19 min
Same layout, new words
A re-export, a re-saved scan, redrawn shapes, a stamp on one page: five public PDF comparison tools each got at least one of them wrong. Perceptual hashes missed a rewritten line in the same layout.
Things that caught my attention.
Whatever I'm into this month, written down while I still remember why. Software and AI most of the time, but games, racing, music and security get a post whenever one of them grabs me.
8 min
From an early break to XSS
One loop in x/net/html's Render trusted its first safe ancestor. Across 2,880 shapes, 240 came back as a live <img>; v0.62.0 closes all of them and escapes 225 that were clean.
12 min
Models guess optimizations well and prove them badly, so gotorque does the proving
An LLM proposes one Go patch per cycle. Isolated worktrees, a test gate the patch can't edit, 25 interleaved A/B pairs and a 407-line policy no model output can reach decide whether it survives.
12 min
A named return silently costs you Go's new append optimization
Go 1.27's runtimefreegc reaches 77 of 2,294 growing appends in the standard library. A temporary pointer rule blocks 224 more; the alias analysis never clears the other 1,994, and that is the gate nobody is lifting.