, you can now expand all macros in source code pages. PR: github.com/rust-lang/ru... Enjoy!
Add support for macro expansion in rustdoc source code pages by GuillaumeGomez · Pull Request #137229 · rust-lang/rust
This is what it looks like: You can test it here. In this case, I also enabled the --generate-link-to-definition to show that both options work well together. Note: There is a bug currently in fi...
github.com
Crates-io implemented trusted publishing! It allows to publish from GitHub Actions without the need of a crates-io token! Here's what you need to change in your release-plz workflow to migrate to it. Learn more at: blog.rust-lang.org/2025/07/11/...
Dear AI coding helper, Sometimes a tab is just a tab and not a request to rewrite the line of code.
Getting around Rust's trait limitations with type-level first order logic 🔥
I am disappointed in the AI discourse steveklabnik.com/writing/i-am...
I am disappointed in the AI discourse
steveklabnik.com