A place for programmers 程序员自留地
Joined December 2011
- Tweets3.9K
- Following41
- Followers129
- Likes366
PostgreSQL 19 now ships November 19 instead of October 29, with an extra RC2 on November 12. About 8 to 10 features were pulled after beta, SQL/PGQ graph queries among them. Many are expected back in PostgreSQL 20.
319 Chrome extensions hijacked searches for 13.4M users with a manifest entry, not code. chrome_settings_overrides made the operator's proxy the default search engine; it logged queries and added Bing or Yahoo referral IDs. Most were unlisted, spread via PDF converter ads.
One leaked set of AI API credentials ran up nearly $1M in charges before anyone caught it, per Unit 42. Stolen keys get resold through proxy services within minutes, and the bill only shows it at the end of the cycle. Spend limits with alerts would have flagged it early.
Go 1.28's HTTP/2 parking lets idle connection goroutines exit, cutting ~85–93 MiB RSS and 5,000 goroutines at 5,000 idle connections in one benchmark.
Go Weekly, 2026-10-26 ~ 2026-11-02: 14 posts. 4 worth your time:
1. Go 1.24+ on Linux listens with MPTCP by default, which the CVE-2026-98432 exploit needs. The post shows how to read the setting from a binary, disable it, and understand the limits.
2. Go shipped an urgent release in under 7.5 hours to block compromised eMudhra certificates, protecting TLS users. It also outlines future improvements.
3. anthropic-sdk-go v2 sends API version 2026-10-21, drops temperature, and moves the key to Authorization. The post runs old and new side by side to show compile errors and silent changes.
4. pgxpool defaults to max(4, NumCPU) connections, and the post shows how to use pool.Stat() to tell whether that is too small, with measured throughput from 4 to 64 connections.
All 14 links, grouped by topic:
substack.com/home/post/p-223…
Go 1.28's HTTP/2 parking lets idle connection goroutines exit, cutting ~85–93 MiB RSS and 5,000 goroutines at 5,000 idle connections in one benchmark.
Go Weekly, 2026-10-26 ~ 2026-11-02: 14 posts. 4 worth your time:
1. Go 1.24+ on Linux listens with MPTCP by default, which the CVE-2026-98432 exploit needs. The post shows how to read the setting from a binary, disable it, and understand the limits.
2. Go shipped an urgent release in under 7.5 hours to block compromised eMudhra certificates, protecting TLS users. It also outlines future improvements.
3. anthropic-sdk-go v2 sends API version 2026-10-21, drops temperature, and moves the key to Authorization. The post runs old and new side by side to show compile errors and silent changes.
4. pgxpool defaults to max(4, NumCPU) connections, and the post shows how to use pool.Stat() to tell whether that is too small, with measured throughput from 4 to 64 connections.
All 14 links, grouped by topic:
substack.com/home/post/p-223…
How Go Context Cancellation Actually Propagates, and Where It Stops
pixelstech.net/article/17931…
for ppl caring abt cost can read
Full write-up: importstatic.com/ai/gpt-6-1-…
PixelsTech retweeted
I have built lots of websites, apps, browser extensions, I find the most difficult problem is not to build the product but to promote it. To promote and learn how people react to my product, I need to collect data from many different sources like hacker news, reddit, X, bluesky... So I build an service to track my product and put them all together and I then have a consolidated place to know what's going on with it. This ends with an open source project which I think would benefit others. Also you can contrinute to add more sources and give feedback on what can be improved.
The service is self-hosted and all you APi keys and AI keys are saved on your machine, so safe to use.
The repo: github.com/sonic0002/eaveson…
Go 1.27.3 and 1.26.10 reject any chain through 16 revoked eMudhra intermediates.
Go Weekly, 2026-10-19 ~ 2026-10-26: 44 posts. 4 worth your time:
1. Go's method must have no type parameters error usually means an old toolchain or go line, unless it is an interface. The post includes real output from Go 1.25, 1.26, and 1.27 to help diagnose it.
2. CVE-2026-111497 is in Brotli's C decoder. The post maps which Go and Rust stacks link it, which frameworks decode br request bodies by default, and the versions to check.
3. A Go SQLite benchmark found mattn/go-sqlite3 ran point queries 1.6x faster than modernc.org/sqlite, but its Linux cross-build from a Mac was a stub. That trade-off matters when choosing a driver.
4. In package APIs, each %w makes the wrapped error part of your API. The post covers when to use sentinels, typed errors, %v, and where to log.
All 44 links, grouped by topic:
substack.com/home/post/p-222…
Node.js 26 becomes Active LTS on October 28, 2026, and teams on Node 22 or 24 should plan to move directly to 26 because Node 22 support ends in April 2027 while 26 lasts until April 2029. The main breakage includes removed response.writeHeader(), _stream_* modules, --experimental-transform-types, and short AES-GCM tags without an explicit authTagLength; module.register() and passing CryptoKey to crypto functions are runtime-deprecated, native addons need rebuilding for NODE_MODULE_VERSION 147, and outbound HTTP code should be retested against undici 8. Skipping Node 25 means also inheriting the removal of bundled Corepack, fs.F_OK/R_OK/W_OK/X_OK constants, and SlowBuffer, plus default Web Storage globals and changed localStorage behavior when no storage file is configured. Before upgrading, run the full test suite with --throw-deprecation, since warnings can fire asynchronously after a test appears to pass, and use a text audit for known patterns, then check dependencies and native modules and apply the official codemods for fs constants and SlowBuffer. The payoff includes Temporal enabled by default and V8 14.6 features such as Map.prototype.getOrInsert(), but verify your own suite on Node 26.12.0 or the first 26.x LTS build before production.
more on pixelstech.net/article/17926…
Zomato cut Go GC CPU from about 25% to under 2% by setting GOMEMLIMIT to 90% of each container's memory ceiling, saving roughly $30K monthly.
Go Weekly, 2026-10-12 ~ 2026-10-19: 32 posts. 5 worth your time:
1. A Go save function using defer f.Close() and defer w.Flush() returned nil while leaving 8 KiB of a 20 KB file. The post explains why the Close error matters and what to write instead.
2. errors.As and errors.Is return false when you wrap &MyErr{} but check for MyErr. Go 1.27 adds a vet check that catches it, and the post covers the fix.
3. Go 1.27 includes an HTTP client change that can make programs sending many sequential HTTP/1 requests significantly faster. This is useful for connection-reuse-heavy workloads.
4. Go 1.27 drains an unread HTTP/1 response body on Close. Tests cover chunked streams, slow bodies, json.Decoder and forced closes to see which connections get reused.
5. gopls adds interactive LSP refactoring for struct tags, interfaces, and declaration moves. That gives Go developers more automated refactors directly in the editor.
All 32 links, grouped by topic:
substack.com/home/post/p-221…
Python 3.15 enables UTF-8 mode by default via PEP 686, so bare open() calls, stdio, pipes, command-line arguments, environment variables, and filenames use UTF-8 instead of the locale encoding. The change mostly breaks Windows code that wrote files with the ANSI code page, since those files may now raise UnicodeDecodeError or decode as mojibake when read back. Developers can preview the behavior on Python 3.14 with -X utf8 or PYTHONUTF8=1 and find implicit encoding sites using -X warn_default_encoding, PYTHONWARNDEFAULTENCODING, or Ruff's PLW1514 rule. Fix flagged calls by passing encoding="utf-8" for new or exchanged data, the correct legacy encoding such as cp1252 for existing Windows files, or encoding="locale" when system settings are truly required, and remember to set encodings on subprocess pipes when using text=True. PYTHONUTF8=0 or -X utf8=0 can temporarily restore old behavior, but explicit encoding arguments are the durable cross-version fix.
more details at pixelstech.net/article/17921…
Good news, our smart redact PDF tool now supports in-browser AI processing to better find information to redact. Give a try. pixelstech.net/application/p…
Upgrading to Go 1.27 made default gzip 3 to 12x faster, and its output up to 13% bigger.
That's 1 of 11 behaviors that changed in code nobody touched.
Go Weekly, Oct 5–12: 58 posts. Five worth your time:
1. Go 1.27.2 fixes a compiler bug that the race detector hides: a pointer that reads garbage. The same patch also fixes three JSON regressions and inflated coverage numbers.
2. In tests with t.Parallel subtests, defer can run before the subtests finish. Use t.Cleanup instead: it runs in LIFO order and respects the test lifecycle.
3. Go 1.27 adds a uuid package to the standard library, covering v4, v7 and parsing. You may be able to drop google/uuid, though it still does a few things the stdlib version doesn't.
4. Still choosing an HTTP router? Ben Hoyt compared the approaches and concludes the Go 1.22 stdlib router is now the recommended choice.
5. connect-go v2 is out: simpler APIs, pluggable transports, and v1 and v2 can coexist during migration.
All 58 links, grouped by topic:
substack.com/home/post/p-219…
SQLite 3.54.0: updating a JSON document without touching its two json_extract-indexed fields wrote 1 WAL page per UPDATE, down from 3. Plain-column and STORED-column indexes still get rewritten.
Full write-up with the code: importstatic.com/databases/s…
