Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Parsing Expression Grammar in Lisp: Converting Org to HTML with (ice-9 peg) in Guile
Hi everyone. In this blog post I want to take you in an adventure of parsing Org mode with Parsing Expression Grammars (PEG) in Guile Scheme (ice 9 peg) and converting to HTML (via SXML): OrgWebAlchemy. I wanted to share something with you all that I’ve been working on for a while. It all started with some naive regular expressions to parse Org mode content, but I pretty quickly realized I needed something smarter than that to get to where I want to.
5 min · 1,135 words
From Thin Air to Bootable Images: The tine Build System
Martin Pitt and Daan De Meyer introduce tine: reproducible builds of RPM, Go, and Rust components into bootable images from minimal host requirements.
21 min · 4,850 words
Writing a ray tracer in Brainfuck
A playful systems post that implements a ray tracer in Brainfuck—compilers, esolangs, and the surprising claim that sometimes the correct answer is to write a compiler.
9 min · 2,118 words
It is with great sadness that we share the news of the passing of Johannes Doerfert, on September 17, 2026, at the age of 36, after a battle with cancer. Johannes was one of the most prolific and respected contributors to the LLVM compiler project, and his loss will be deeply felt.
5 min · 1,239 words
Every package is already installed
Farid Zakaria introduces omnibin: a FUSE filesystem that puts every binary Nixpkgs ever shipped on your $PATH—nothing installed upfront, 0 bytes on disk until something is actually run.
4 min · 1,001 words
SourceHut account takeover via build logs (XSS in ansi2html.py)
Write-up of CVE-class XSS in SourceHut’s ansi2html path: how crafted build logs could escalate to account takeover, and the fix timeline.
11 min · 2,518 words
F-Droid 2.0: A New Chapter for Android Freedom
F-Droid announces version 2.0—the largest official app update in a decade—with a redesigned UI, better discovery and search, and a simpler experience for installing free and open-source Android apps.
13 min · 2,980 words
Breaking Up with Google Play: Why Conversations Is Now Free
Daniel Gultsch recounts twelve years of Conversations on Google Play, why the XMPP client is leaving the Play Store, and what going fully free means for Android messaging and F-Droid distribution.
4 min · 901 words
Is Structured Human Input the Missing Link in Agentic Work?
Long-running agents pause unpredictably for human input. Ben Greenberg argues A2A’s input-required state needs a schema contract—not free-form text—so pauses become reliable handoffs.
3 min · 801 words
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
Antonio Morales walks through GitHub Security Lab’s Fuzzing Taskflow: point it at a C/C++ repo and an LLM agent writes harnesses, runs AFL++, reads coverage, triages crashes, and files reports.
9 min · 2,147 words
Introducing WalShadow: Sub-second Postgres replication to ClickHouse from physical WAL
Today, we’re announcing WalShadow, an open-source engine that replicates Postgres data to ClickHouse directly from physical WAL. In our benchmarks, transactions committed in Postgres became visible in ClickHouse in around 200 ms, while WalShadow sustained 289K rows/sec, effectively keeping pace with the source Postgres instance. Unlike traditional CDC based systems, WalShadow doesn’t use Postgres logical replication. It consumes the same physical WAL stream used by Postgres replicas, decodes…
5 min · 1,059 words
Glyph Lefkowitz argues open source is a web of ongoing relationships—not a one-way gift from maintainers to users—and asks who the community is really for.
23 min · 5,200 words
devenv 2.4 adds Machines: declare NixOS (and other) host configs beside your nix-based dev environment, then build, install, and deploy with devenv machines.
4 min · 850 words
Electric Capital open-sources Quest, a safety-first AI harness that keeps sensitive data inside your perimeter unless a user explicitly approves outbound access—Apache 2.0 on GitHub.
4 min · 1,008 words
arXiv receives multiyear investment to support independent nonprofit launch
arXiv announces $17.2M in multiyear philanthropic commitments from the Simons Foundation International, XTX Markets, and the Siegel Family Endowment as it launches as an independent nonprofit.
4 min · 825 words
I Got Tired of Vibe Coding, So I Rebuilt the SDLC as Twelve Agent Skills
Zeeshan Hanif open-sources a twelve-skill agent kit that turns vibe coding into a disciplined pipeline—from requirements interview to deployed, verified software with decisions traced on disk.
19 min · 4,397 words
Semantic memory or just Markdown?
Laravel Boost tried embeddings and semantic search for project rules, then deleted them: a generated Markdown index plus grep proved simpler and more reliable for teaching agents existing conventions.
7 min · 1,562 words
mantle.nes breakdown blog part 1
Drmelon walks through building mantle.nes—a multi-month NES demake/fangame of a Deltarune Chapter 3 sequence—covering constraints, techniques, and why the project took shape.
16 min · 3,755 words
Loris Cro reflects on Zigtoberfest remarks: approaching Zig as a multi-year journey across newcomers, intermediate, and advanced users—and what that framing means for the language and community.
4 min · 1,028 words
ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE
TACACS+ is one of the ways large networks centralise administrative access to their equipment, alongside RADIUS and DIAMETER, and it is the one that tends to be chosen where per-command control matters. Instead of every router, switch, firewall and console server keeping its own local accounts, each device asks a TACACS+ server whether a login is allowed, at what privilege level, and often whether each individual command should be permitted. It is standard in enterprise,…
25 min · 5,766 words