Reddit Programming
199 subscribers
1.22K photos
126K links
I will send you newest post from subreddit /r/programming
Download Telegram
chronex - an Open-source social media scheduler
https://www.reddit.com/r/programming/comments/1sb4hwt/chronex_an_opensource_social_media_scheduler/

<!-- SC_OFF -->Over the past few weeks, I've been building a platform where users can connect their social accounts and automate content posting. So I built Chronex, an open-source alternative to paid content schedulers. Tech Stack Web/Platform: Next.js, tRPC, Drizzle, Better Auth Media Storage: Backblaze B2 Scheduling & Posting: Cloudflare Workers & Queues Github (https://github.com/prncexe/chronex) <!-- SC_ON --> submitted by /u/_Introvert_boi (https://www.reddit.com/user/_Introvert_boi)
[link] (https://chronex.princecodes.tech/) [comments] (https://www.reddit.com/r/programming/comments/1sb4hwt/chronex_an_opensource_social_media_scheduler/)
Using CEL's now() to enforce dependency cooldown periods - block packages published in the last N hours
https://www.reddit.com/r/programming/comments/1sbb7jv/using_cels_now_to_enforce_dependency_cooldown/

<!-- SC_OFF -->Supply chain attacks often rely on speed that is publish a malicious version, let automated builds pull it before detection catches up. One defense is a cooldown period : refuse any dependency published within the last N hours. CEL (Common Expression Language) doesn't expose now() by default since it's designed to be hermetic. This article actually walks through registering a custom now() function binding that returns the current UTC timestamp, using duration arithmetic to compare against package_published_at, and using the has() macro to handle packages so new they haven't been indexed yet - which is the edge case that will bite you if you miss it. <!-- SC_ON --> submitted by /u/BattleRemote3157 (https://www.reddit.com/user/BattleRemote3157)
[link] (https://safedep.io/writing-time-based-policies-in-vet-cel/) [comments] (https://www.reddit.com/r/programming/comments/1sbb7jv/using_cels_now_to_enforce_dependency_cooldown/)
I implemented Raft, a KV store, and a sharded system in Go (MIT 6.5840)
https://www.reddit.com/r/programming/comments/1sbdk50/i_implemented_raft_a_kv_store_and_a_sharded/

<!-- SC_OFF -->I recently completed the labs from MIT 6.5840 Distributed Systems and implemented everything in Go, including: Raft consensus algorithm A replicated Key/Value store A sharded KV system with dynamic reconfiguration The implementation focuses a lot on concurrency and failure handling: goroutines for RPC handling and background tasks channels for coordination between Raft and the state machine dealing with unreliable networks (dropped / delayed / out-of-order RPCs) Some interesting challenges: ensuring commitIndex never goes backward under out-of-order RPC responses handling retries safely with client/request IDs (idempotency) keeping deduplication state consistent across snapshots and shard transfers I wrote a detailed README explaining both the design and the tricky edge cases I encountered. <!-- SC_ON --> submitted by /u/am0123 (https://www.reddit.com/user/am0123)
[link] (https://github.com/abdellani/mit-6.5840-labs) [comments] (https://www.reddit.com/r/programming/comments/1sbdk50/i_implemented_raft_a_kv_store_and_a_sharded/)
Someone is actively publishing malicious packages targeting the Strapi plugin ecosystem right now
https://www.reddit.com/r/programming/comments/1sbkx3b/someone_is_actively_publishing_malicious_packages/

<!-- SC_OFF -->strapi-plugin-events dropped on npm today. Three files. Looks like a legitimate community Strapi plugin - version 3.6.8, named to blend in with real plugins like strapi-plugin-comments and strapi-plugin-upload. On npm install it runs an 11-phase attack with zero user interaction: Steals all .env files, JWT secrets, database credentials Dumps Redis keys, Docker and Kubernetes secrets, private keys Opens a 5-minute live C2 session for arbitrary shell command execution The publisher account kekylf12 on npm is actively pushing multiple malicious packages right now and all targeting the Strapi ecosystem. Check the account: npmjs.com/~kekylf12 (http://npmjs.com/~kekylf12) If you work with Strapi or have any community plugins installed that aren't scoped under strapi/ - audit your dependencies now. Legitimate Strapi plugins are always scoped. Anything unscoped claiming to be a Strapi plugin is a red flag. Full technical breakdown with IoCs is in the blog. <!-- SC_ON --> submitted by /u/BattleRemote3157 (https://www.reddit.com/user/BattleRemote3157)
[link] (https://safedep.io/malicious-npm-strapi-plugin-events-c2-agent/) [comments] (https://www.reddit.com/r/programming/comments/1sbkx3b/someone_is_actively_publishing_malicious_packages/)
Domain-Driven Design: Lean Aggregates
https://www.reddit.com/r/programming/comments/1scjod7/domaindriven_design_lean_aggregates/

<!-- SC_OFF -->In DDD, an aggregate is a consistency boundary, not just a container for related data. If you find yourself loading massive object graphs for simple updates, you might be falling into a common trap. <!-- SC_ON --> submitted by /u/deniskyashif (https://www.reddit.com/user/deniskyashif)
[link] (https://deniskyashif.com/2026/04/04/domain-driven-design-lean-aggregates/) [comments] (https://www.reddit.com/r/programming/comments/1scjod7/domaindriven_design_lean_aggregates/)
A whole boss fight in 256 bytes
https://www.reddit.com/r/programming/comments/1sde1vx/a_whole_boss_fight_in_256_bytes/

<!-- SC_OFF -->Technical write up for "Endbot" 256 bytes MSDOS program with plot, sync, sound, and payoff. Released April 4th at Revision Demoparty 2026. <!-- SC_ON --> submitted by /u/Hell__Mood (https://www.reddit.com/user/Hell__Mood)
[link] (https://hellmood.111mb.de//A_whole_boss_fight_in_256_bytes.html) [comments] (https://www.reddit.com/r/programming/comments/1sde1vx/a_whole_boss_fight_in_256_bytes/)