Reddit Programming
211 subscribers
1.22K photos
126K links
I will send you newest post from subreddit /r/programming
Download Telegram
Two Catastrophic Failures Caused by "Obvious" Assumptions
https://www.reddit.com/r/programming/comments/1qj00yq/two_catastrophic_failures_caused_by_obvious/

<!-- SC_OFF -->Both incidents involve smart people doing reasonable things and systems behaving exactly as designed. Mars Climate Orbiter (1999): lost because one team used Imperial units and the other used Metric. Citibank $500M error (2020): a routine interest payment turned into a principal transfer due to ambiguous UI labels. The problem wasn’t complexity but "meaning" that existed only in people’s heads. This is a breakdown of how assumptions turn into catastrophic technical debt. <!-- SC_ON --> submitted by /u/Vast-Drawing-98 (https://www.reddit.com/user/Vast-Drawing-98)
[link] (https://open.substack.com/pub/alexanderfashakin/p/make-it-make-sense-nobody-clicked-the-wrong-button?utm_campaign=post-expanded-share&utm_medium=web) [comments] (https://www.reddit.com/r/programming/comments/1qj00yq/two_catastrophic_failures_caused_by_obvious/)
Using KadePy (Python) to communicate with Node.js via Hyperswarm — best practices?
https://www.reddit.com/r/programming/comments/1qjgwt2/using_kadepy_python_to_communicate_with_nodejs/

<!-- SC_OFF -->Hey everyone, I recently released KadePy, a Python library inspired by Hyperswarm, with the goal of enabling P2P communication between Python and Node.js using the same swarm/discovery concepts. I've been experimenting with a setup since: Python uses KadePy Node.js uses Hyperswarm Both enter the same thread and exchange binary messages/streams2 So far, it's a function for basic messages, but I'd like to receive feedback from people with more experiences with: Hyperswarm Internal Operation P2 P Networks Communication between runtime environments (Python Node.js) Something questions: Are there any issues encountered when confusing Python-based peers with Hyperswarm peers in Node.js? Anything recommended for message inquiries, handshakes, or broadcast protocols? Do anyone have performance or security issues with a C extension approach to CPython? Would it make sense to completely mirror a Hyperswarm API or maintain a more Pythonic abstraction? For those curious, the project is open source and still in its early stages. I'd greatly appreciate any feedback, criticism, or ideas from the community. Thank you! <!-- SC_ON --> submitted by /u/Shoddy_Use_473 (https://www.reddit.com/user/Shoddy_Use_473)
[link] (https://github.com/on00dev/KadePy.git) [comments] (https://www.reddit.com/r/programming/comments/1qjgwt2/using_kadepy_python_to_communicate_with_nodejs/)
Malicious PyPI Packages spellcheckpy and spellcheckerpy Deliver Python RAT
https://www.reddit.com/r/programming/comments/1qkwrks/malicious_pypi_packages_spellcheckpy_and/

<!-- SC_OFF -->Please forgive my "Shell-check" dad joke it was too easy, had to be done. At Aikido Security we just found two malicious PyPI packages, spellcheckpy and spellcheckerpy, impersonating the legit pyspellchecker… and the malware authors got pretty creative. Instead of the usual suspects (postinstall scripts, suspicious __init__.py), they buried the payload inside: 📦 resources/eu.json.gz …a file that normally contains Basque word frequencies in the real package. And the extraction function in utils.py looks totally harmless: def test_file(filepath: PathOrStr, encoding: str, index: str): filepath = f"{os.path.join(os.path.dirname(__file__), 'resources')}/{filepath}.json.gz" with gzip.open(filepath, "rt", encoding=encoding) as f: data = json.loads(f.read()) return data[index] Nothing screams “RAT” here, right? But when called like this: test_file("eu", "utf-8", "spellchecker") …it doesn’t return word frequencies. It returns a base64-encoded downloader hidden inside the dictionary entries under the key spellchecker. That downloader then pulls down a Python RAT — turning an innocent spelling helper into code that can: - Execute arbitrary commands remotely
- Read files on disk
- Grab system info or screenshots
- …and generally turn your machine into their machine So yeah… you weren’t fixing typos — you were installing a tiny remote employee with zero onboarding and full permissions. We reported both packages to PyPI, and they’ve now been removed.
(Shoutout to the PyPI team for moving fast.) Checkout the full article here -> https://www.aikido.dev/blog/malicious-pypi-packages-spellcheckpy-and-spellcheckerpy-deliver-python-rat <!-- SC_ON --> submitted by /u/Advocatemack (https://www.reddit.com/user/Advocatemack)
[link] (https://www.aikido.dev/blog/malicious-pypi-packages-spellcheckpy-and-spellcheckerpy-deliver-python-rat) [comments] (https://www.reddit.com/r/programming/comments/1qkwrks/malicious_pypi_packages_spellcheckpy_and/)
Explainability Is a Product Feature
https://www.reddit.com/r/programming/comments/1qkxlmw/explainability_is_a_product_feature/

<!-- SC_OFF -->Admins, support staff, and operations teams are first-class users of your system, yet most systems treat them as afterthoughts. When systems hide their reasoning, these humans absorb the cost. They field angry tickets, craft apologetic responses to frustrated customers, and stay late trying to understand why something happened so they can explain it to someone else. The stress accumulates. Blame spreads. Burnout follows. Poor explainability doesn’t just create technical debt, it creates organizational drag. Every unexplainable behavior becomes a meeting, a Slack thread, an interruption that pulls someone away from actual work to perform forensics on their own system. The system’s opacity becomes everyone’s problem. <!-- SC_ON --> submitted by /u/Unhappy_Concept237 (https://www.reddit.com/user/Unhappy_Concept237)
[link] (https://open.substack.com/pub/hashrocket/p/explainability-is-a-product-feature?utm_campaign=post&utm_medium=email) [comments] (https://www.reddit.com/r/programming/comments/1qkxlmw/explainability_is_a_product_feature/)