Open-Source on vnykmshr

Bug 1465

Fri, 27 Mar 2026 00:00:00 +0000

Three bugs walk into a triage queue.

A stack overflow. Symlink loop in tarball parsing, unbounded recursion, process crashes. Build a PoC, trace the call chain, write the report.

“Duplicate of #1465”

Memory exhaustion. String replace in an expression engine, exponential allocation, no cost limit. Different repo, different CWE, different everything. PoC, trace, report.

“Duplicate of #1465”

SQL injection. Template parameter escaping that wraps but doesn’t escape. Different repo again. PoC, trace, report.

What compounds

Fri, 20 Mar 2026 00:00:00 +0000

Something shifted. Not the AI thing – everyone noticed that. What counts as proof.

Used to be your resume, your title, the logo. Still opens doors. But the gap between “I can do X” and “here’s the commit” got wide enough that both sides feel it. A merged PR has a commit hash. A CVE has a number. A library someone depends on has a git log. Credentials got easier to claim. Artifacts didn’t.

The invitation

Wed, 18 Mar 2026 00:00:00 +0000

First PR to an open source project, you’re proving you can read. That you studied the codebase, matched the style, understood why things are the way they are before suggesting they should be different. Most people skip this. Most PRs show it.

The second and third, you’re proving you’ll stay. Maintainers have seen hundreds of drive-by contributions. One PR, gone forever. The ones who come back are rare enough to notice.

The loop

Sat, 14 Mar 2026 00:00:00 +0000

A handful of Go libraries on GitHub. MIT licensed, anyone can use them for anything, that was always the deal.

But the deal isn’t about the license. It’s about the loop.

Someone uses your thing, hits an edge case, opens an issue. Sometimes they send a fix. You review it, learn how people actually use what you built, catch a pattern you missed. That back and forth is the whole point. Code just sits there without it.

autobreaker: adaptive circuit breaking

Sat, 15 Nov 2025 00:00:00 +0000

The circuit breaker post from last year used a common trigger: trip after N consecutive failures. This works when traffic is predictable. It falls apart when it’s not.

At 10,000 requests per second, 10 failures is noise – a 0.1% error rate. A static threshold trips the circuit on what’s essentially a healthy service. At 10 requests per second, 10 failures is total collapse – 100% error rate over one interval. The same threshold that false-positives under high traffic is too slow to protect under low traffic.

ACCEPTed. COMMITed. RESOLVEd.

Fri, 11 Apr 2014 00:00:00 +0000

I came across Adrian Hands’ story through a blog post. I don’t remember which one. The details stayed.

Adrian was a developer with ALS. By the time he wrote his last patch, his hands were gone. He built a Morse code input rig – a Darci USB emulator wrapped in PVC pipe strapped to his knee, paddles attached, tapping out dots and dashes with the last muscles that still worked. That was his keyboard.