0:00 After six years and three hundred and sixty separate patches, the Linux kernel has finally, officially, eliminated the strncpy function.0:09 This is a story about the slow, deliberate, and almost heroic work of paying down technical debt at a planetary scale.0:17 Last week, we talked about Norway making a single, sweeping decision to ban generative AI in schools.0:24 Today we're looking at the opposite: the years-long grind it takes to undo one bad decision made decades ago, and why it's one of the most important things happening in software.0:36 Let's sweep the rest of the day's big conversations on Hacker News.0:41 The other massive infrastructure story is about a beginning, not an end.0:46 Google announced it now sees fifty percent of its traffic coming over IPv6.0:51 That’s the next-generation internet protocol that’s been slowly, sloooowly replacing the original one for about twenty-five years.1:00 We're going to come back to both of these, because they're two sides of the same very important coin.1:06 Then there's the flip side of infrastructure: when it goes wrong.1:11 Hackers in Brazil managed to gain access to an emergency alert system and sent a bogus warning to cell phones across the entire country.1:20 The message itself was apparently nonsensical, but the event is a brutal reminder that the systems designed to keep us safe can be turned into tools of chaos.1:31 It's not just about protecting data anymore; it's about protecting the very channels of public trust.1:38 Meanwhile, a seven-year-old article titled "Developers don't understand CORS" is one of the top items today.1:45 CORS, or Cross-Origin Resource Sharing, is a fundamental security mechanism for the web.1:51 And the fact that an article from 2019 explaining it is still resonating so strongly… well, it tells you everything you need to know.2:00 Some problems aren't glamorous.2:03 They aren't solved by a new framework.2:05 They're just hard, persistent, and a constant source of pain for the people building the web.2:12 It’s the digital equivalent of realizing nobody on your team actually knows how plumbing works, right as the basement starts to flood.2:21 On the AI front, Anthropic dropped a research update on "Project Fetch: Phase Two." They're working on what they call reliable agentic AI systems.2:31 The goal is to build AI agents that can use tools—like web browsers or APIs—in a dependable way.2:37 It's less about the "what can it think" and more about the "what can it do" reliably, without going off the rails.2:45 Martin Fowler's site also has a great piece on this same topic, which suggests the whole industry is moving from the magic-show phase of AI into the engineering phase.2:57 How do we make this stuff predictable, testable, and safe?3:00 And then you get the pure, uncut Hacker News stuff.3:04 Somebody wrote a complete 3D voxel game engine—think Minecraft-style blocks—in APL.3:10 For the uninitiated, APL is a programming language famous for using a bizarre set of Greek letters and mathematical symbols.3:18 It looks like alien hieroglyphs.3:20 Building a game engine in it is… an act of profound, beautiful madness.3:25 It's a testament to the fact that sometimes, the point isn't to be practical.3:30 The point is to see if it can be done.3:33 In that same spirit, we've got deep dives on using AVX-512 instructions for Zigzag decoding, a guide to building your own 4-bit CPU from scratch, and a trending Wikipedia article on PID controllers—the foundational algorithm for everything from your car's cruise control to industrial chemical plants.3:54 It’s a good reminder that for every new shiny thing, there's a community of people obsessed with mastering the fundamentals, pushing performance at the lowest level, and just… building weird stuff for the joy of it.4:08 So let's go back.4:10 Let’s talk about infrastructure.4:12 Because the two biggest stories today—getting rid of one bad function in Linux and hitting a milestone for one new protocol at Google—are about the same thing: the plumbing of the digital world.4:25 And they show us the two ways progress actually happens.4:29 First, strncpy.4:30 The C programming language, which underpins Linux, Windows, macOS, everything… has a dark secret.4:37 It makes it very, very easy to make mistakes with memory.4:40 Specifically, with buffers—chunks of memory you set aside to hold data.4:45 A "buffer overflow" is when you try to put ten pounds of data in a five-pound bag.4:51 The data spills out and overwrites adjacent memory, which can cause your program to crash, or worse, create a security hole an attacker can exploit.5:01 This isn't a theoretical problem.5:03 It was THE vector for hacks for decades.5:06 The strncpy function was supposed to be a "safe" version of its predecessor, strcpy.5:12 It let you specify the maximum number of bytes to copy.5:16 The problem?5:16 It had its own subtle, disastrous flaws.5:19 It might not null-terminate the string, leaving you with a ticking time bomb.5:24 It was just… a bad tool.5:26 A trap waiting for even experienced developers to fall into.5:30 So, for six years, Linux kernel developers have been on a mission.5:35 Not to invent something new, but to painstakingly remove every single use of strncpy from millions of lines of code and replace it with better, safer alternatives.5:46 Three hundred and sixty patches.5:48 That’s an average of one patch a week, for six years.5:52 Where have we seen this before?5:54 This is the digital equivalent of replacing all the lead pipes in a city.5:59 It's unglamorous.6:00 It's expensive.6:01 Nobody gets a promotion for doing it.6:03 When it's done, the water that comes out of the tap looks exactly the same.6:09 But it's no longer poisoning you.6:11 This is maintenance as an act of progress.6:14 It's recognizing a foundational mistake and committing to the long, thankless, but absolutely vital work of fixing it everywhere.6:23 It's a pattern of subtraction, not addition.6:26 And in a world obsessed with the next big thing, this quiet, determined act of removal is one of the most significant victories for software security in years.6:36 Now, let's look at the other side: Google hitting fifty percent IPv6 adoption.6:42 If strncpy is about fixing a mistake, IPv6 is about dealing with the consequences of a massive success.6:49 The original internet protocol, IPv4, gives us about four point three billion addresses.6:55 In the 1980s, that seemed like an infinite number.6:58 Whoops.6:59 We ran out.7:00 For years, the internet has been held together with hacks and workarounds—a technique called NAT, Network Address Translation, is the main one—to share those scarce addresses.7:12 IPv6 is the solution.7:13 It provides… well, for all practical purposes, an infinite number of addresses.7:18 The number is so large it's meaningless to say out loud.7:22 It's enough to give every single atom on the surface of the Earth its own IP address, and still have trillions of trillions left over.7:31 So why has it taken twenty-five years to get here?7:35 Because of the pattern it follows.7:37 This isn't like replacing lead pipes, where the old thing is just bad.7:42 IPv4, with all its workarounds, is "good enough" for most people.7:46 Changing the core protocol of the internet is like trying to change the engines on a 747 while it's in mid-flight with four billion passengers on board.7:57 You can't just switch it off for the weekend.8:00 Every router, every server, every phone, every piece of software has to support the new thing while still supporting the old thing.8:09 This is the S-curve of adoption.8:11 For decades, IPv6 was a niche thing for academics and network engineers.8:16 It was flat.8:17 Maybe one percent adoption, then two percent.8:20 But now, with major players like Google pushing it, and with mobile networks making it the default, we're hitting the steep part of the curve.8:30 Fifty percent at Google is a tipping point.8:33 It means we've moved from "if" to "when." It means the momentum is now unstoppable.8:38 The analogy breaks down a bit because unlike a software update you're forced to take, this migration has been entirely voluntary, which makes its success even more remarkable.8:50 It's a global coordination effort achieved without a central commander.8:55 So what does it all add up to?8:57 What connects the slow removal of a dangerous function with the slow adoption of a necessary protocol?9:04 It’s that the most important work in technology is often the least visible.9:09 It's not the flashy user interface or the clever new algorithm.9:14 It's the plumbing.9:15 It's the foundation.9:16 This week wasn't about a revolutionary new product that will change your life tomorrow.9:22 It was about the quiet, collective effort of thousands of engineers making the systems we all depend on just a little bit safer, a little bit more robust, and a little bit more ready for the future.9:36 One is an act of careful repair, the other an act of monumental construction.9:41 Both are happening too slowly for most people to notice, but they are the bedrock on which everything else is built.9:49 And that's the real story.9:51 Progress isn't always a launch event.9:53 Sometimes, it's just a patch number ticking up, or a percentage point crossing a threshold.9:59 It’s the slow, steady, and relentless work of getting the foundation right.
