GPT-5.5-Cyber builds a zlib fuzzing lab in a single day; someone translated the entire Rust compiler to C; GitHub's nine-month march to zero secret-scanning alerts

GitHub (FractalFir/crustc)

Someone Translated the Entire Rust Compiler to C

crustc transpiles rustc itself into roughly 46 million lines of C, buildable with plain GCC and make instead of LLVM — and it successfully compiles Rust's core, alloc, and std libraries. The engine behind it, cilly, is a custom Rust-to-C backend that probes a target C compiler's capabilities and generates code adapted to what it can actually handle, and even supports remote compilation over TCP. The practical motivation is bootstrapping: platforms like Plan 9 or obscure embedded targets that have a C compiler but no LLVM port have historically been locked out of Rust entirely, and a C-based rustc sidesteps that dependency completely. The project's creator is upfront that the output is rough and still has optimization gaps, and cilly itself isn't public yet — but as a proof that a 46-million-line compiler can be mechanically retargeted off LLVM's toolchain monopoly, it's a striking one-person feat that generated one of the day's largest Hacker News threads.

GitHub Blog

How GitHub Cleared 20,000 Secret-Scanning Alerts Down to Zero — in Nine Months

When GitHub Security first piloted its own secret-scanning tooling internally, it surfaced more than 20,000 alerts across 15,000+ repositories — a number that turned out to be almost entirely misleading. Five repositories accounted for roughly 18,000 of those alerts, every one an inactive test fixture or fake-but-valid-looking credential (GitHub builds secret scanning, so naturally its own test suites are full of decoy secrets). That left just over 2,000 alerts needing real triage, which GitHub worked through via a six-phase playbook: enforce scanning and push protection everywhere with no opt-outs, bulk-close proven noise, build validity checks to determine which credentials were still live, fix an underlying repository-ownership gap that made remediation impossible without knowing who to notify, hand-triage the long tail, and finally tie secret hygiene to its internal engineering-accountability program so it stayed fixed. The most transferable lesson isn't the tooling — GitHub has since productized the validity-checking and metadata work natively — it's the reframing: a scary alert count is almost never the real scope of the problem, and the actual bottleneck is organizational (who owns this credential, who can rotate it) rather than technical.

Geoffrey Litt

'Understand to Participate': The Cognitive-Debt Problem of Working With Coding Agents

Geoffrey Litt's framing, delivered as a talk at the AI Engineer World's Fair, cuts against the instinct to treat code comprehension as a verification chore AI lets you skip: understanding the code an agent produces is what lets you keep participating in shaping it. Skip that understanding to move faster in the short term, and you accumulate 'cognitive debt' — your mental model drifts from what the system actually does, until you can no longer meaningfully steer the next round of changes and are reduced to accepting or rejecting whatever the agent proposes. Litt's practical countermeasures are concrete: structured code explainers with built-in comprehension checks, AI-generated interactive micro-worlds for exploring unfamiliar code, and shared environments designed to keep a team's mental models of a system aligned with each other, not just with the agent. It's a sharper version of a worry surfacing across the industry as agents take on larger, more autonomous changes — echoed the same week at AIEWF by Anthropic's Mike Krieger, who described his own team as increasingly 'bottlenecked on reviews' and on 'human ability to fully conceptualize what we're doing.'

Matthew Garrett

Fifteen Years of Failed Attempts to Stop Token Theft

Matthew Garrett traces a fifteen-year graveyard of proposals to bind authentication tokens to the device or session that created them — Origin-Bound Certificates, Channel IDs, Token Binding (RFC 8471), and now Device-Bound Session Credentials — each technically capable of defeating the malware-exfiltration attacks that render multi-factor authentication moot once a token is stolen. None of them stuck. The common thread isn't technical failure but coordination failure: shipping a binding scheme requires broad browser buy-in and forces trade-offs no single vendor wants to own alone, so proven defenses keep getting proposed, prototyped, and quietly abandoned rather than deployed. It's a useful corrective to the assumption that security problems persist because no one's solved them — sometimes the solution has existed for over a decade, and the actual blocker is standardization politics.