1
We should all be using dependency cooldowns
See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.
William Woodruff
TL;DR: I’ve turned my April post on Brocards for vulnerability triage into a more permanent website. You can now link to each brocard directly, like this , without having to worry about link rot 1 .
- Popular posts
- 19
- Total points
- 4,095
- HN comments
- 2,920
- Rank
- #310 personal
Visit blog.yossarian.net → RSS feedOn Hacker News May 2020 – Aug 2026
Software Engineering 11Systems & Performance 5Tools & Productivity 4Programming Languages 4Security & Privacy 3Infrastructure & DevOps 3
2
Be Aware of the Makefile Effect
Update 2024-01-12 : Ken Shirriff has an an excellent blog post on why “cargo cult” is a poor term of art.
3
GitHub Actions could be so much better
I love GitHub Actions: I’ve been a daily user of it since 2019 for both professional and hobbyist projects, and have found it invaluable to both my overall productivity and peace of mind. I’m just old enough to have used Travis CI et al. professionally before moving to GitHub Actions, and I do not look back with joy 1…
4
Weird architectures weren't supported to begin with
This post contains my own opinions, not the opinions of my employer or any open source groups I belong or contribute to.
5
Why don’t we do email verification in reverse?
Just about everybody who has ever used a service on the web has experienced the following account creation follow:
6
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
7
Dear GitHub: no YAML anchors, please
This was a good thing . YAML anchors in GitHub Actions are (1) redundant with existing functionality, (2) introduce a complication to the data model that makes CI/CD human and machine comprehension harder, and (3) are not even uniquely useful because GitHub has chosen not to support the one feature (merge keys) that…
8
Things I hate about Rust, redux
Two years ago, I wrote a post with a handful of grievances about Rust , a language that I then (and still) consider my favorite compiled language.
9
Hiding messages in x86 binaries using semantic duals
This is a quick writeup of a steganographic tool that I threw together: steg86 . It uses a quirk of the x86 instruction encoding format to hide messages in pre-existing binaries with no size or performance overhead.
10
Things I hate about Rust
Five years ago, I wrote a post about the things I hated most about my then (and still) favorite scripting language: Ruby.
11
How x86_64 Addresses Memory
Update 2025-03-05 : @jxu has shared a collection of simplified examples that are even easier to follow than the original ones in this post.
12
Approximating sum types in Python with Pydantic
TL;DR: You can use Pydantic’s support for tagged unions to approximate sum types in Python; go right to Sum types in Python (and onwards) to see how it’s done.
13
A few HiDPI tricks for Linux
As part of that switch, I needed to configure parts of my Linux environment (which was originally stock Ubuntu, but is now i3 with a heavily customized userspace) to function correctly on HiDPI displays.
14
LLVM Internals: The Bitcode Format
I’ve done a couple of posts on LLVM itself, mostly on things you can do with LLVM or how LLVM represents particular program features.
15
Dates That Don't Exist (2015)
In 1582, under the inter gravissimas papal bull, the Catholic world transitioned from the Julian Calendar to the Gregorian Calendar . This new calendar shortened the length of the year from 365.25 days to 365.2425 , a reduction of just 0.002% .
16
Modernizing my 1980s sound system
Where the last two posts were primarily about software ( Navidrome and beets , respectively), this post will be more about hardware (and a bit of software to control it). Hopefully it’ll be useful to others with older sound hardware, especially those who are compelled (as I am) to avoid buying a “connected” device…
17
How many registers does an x86-64 CPU have?
x86 is back in the general programmer discourse, in part thanks to Apple’s M1 and Rosetta 2 . As such, I figured I’d do yet another x86-64 post.
18
LLVM internals, part 4: attributes and attribute groups
This is the last post I plan to do on parsing LLVM’s bitcode, at least for a while. I’ll keep working on the various libraries that I’ve started under the mollusc umbrella, but they won’t be accompanied by regular posts anymore — I’d like to refocus on writing smaller, less dense (read: lower-pressure) posts for a…
19
Writing and publishing a Python module in Rust
This post is a quick walkthrough of how I wrote a Python library, procmaps , in nothing but Rust. It uses PyO3 for the bindings and maturin to manage the build (as well as produce manylinux1 -compatible wheels).