Article URL: https://servo.org/blog/2026/11/05/september-in-servo/ Comments URL: https://news.ycombinator.com/item?id=50379576 Points: 12 # Comments: 1
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
The article explains how to write regression tests that ensure the CVE-2026-114509 fix in Laravel's TokenGuard remains in place after deployment. The vulnerability involves non-string JSON credentials reaching the user lookup on MySQL, and the patched guard now rejects such values with an is_string() check before querying the provider. The recommended approach combines unit tests with a synthetic provider, integration tests on MySQL or MariaDB, and HTTP-level tests on a disposable application. It also calls for a version matrix covering the patched releases, pinned dependencies, and a non-affected database as a control. Together these layers guard against regressions from vendor changes, copied custom guards, or dependency updates.
EXOSHOCKのようなVRゲームの普及で、ヘッドセットを日常的に装着する習慣が広がりつつある。この流れを受けて、両眼に独立した映像を出せるVR機器を視覚トレーニングに応用する発想が生まれている。Seven SportsのAmblyotubeは、Meta Quest向けにYouTubeの映像を左右の目で別々に処理し、弱視や両眼協調の改善を目指す。アイパッチに比べて継続しやすく、仮想空間で視力測定の条件を一定に保てる点が特徴とされる。記事は、こうした設計判断をエンジニア視点で整理している。
An AI agent operating a benchmark program tested open-weight models against self-hosted CAPTCHAs in a scripted browser. Proof-of-work challenges from ALTCHA and Cap were solved in every trial, typically within seconds and at a cost of a fraction of a cent. GoCaptcha's image-based click challenge, however, produced zero solves across 209 attempts with three models. The authors attribute the failures to the agents running out of their attempt budgets, with the 95% upper confidence bound for success placed at about 1.8%. The article also reports that the program's own published posts have received essentially no reactions.
A Nigerian developer built Airlock for the Flip the Switch hackathon to address a common payments problem: a customer is charged but an order stays pending, and each company blames the other while neither can share sensitive logs. The project uses two fictional companies, a shop called KudiMart and a provider called Paylane, with synthetic data. In the scenario, a KudiMart webhook verifier rolled out to a canary pod reads only the new signature header, so it rejects webhooks after Paylane rotates its signing secret. Each company runs a private room and an AI investigator, while a shared room includes only the engineers and a rule-based 'Customs' agent that accepts typed, enum-constrained claims that a human must release. Switch enforces room membership on the server, so investigators cannot read the shared channel.
Discussion (0)
Log in to join the discussion and vote.
Log in