https://devnews.news/ Software news, read and annotated by a working engineer en Sat, 19 Sep 2026 17:30:00 +0100 https://devnews.news/analysis/allowlists-encode-the-day-they-were-written/ https://devnews.news/analysis/allowlists-encode-the-day-they-were-written/ Sat, 19 Sep 2026 17:30:00 +0100 The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence. https://devnews.news/analysis/vendor-patch-is-an-unreviewed-change/ https://devnews.news/analysis/vendor-patch-is-an-unreviewed-change/ Sat, 19 Sep 2026 15:10:00 +0100 Every release process guards the code it writes. Almost none guard the code that arrives on somebody else's schedule. https://devnews.news/security/http-query-method-rfc-10008/ https://devnews.news/security/http-query-method-rfc-10008/ Sat, 19 Sep 2026 04:51:46 +0000 RFC 10008 defines QUERY - a GET with a body, safe, idempotent and cacheable. Handling in the wild already disagrees: nginx and Django reject it, Caddy, Traefik and FastAPI pass it through. https://devnews.news/ai/millemiglia-open-benchmark-generator/ https://devnews.news/ai/millemiglia-open-benchmark-generator/ Fri, 18 Sep 2026 17:46:09 +0000 MilleMiglia produces realistic, privacy-preserving middle-mile instances in C++. The scarce resource in optimisation research is not algorithms - it is comparable problems. https://devnews.news/cloud/amazon-sns-1-mib-payloads/ https://devnews.news/cloud/amazon-sns-1-mib-payloads/ Fri, 18 Sep 2026 15:00:00 +0000 The workaround everyone built - put the body in S3 and publish a pointer - is no longer required for messages under a megabyte. https://devnews.news/news/excel-paste-broken-by-security-update/ https://devnews.news/news/excel-paste-broken-by-security-update/ Fri, 18 Sep 2026 13:22:00 +0000 The paste failed silently - no beep, no error, source still selected. The Register reports a fix has arrived for Excel 2016 only. https://devnews.news/tooling/ktor-3-6-0-http3-typed-auth/ https://devnews.news/tooling/ktor-3-6-0-http3-typed-auth/ Fri, 18 Sep 2026 10:45:56 +0000 OpenID Connect gets specialised support, routing and request handling get quality-of-life changes, and the Kotlin Multiplatform client gets better defaults. https://devnews.news/frameworks/rails-json-schema-cache-22x-faster/ https://devnews.news/frameworks/rails-json-schema-cache-22x-faster/ Fri, 18 Sep 2026 00:00:00 +0000 Point schema_cache_path at a .json file and Active Record stops paying the YAML cost at boot. A new herb:check task compiles every ERB template and fails the build. https://devnews.news/languages/jdk-28-six-jeps-targeted/ https://devnews.news/languages/jdk-28-six-jeps-targeted/ Thu, 17 Sep 2026 15:57:59 +0000 Build 16 is tagged. The targeted list now includes a Simple JSON API in incubator, generational Shenandoah by default, and the deprecation of the macOS/x64 port. https://devnews.news/languages/rust-maintainers-phished-through-fake-job-calls/ https://devnews.news/languages/rust-maintainers-phished-through-fake-job-calls/ Thu, 17 Sep 2026 00:00:00 +0000 The Rust project warns of an ongoing campaign against maintainers of popular crates. The target is the publish token, not the laptop. https://devnews.news/security/pgadmin-4-v9-18-four-cves/ https://devnews.news/security/pgadmin-4-v9-18-four-cves/ Thu, 17 Sep 2026 00:00:00 +0000 pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing. https://devnews.news/ai/openai-misalignment-reporting-framework/ https://devnews.news/ai/openai-misalignment-reporting-framework/ Wed, 16 Sep 2026 17:00:00 +0000 A process for tracking, investigating and disclosing model behaviour, plus six cases observed over the last six months.