The Nature weekly journal of science was first published in 1869. And after one and a half century, it has finally completed one cycle of carcinization, by publishing an article about the Rust programming language.

It’s a really good article.

What I liked about this article is that it didn’t just talk about performance, or even just memory safety - it also talked about correctness.

On September 8 2025, around 13:00 UTC, someone compromised Josh Junon’s npm account (qix) and started publishing backdoored versions of his package.

Someone noticed and let Josh know:

Josh confirmed he’d gotten pwned by a fake 2FA (two-factor authentication) reset e-mail:

The phishing e-mail came from npmsj.help (registered 3 days prior) and claimed users had to reset their 2FA:

Day, 10! Day, 10!

Okay, Day 10.

Again, the problem statement is very confusing - but what it all boils down to is this. We have a list of numbers:

16 10 15 5 1 11 7 19 6 12 4

To which we need to add 0 and whatever the maximum was, plus three:

16 10 15 5 1 11 7 19 6 12 4 0 22

From there on, if we take them in order, we’ll have gaps of 1 and gaps of 3:

The last article, Position-independent code, was a mess. But who could blame us? We looked at the world, and found it to be a chaotic and seemingly nonsensical place. So, in order to blend in, we had to let go of a little bit of sanity.

The time has come to reclaim it.

Short of faulty memory sticks, memory locations don’t magically turn from 0x0 into valid addresses. Someone is doing the turning, and we’re going to find out who, if it takes the rest of the series.

In my previous article, I said I needed to stop thinking of Rust generics as Java generics, because in Rust, generic types are erased.

Someone gently pointed out that they are also erased in Java, the difference was elsewhere. And so, let’s learn the difference together.

Java generics

I learned Java first (a long, long time ago), and their approach to generics made sense to me at the time.

It’s time for some personal and professional news!

TL;DR: I started a podcast with James, I’m stable on antidepressants, I’m giving a P99 CONF about my Rust/io_uring/HTTP work, I’m trying on “they/them” as pronouns, I’m open-sourcing merde_json, rubicon and others, I got a divorce in 2023, I found a new business model.

Now that we’re on the same page: let’s unpack this a bit!

We’ve achieved our goals already with this series: we have a web service written in Rust, built into a Docker image with nix, with a nice dev shell, that we can deploy to fly.io.

But there’s always room for improvement, and so I wanted to talk about a few things we didn’t bother doing in the previous chapters.

Making clash-geoip available in the dev shell

A little less than two months after the previous release, I’m happy to announce that the ooc compiler rock 0.9.8, codename columbia is now out.

The impatients can readily skip to the release notes, but for those who prefer a narrative, let me tell you why I’m excited about this release.

String interpolation

We’ve thrown around this idea a lot since the early versions of rock since we have a few rubyists in our ranks, but only recently Alexandros Naskos took matters into his own hands and just implemented the fuck out of it.

Welcome back to the “Making our own executable packer” series, where digressions are our bread and butter.

Last time, we implemented indirect functions in a no-libc C program. Of course, we got lost on the way and accidentally implemented a couple of useful elk-powered GDB functions - with only the minimal required amount of Python code.

The article got pretty long, and we could use a nice distraction. And I have just the thing! A little while ago, a member of the Rust compiler team stumbled upon this series and gave me some feedback.

I started working on the itch.io desktop app over 4 years ago.

It has arguably been my main project ever since, along with companion projects like butler, capsule and many smaller libraries.

I’m fuzzy on the initial history, but I remember the codebase went through a lot of changes. As early as 2014, the whole codebase was ported from vanilla JavaScript to TypeScript. In 2016, I released a timeline of all the changes. In 2018, I released a postmortem for v25 (which I then deleted).