During my work on Lux, I noticed an oddity in luarocks and launched a month-long investigation. luarocks.org had a critical RCE allowing anyone to gain root access to the site with a package upload. I will launch a blog post describing how the exploit works soon. luarocks.org/security-inc...
vhyrro
vhyrro
@vhyrro.neorg.org
A programmer. Can someone build me a hut in the woods pls. Lead dev of: - https://github.com/nvim-neorocks/rocks - https://github.com/nvim-neorg/neorg
66 followers10 following80 posts
If I had to teach the accumulated best practices of AI to a person from 2019 this is how I'd do it: vhyrro.neorg.org/posts/a-hitc...
vhyrro reposted
Progress update on Lux: You can now distribute your Lua projects as archives or standalone binaries. mrcjkb.dev/posts/2026-0...
Huge updates for Lux! The recently implemented 2FA will prevent a class of API key hijacking attacks present throughout programming today. vhyrro.neorg.org/posts/rocks-...
This was one fun side project to devise and create, opinions welcome! vhyrro.neorg.org/posts/calend...
I'm about to finalize sensible rate limiting for Luanox APIs to prevent spam or excessive server load. There are many great features coming up, including 2FA for tokens and full backwards compatibility with the luarocks.org APIs 🚀🚀
the Lux Lua bridge wiil soon get support for full type annotation generation. You'll soon be able to get hints from the lua language server when interacting with the Lux API :) github.com/lumen-oss/lu...
Moved my bsky account from bsky.social to vhyrro.neorg.org, it's nice that all you need is a DNS entry! I love it.
My Rust bindings for the fantastic Janet language are the first repo of mine to be hosted on tangled.org! tangled.org/vhyrro.neorg...
Lux now prevents privilege escalation and malicious Lua scripts from doing any damage to your host system. After thousands of changes and hours of debugging, say hello to sandboxing! 🚀🔥 opencollective.com/lumen-labs/u...
youtu.be/vZtL_Er4QpQ?... Here it is! Latest Neovim video 🔥
github.com/neovim/neovi... Dont mind me eagerly checking this PR daily hoping for some progress. The Neovim terminal could really do with some QoL for end users :)
vhyrro reposted
Thanks to generous donations from our OpenCollective supporters we've now moved Luanox to a dedicated domain (beta.luanox.org)! For reasons to support us be sure to check out beta.luanox.org/donate :D
vhyrro reposted
We received reports of a phishing campaign targeting crates.io users. Do not click on links asking to authenticate to protect your account. More information: blog.rust-lang.org/2025/09/12/c...
vhyrro reposted
With the growth of luarocks maybe we should start advocating for internationalization in larger Neovim plugins? I think it'd be quite amazing. You could throw a lua lib like github.com/kikito/i18n.... in your project and make a more accessible plugin than ever before 🎉
Starting work on native support in Lux for Luanox's API. It's so much more efficient than luarocks.org's, allowing you to do package search server-side, pull metadata about individual packages (instead of pulling a massive manifest file) and no weird stuttering or delays on the server. Excited!
Give the luanox site a quick test run over on our beta: luanox-beta.neorg.org 🚀 🚀
Huge win! Neovim now has a dedicated documentation page for plugin best practices 🎉 github.com/neovim/neovi...
Alright, the MVP package page is ready 🚀 I'm already done with the backend endpoints, which are much more convenient to use over luarocks.org, and they sure as hell don't encode the API key in the URL itself ☠️ I guess the next natural step is to create a "legacy" API which is luarocks-compatible
Amidst all the projects I'm working on I decided to dedicate some time to Luanox - a more modern alternative to luarocks.org We've had quite a few run-ins with the site misbehaving (as well as being slow) and so we're working on a sister site that will work in tandem with the main luarocks site :)