How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

These used to be super important in early oceanic navigation. It is easier to maintain a constant bearing throughout the voyage. So that's the plan sailors would try to stick close to. These led to let loxodromic curves or rhumb lines.

https://en.m.wikipedia.org/wiki/Rhumb_line

Mercator maps made it easier to compute what that bearing ought to be.

https://en.m.wikipedia.org/wiki/Mercator_projection

This configuration is a mathematical gift that keeps giving. Look at it side on in a polar projection you get a logarithmic spiral. Look at it side on you get a wave packet. It's mathematics is so interesting that Erdos had to have a go at it [0]

On a meta note, today seems spherical geometry day on HN.

https://news.ycombinator.com/item?id=44956297

https://news.ycombinator.com/item?id=44939456

https://news.ycombinator.com/item?id=44938622

[0] Spiraling the Earth with C. G. J. Jacobi. Paul Erdös

https://pubs.aip.org/aapt/ajp/article-abstract/68/10/888/105...

taco_emoji · 10m ago

Don't forget this post, which spawned a discussion of Rhumb lines etc. in the comments: https://news.ycombinator.com/item?id=44962767

jacobolus · 4h ago

You inspired me to submit one of my 2022 projects

https://observablehq.com/@jrus/spheredisksample

https://news.ycombinator.com/item?id=44963521

to fit the trend of the day. People may also enjoy

https://observablehq.com/@jrus/sphere-resample

srean · 4h ago

Great to see you. I look forward for your comments on geometry, multivariate calculus and rotations.

Edit: fantastic graphics. You should submit the other one as an HN post too.

sfink · 5h ago

Awesome visualizations.

The part that I was expecting to see but didn't: how can you move at a constant speed? For the original purpose of positioning objects along a path, it doesn't matter. But when moving, you can see it's moving much more slowly at the beginning and end (mostly determined by the radius). What if I want it to travel at a constant rate? Or even apply an easing function to the speed?

I'm sure there's some fancy mathematical trick that would just do it. If I were only more comfortable with math... my handwavy sketch would be to compute the speed function by differentiating the formulas to get dx, dy, and dz and passing them through the Pythagorean equation, then reparameterize on a t' variable using the inverse of the speed function? Maybe? I feel like I'm speaking using words I don't understand.

Sharlin · 5h ago

For constant speed you need a so-called “Euclidean parameterization” where the t value is proportional to s, the Euclidean distance traveled (and thus no matter the value of t, if you add some dt it always works out to the same ds). This is super commonly needed when animating motion along all sorts of curves, as you might guess.

Unfortunately, there’s usually no closed-form solution for it, so we have to do it numerically. And for doing that there’s in general no better way than at each t, binary/interpolation search a dt that roughly corresponds to the ds that you want (start with the previous dt, it’s likely a very good approximation).

In practice, you’d do that once and store the results, basically approximating the curve as a polyline of evenly-spaced points– at least assuming that the curve itself isn’t changing over time!

Kennnan · 4h ago

This pattern of stepping with different ds along a path has a lot of applications in control theory. Often we change the ds/dt ratio based on the known acceleration profile of a motor to minimize jerk and reach our destination as fast as possible.

Generally this idea is called motion profiling: https://www.motioncontroltips.com/what-is-a-motion-profile/

meindnoch · 2h ago

>I'm sure there's some fancy mathematical trick that would just do it. If I were only more comfortable with math... my handwavy sketch would be to compute the speed function by differentiating the formulas to get dx, dy, and dz and passing them through the Pythagorean equation, then reparameterize on a t' variable using the inverse of the speed function? Maybe? I feel like I'm speaking using words I don't understand.

What you're looking for is called arc length parameterization. Basically, you need to compose the curve with the inverse of its arc length function. Aside from a few special curve families, closed-form solutions don't exist.

chaboud · 4h ago

The instinct to sort of slow t is right, as the governing functions are maintaining angular velocity with respect to t but scaling radius also with respect to t.

It’s sort of like an Archimedean spiral. So, yeah, if you parameterize velocity and make that constant, you’re in better shape. Note that the radius starts at zero, though, so something is going to have to deal with limits.

A simpler path following approximation (e.g., for a game) might be to just give an iterative system path and tangent targets with respect to Z and then provide an iterative constraint on velocity with some sort of basic tweening (e.g., new = a * old + (1 - a) * target). Then just drag the thing along Z, like bead toys for toddlers.

erikerikson · 5h ago

Thanks. My useful feedback is that navigation violated my expectations. I was in mobile FWIW. I didn't know what to do so I started to scroll. My touch to the screen kicked into the next pane so I'm like "oh, okay". I happened to touch the right side so I thought that advanced it and so when I later clicked an extra time unintentionally, I tried to click the left side to go back (note that people who read right to left it top to bottom may have different intuitions [or be used to an insensitive web]). Unfortunately that just skipped another screen so that I missed two in a row. Not fatal because I kept going but disappointing and micro-sad. I think some subtle guidance could have removed the ambiguity and helped me focus and engage better.

ghostly_s · 5h ago

There are instructions on the first slide. I think adding a secondary swipe mechanic would be nice tho (although I prefer the tap), as that's how these "card stack" interfaces are usually navigated in social media apps.

erikerikson · 4h ago

Oh, you're right. Small and at the bottom. I guess I tried to scroll before my eyes got there. Thanks for pointing out my error.

addaon · 58m ago

> …which we know isn't actually chaotic. It's just a path defined by mathematical functions.

I don't know what function is being presented, so I can't speak to whether it demonstrates chaotic behavior -- but the whole /point/ of chaos is that it's an emergent property of deterministic mathematical functions. Perhaps the author meant "random" or "non-deterministic" rather than "chaotic"?

latexr · 3m ago

> the whole /point/ of chaos is that it's an emergent property of deterministic mathematical functions.

I believe you. But the colloquial definition (I’m looking at a dictionary right now) is “complete disorder and confusion”; “a state of things in which chance is supreme”; “the inherent unpredictability in the behavior of a complex natural system”. That path fits that apparent definition. The post is written in a way that a relative layman would understand, so it makes sense to speak/write in a way non-mathematicians would expect.

skalidindi3 · 17m ago

^^^ This is an extremely underrated nitpick.

I am guessing that the HN audience would be / should be interested in that distinction. Mathematically speaking, chaos is an extreme sensitivity to initial conditions, and is very much still in line with deterministic systems. The resulting output, while seemingly random (since there is no easily identifiable pattern), is mathematically and conceptually different from actual randomness.

coreyp_1 · 1h ago

The content is good, but the weird dither effect is giving me a horrible headache! I'm glad you created it (it's always good to see someone bring an idea to fruition!), and I hope that you continue to create cool things. But please, please, please turn off whatever effect you're using.

grimgrin · 5m ago

the dithering is lovely and the OP better not touch it. they can give you a toggle though :P

RugnirViking · 6h ago

It's a pretty basic primer to the subject, but good for kids learning maths. Could do with some callbacks to maths concepts like the circle equation ( x = r cos (t) and y = r sin (t) ).

Possible topics to branch further into would be polar coordinates and linear algebra basics (vectors, transformations, transformations in 3d space). If you the author aren't sure of such topics, I would recommend 3blue1brown yt videos on the matter

Possibly better for that than for programmers (given it doesn't include code or libraries used or anything about actually manipulating 3d objects like vertices, stretching and morphing to achieve the effect shown etc)

pimlottc · 6h ago

I was wondering about the “correctness” of the z-axis movement for the spherical helix. You could pick lots of different functions, including simple linear motion (z = c * t). This would obviously affect the thickness and consistency of the “peels”.

The equation used creates a visually appealing result but I’m wondering what a good goal would be in terms of consistency in the distance between the spirals, or evenness in area divided, or something like that.

How was this particular function selected? Was it derived in some way or simply hand-selected to look pleasing?

crdrost · 5h ago

I think this particular function was selected because it happened to be convenient to program and the visual effect was pleasant enough.

The actual "correct" thing to do would probably be to have the point maintain constant speed in 3D space like a real boat sailing on a globe, right? But that's a rather bigger lift:

    const degrees = Math.PI / 180;
    const bearing = 5 * degrees; // or it might be 85 degrees? Not sure off the top of my head
    const k = Math.tan(bearing);
    const v = 0.001 // some velocity, adjust as needed
    const phi = (t) => v*t/Math.sqrt(1 + k*k) // the sqrt is not strictly needed
    const theta = (t) => k*Math.ln(Math.tan(phi(t)/2)) // this is the annoying one haha

with outputs,

    const x = (t) => Math.sin(phi(t)) * Math.cos(theta(t))
    const y = (t) => Math.sin(phi(t)) * Math.sin(theta(t))
    const z = (t) => Math.cos(phi(t))

I doubt that they did the ln(tan(phi/2)) thing though, but it's what you get when you integrate the k d{phi} = sin{phi} d{theta} equation that you have here.

patrickthebold · 2h ago

Just a thought: Make the velocity of the path constant. There should be some way to take a derivative an set it to a constant and solve for z. ( or really reparameterize the curve t' = f(t)) so the velocity is constant.

Actually, now that I think about it, choosing z = c * t is kind of both influencing how the path is parameterized as well as the path carved out on the sphere.

rashidae · 27m ago

Wow! You did something amazing! The first few interactions, I felt as if I was actually spinning a wheel. Great job, bravo!

fsckboy · 57m ago

when it gets past the "intro" slides and into the A-B-C explanation, slide 11 says "A helix is a shape that loops around and around, like a spring." Unfortunately, what is shown is not a helix nor a normal spring, it's just yet another spherical helix progression.

also, the progress dots at the bottom should be toc nav buttons, single stepping backward to find the slide above was torture.

and the derivation of a circle from two sines and a sphere from three, to me should really be separated out as a "pre req" presentation. this thought goes along with the above "hey, where's my helix" thought

reeece · 3h ago

The animations are so fluid!

I very recently was looking to generate some complex shapes, and stumbled onto the complex problem of "disperse N points on sphere" and all its nuances.

There was a really cool / simple algorithm that was mentioned called the fibonacci-sphere that also generates a spiral around a sphere, but for the point dispersal. Here's a paper [1] on it that talks more about it.

[1] - https://arxiv.org/pdf/0912.4540

mayoff · 2h ago

You can play with the equations on 3D Desmos here: https://www.desmos.com/3d/t66etxi1y8

Interesting to note that the parametric equations of the spiral are linear in spherical coordinates. https://en.wikipedia.org/wiki/List_of_common_coordinate_tran...

pavel_lishin · 2h ago

I've recently gotten interested in p5js, which is a fun and easy way to explore this kind of stuff; if anyone here is currently thinking (like I am) that you want to try this out yourself, I'd give it a try: https://p5js.org/tutorials/setting-up-your-environment/

hailpixel · 5h ago

I LOVE when people geek out about the most simple mathematical things*, especially discovering the animation power of the trigonometric functions... or any of mathematics underlying modern interactive stuff. It's one thing to know what they do, it's another to understand the power of that tool.

* I wrote a similar article around making "blobs" a while back: https://www.hailpixel.com/articles/generative-art-simple-mat...

Duanemclemore · 6h ago

This is excellent. I'm always looking for good things to show my students on coordinate systems and geometry, and this joins the list. Thank you for diving down the rabbit hole and bringing this back for everyone.

If you want really great further consideration of creating geometric figures with parametric equations, Joseph Choma's book "Morphing" is an all-timer.

https://www.quercusbooks.co.uk/titles/joseph-choma/morphing/...

willdelorm · 2h ago

I am about to start my computer science degree, so this visualization got me really excited to dive into the mathematics of it all. I love to see these kind of animations, but the math behind them sends my brain spinning! Very cool to see it broken down in a digestible way like this.

danans · 6h ago

Nifty, but what I'm curious about is how you created the drain/fill effect on the cube.

latexr · 5h ago

> If you like this, please consider following me on Twitter and sharing this with your friends.

I do like this and will share with a couple of friends. But I no longer have a Twitter account and will definitely not rejoin. Would you consider adding an RSS or JSON feed to your website? Or make a Mastodon account, those provide RSS feeds by default.

netdur · 2h ago

Man, that whole ‘please make an RSS or JSON feed for me’ request reads like Richard Stallman emailing himself a webpage to print out later, let them use Twitter or whatever medium they wants

pavel_lishin · 51m ago

But it's not "for me", it's for everyone who'd be interested in getting regular updates from OP.

Twitter is the absolute worst way to get that, even if I had an account.

alias_neo · 2h ago

Really nice visualisation.

Does anyone know of any tooling I could use to do some plotting like this in 3D space even a fraction as nice looking as OPs? I'm not a web dev but I am a dev, but would prefer something high enough level that I can focus on the "what" (to plot) rather than the "how".

tantalor · 5h ago

> Together, these functions create a spherical helix... That's all!

This strikes me as backwards reasoning.

You are showing "these functions" -> spherical helix

But I actually want spherical helix -> "these functions"

1. What if I want to make some other shape? I'm lost.

2. I have learned nothing about the spherical helix.

dgrin91 · 5h ago

Very cool & pretty, but I feel a little let down. There is a huge leap from the basics of 3d plotting & spheres to the crazy pattern you tease and then show at the end. I understand it as someone who kind of knows this stuff already, but I think its way too big of a leap for someone who doesn't have the background.

zamadatix · 4h ago

I think the crazy plot at the end is not intentionally constructed to be exactly that way, just an example of what you can get if you vary the parameters of cosines and sines in parametric equation setups similar to the ones shown earlier (instead of seeking to align them so they wrap a sphere exactly).

fluoridation · 6h ago

For me personally it's simpler to think about it as having an f(theta, r) = r (cos(thetha), sin(theta)), interpreting theta as a compass direction and r as a distance to walk along a great circle. So g(t) = polar_to_R3(f(t k, t l)). Changing the relative sizes of k and l changes the tightness of the helix.

gabeyaw · 3h ago

This reminds me of how the spins in MRI are manipulated in order to acquire the signal. Tracking the tips of the spins traces out similar looking paths. https://m.youtube.com/watch?v=vapJRr6gAds&t=2786s

mostlyk · 6h ago

This is super nice to view, could you share how you made it? I want to make something similar for Rotation Matrices

qwertytyyuu · 6h ago

I think 3blue1brown might have an animation library, the same one he uses in his videos that might help with that

megaloblasto · 6h ago

He created a visualization library called Manim and it's great.

jhaile · 4h ago

I was also hoping to see more about how the animations were done here. They look great. I love the shifting camera perspectives.

dcanelhas · 3h ago

https://www.johndcook.com/blog/2023/08/12/fibonacci-lattice/

If you want a spiral that covers the sphere with evenly spaced samples, consider this approach.

gowld · 2h ago

And the Matt Parker Stand-up Maths video: "Golf balls: How many holes in one?" https://www.youtube.com/watch?v=dNTnk1VFoJY

thefringthing · 2h ago

Grammar problem: "In 3D space, we position objects by setting its coordinates" should read either "their coordinates" or "an object".

mustaphah · 4h ago

I can't tell why, but I'm getting terrible performance on Linux/Brave. The CPU spikes immediately on visit. I'm on a powerful machine (32 GiB RAM, Intel i9 w/ 24 cores).

jeffbee · 4h ago

> I can't tell why

Let's find out where this sentence goes!

> Linux

Would look into that.

> Brave.

Definitely would look into that.

> 32 GiB RAM, Intel i9 w/ 24 cores

This part is not relevant

mustaphah · 3h ago

You're just jealous of my 32 GiB.

jeffbee · 3h ago

Crying in Mac mini voice

fragmede · 3h ago

How is that not relevant?

jeffbee · 3h ago

Because any non-broken combination of browser and software platform can run this on any PC made this century. It runs fine on my terrible Atom Chromebook, even.

1970-01-01 · 6h ago

That is beautiful animation. This is a great example of a visual lesson that leaves a chalkboard in the dust (ha).

BlitzCloud · 1h ago

This is awesome, it was easier to understand that what my uny theacher tried to explain.

aacid · 5h ago

Really love this project, I only have small little UX nitpick: as lefthanded person it is quite cumbersome to tap right side of screen. Go to solution is to navigate using swiping which is ambidexterous.

ghostly_s · 4h ago

As a left-handed person I have no problem holding the phone in my right hand when I need to use UI on that side of the screen. Though I do prefer phones on the small side.

meken · 4h ago

This is why I love small phones - I’m able to reach and tap with left thumb quite easily on my iPhone SE.

MarcelOlsz · 3h ago

Wish the bundle.js wasn't minified so I can look at the code and see what's going on!

lucho_mzmz · 4h ago

Cool! My first instinct was to scroll. I suggest you treat the scroll down as a signal to move 1 slide further

lucho_mzmz · 4h ago

Cool! My first instinct was to scroll. I suggest you use the scroll down as a signal to move 1 slide further

ShahoG · 4h ago

This was amazing! I also checked the understanding neural network. Looking forward to the next part in that one. Keep up the good work!

maxbaines · 6h ago

Best thing I have seen on HN in ages. Also interesting for a CNC geek.

ejp · 5h ago

I had a similar thought about 3D printing - particularly extruding mathematically defined shapes in vase mode.

In both of these cases, mathematically generating the points to visit (in gcode) is needed, and we don't care about constant speed - the firmware handles the instruction->motion part.

I am thinking about non-planar printing mostly, but this could also apply to CNC finishing passes.

NooZ · 2h ago

I never tought this would be interesting but it is VERY much.

stephenlf · 4h ago

I love the slight aliasing on the visuals (iOS Safari). It makes it obvious that it’s rendered on the fly.

fleebee · 6h ago

I love this. It's pretty and really easy to digest.

ramathornn · 3h ago

This is so cool! Thanks for sharing, stuff like this is why I love HN.

mystraline · 5h ago

When I first opened it, its basically a bunch of static pages that made absolutely no sense. My first question was 'why is this garbage being #1 on HN?'

Then I realized that, unlike the early web with banners of "best viewed in Netscape navigator", this was an unstated "best viewed in google chrome".

Alas. At least please check and validate if the site works in Firefox, or notify appropriately. Because this demonstrably does not.

alias_neo · 2h ago

Worked perfectly for me on Firefox 142.0 on Arch Linux.

rocmcd · 5h ago

I use Firefox (dev edition, v142.0b9) and it works great.

madhato · 4h ago

Worked fine for me using Firefox 142 on Linux. Did you have any errors in the console?

hotsalad · 3h ago

For me, it doesn't work entirely in Librewolf 142 (shows the text, and some tags moving around an otherwise black screen), but does work in Firefox Nightly.

sssilver · 5h ago

Works great on mobile Safari

wpm · 5h ago

Worked fine for me on desktop Safari.

Doc-Bok · 5h ago

It works for me in Firefox.

wigster · 5h ago

works on firefox macos

toss1 · 5h ago

Worked fine here on Firefox/Win11.

taherchhabra · 3h ago

so beautiful. thank you for this. I am trying to develop intuition for sine cosine etc. and it did fire some neurons in my brain not sure i can put that into words

chamomeal · 6h ago

Really nice animations! This is the type of thing that was really hard for me to grasp in school. This lays it out so plainly.

jtbayly · 4h ago

I believe there is a typo here:

y = 10 * sin(πt/2) * sin(0.02 * πt)

On the previous two slides the end is sin(0.2 * πt)

Gud · 1h ago

Love it

SKILNER · 5h ago

That's an excellent job of teaching - thank you!

meken · 4h ago

This was delightful - thank you!

nedsma · 4h ago

Brilliant, I learned something today.

markusw · 5h ago

Beautifully done, thank you for sharing. :-)

dwayne_dibley · 4h ago

Well this is lovely. Well done.

thopkinson · 4h ago

This is fantastic. What a terrific combination of the creative presentation and the clear exposition of information. You've hit on a very nice aesthetic and a stunningly clear articulation of the underlying mechanics.

ezconnect · 5h ago

The solar system spiraling through the universe.

Tyr42 · 6h ago

Okay, I have some followup questions. Are the points equally spaced? I.e. the cube's |∆p| is constant? I see you scale z by the sin. What happens of you don't?

zamadatix · 3h ago

Without scaling the rate of change of the given curve would not be constant.

scotty79 · 5h ago

I was expecting linear progression on z and some nasty square root for amplitude of x,y. It's cool that he basically just used another parametric circle drawn on coordinates z and amplitude of x,y oscillations.

exasperaited · 6h ago

This is very cool, but somewhat confusing to the eye, because you are actually demonstrating the movement of a point along a path, while visualising it with a cube whose orientation doesn't change when it feels like it should.

The point that is moving is in the centre of the cube. But the cube's orientation is fixed in global space.

So the cube's orientation relative to the path of the spiral/helix is not quite the same as its orientation relative to the path of the straight line.

Your mission, should you choose to accept it ;-)

https://en.wikipedia.org/wiki/Frenet–Serret_formulas

metalman · 3h ago

it's impressive enough to crash my browser (twise) before I got to see it the full digital resource conflict jam and judder!

adammarples · 3h ago

Very distracting to try and read text in the middle of a constantly spinning visualisation

nikolayasdf123 · 6h ago

quite beautiful

GPT-5 (openai.com)

Fight Chat Control (fightchatcontrol.eu)

GitHub is no longer independent at Microsoft after CEO resignation (theverge.com)

I tried every todo app and ended up with a .txt file (al3rez.com)

Claude Sonnet 4 now supports 1M tokens of context (anthropic.com)

I want everything local – Building my offline AI workspace (instavm.io)

Ultrathin business card runs a fluid simulation (github.com)

Streaming services are driving viewers back to piracy (theguardian.com)

Wikipedia loses challenge against Online Safety Act (bbc.com)

Anna's Archive: An Update from the Team (annas-archive.org)

FFmpeg 8.0 adds Whisper support (code.ffmpeg.org)

Emailing a one-time code is worse than passwords (blog.danielh.cc)

Debian 13 “Trixie” (debian.org)

Steve Wozniak: Life to me was never about accomplishment, but about happiness (yro.slashdot.org)

Good system design (seangoedecke.com)

Vibechart (vibechart.net)

Why LLMs can't really build software (zed.dev)

VC-backed company just killed my EU trademark for a small OSS project

Claude Code is all you need (dwyer.co.za)

Gemma 3 270M: Compact model for hyper-efficient AI (developers.googleblog.com)

Nginx introduces native support for ACME protocol (blog.nginx.org)

Show HN: The current sky at your approximate location, as a CSS gradient (sky.dlazaro.ca)

Claude says “You're absolutely right!” about everything (github.com)

AGENTS.md – Open format for guiding coding agents (agents.md)

PYX: The next step in Python packaging (astral.sh)

Copilot broke audit logs, but Microsoft won't tell customers (pistachioapp.com)

Open hardware desktop 3D printing is dead? (josefprusa.com)

How I code with AI on a budget/free (wuu73.org)

Show HN: Building a web search engine from scratch with 3B neural embeddings (blog.wilsonl.in)

Obsidian Bases (help.obsidian.md)

Show HN: I built an app to block Shorts and Reels (scrollguard.app)

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

Try and (ygdp.yale.edu)

This website is for humans (localghost.dev)

I accidentally became PureGym’s unofficial Apple Wallet developer (drobinin.com)

GPT-5: Key characteristics, pricing and system card (simonwillison.net)

Wikimedia Foundation Challenges UK Online Safety Act Regulations (wikimediafoundation.org)

Web apps in a single, portable, self-updating, vanilla HTML file (hyperclay.com)

OpenFreeMap survived 100k requests per second (blog.hyperknot.com)

Jim Lovell, Apollo 13 commander, has died (nasa.gov)

Search all text in New York City (alltext.nyc)

Lazy-brush – smooth drawing with mouse or finger (lazybrush.dulnan.net)

OpenMower – An open source lawn mower (github.com)

Ask HN: How can ChatGPT serve 700M users when I can't run one GPT-4 locally?

What's the strongest AI model you can train on a laptop in five minutes? (seangoedecke.com)

Show HN: Whispering – Open-source, local-first dictation you can trust (github.com)

The future of large files in Git is Git (tylercipriani.com)

Historical Tech Tree (historicaltechtree.com)

Why are there so many rationalist cults? (asteriskmag.com)

Meta Leaks Part 1: Israel and Meta (archive.org)

Show HN: I was curious about spherical helix, ended up making this visualization

Comments (95)