Technology Tales

Plotting in Julia with Makie

Makie.jl is a relatively new but rapidly growing data visualisation library for the Julia programming language, gaining a strong reputation within the Julia community for its versatility and active development. It operates through a system of interchangeable backends, namely CairoMakie for static plots, GLMakie for interactive and three-dimensional visualisations using OpenGL and WGLMakie for interactive web-based visualisations.

The library follows a structure built around three core objects, being the Figure, the Axis and the Plot, which can be created and modified individually to allow precise control over the appearance and layout of visualisations, including subplots, legends, axis labels and titles. Rather than relying on a grammar of graphics approach, Makie provides a set of ready-to-use plotting functions such as scatter, lines and density, with a syntax broadly comparable to that of Matplotlib in Python.

Plots can be saved in various formats, including PNG and SVG, the latter being a particular advantage of the CairoMakie backend. Beyond static visualisations, the library also supports animations and a wide range of further customisation options, with comprehensive documentation and dedicated coverage in the Julia Data Science book serving as useful learning references.

Welcome to DataFramesMeta.jl

The DataFramesMeta.jl package simplifies data manipulation in Julia by streamlining operations such as aggregation, column selection and transformation within the DataFrames.jl ecosystem. It introduces macros like @combine, @select and @transform to perform these tasks, with @select retaining only computed columns and @transform preserving original data alongside new ones.

By-row operations, indicated by the r prefix, automate broadcasting for element-wise computations, while the ! suffix enables in-place modifications to avoid duplicating large datasets. Examples demonstrate how to calculate aggregated values, apply mathematical transformations and efficiently manage data modifications, highlighting the package's utility in reducing complexity during data processing workflows.

Getting Started with Python in VS Code

Visual Studio Code's Python extension allows developers to write, run and debug Python code directly within the editor. Getting started requires installing Python 3, VS Code and the Python extension, after which users can set up a project-specific virtual environment to keep package dependencies isolated and avoid version conflicts.

A simple script can then be created, run via the built-in terminal or play button, and stepped through using the integrated debugger, which supports breakpoints, variable inspection and a debug console. Additional functionality can be added by installing third-party packages such as NumPy via pip or the package management interface, and dependencies can be tracked using a requirements.txt` file to ensure consistency across different environments. From this foundation, developers can extend their work into web frameworks such as Django, Flask and FastAPI, or explore further features including linting, formatting, testing and remote development.

Rob J Hyndman is a statistician and researcher whose blog, Hyndsight, covers topics spanning forecasting, time series analysis, anomaly detection, data science and statistical computing. His recent work includes updates to the forecast and fpp3 R packages, the development of Quarto templates for Monash University, and the addition of instructional videos to the third edition of his co-authored textbook, Forecasting: Principles and Practice. He has also explored methodological questions around forecast accuracy metrics, AIC calculations, prediction intervals and the Ljung-Box test, while writing a forthcoming textbook on anomaly detection. Beyond his own research, he has contributed to open data advocacy in Australia, organised forecasting workshops in cities including New York, Chicago and Canberra, and highlighted Python implementations of his statistical models and algorithms for those outside the R ecosystem.

The Invisible JavaScript Backdoor

Researchers have demonstrated how invisible and visually deceptive Unicode characters can be exploited to embed hidden backdoors in JavaScript code that are effectively undetectable during manual code reviews. By using a Unicode character known as HANGUL FILLER (U+3164), which is recognised by JavaScript as a valid identifier yet renders as completely invisible in most editors, an attacker can introduce additional variables and inject arbitrary operating system commands through what appears to be a routine network health check endpoint.

A separate but related technique, known as a homoglyph attack, involves substituting standard code characters with visually similar Unicode equivalents, such as replacing an exclamation mark with an ALVEOLAR CLICK character, which can silently alter the logic of conditional statements. Both approaches pose a particular risk in open-source projects, where contributions may come from anonymous or untrusted developers. Since non-ASCII characters are rarely necessary in most codebases, especially those using English as the primary development language, a practical defensive measure would be to disallow non-ASCII characters entirely, and some development tools have since introduced features to flag such characters when they are detected.

Trojan Codes

Researchers at the University of Cambridge have identified a class of security vulnerabilities, tracked as CVE-2021-42574, that exploit Unicode bidirectional control characters to manipulate how source code is visually presented to human reviewers without altering how compilers and interpreters process it. By embedding these control characters within comments and string literals, an adversary can make malicious logic appear harmless or invisible to anyone reading the code, while the underlying execution follows an entirely different path.

A related variant, tracked as CVE-2021-42694, achieves a similar effect through the use of homoglyphs, which are characters that appear visually identical or near-identical but are encoded differently, allowing an attacker to define subtly distinct functions that are difficult to distinguish by sight. Both attack patterns pose a particular risk within software supply chains, where compromised open-source code can propagate vulnerabilities into downstream projects. Recommended defences include compilers and interpreters raising errors for unterminated bidirectional control characters, formal language specifications prohibiting such characters in comments and string literals, and code editors surfacing these characters through visible warnings or symbols.

juliabloggers.com

This is Julia blog aggregator that is worth a look if you fancy seeing what is happening in the community. If you have a Julia-focussed blog, you can submit your own RSS feed. Being more of a generalist and not wanting to swamp others with irrelevant content, I am leaving my own efforts out of there.

Learn X in Y minutes is a community-driven reference resource offering quick introductory guides to a wide range of programming languages, frameworks, libraries, developer tools and computer science topics such as algorithms and data structures. The catalogue spans well-known languages including Python, JavaScript, Java, Rust and Ruby, alongside more niche or academic options such as APL, Coq, BQN and LOLCODE, with many guides available in multiple human languages including English, German, French, Portuguese, Chinese and others. Frameworks and libraries such as jQuery, OpenGL and PyQt are covered, as are practical tools including Git, Docker, Vim and Make.

Julia in VS Code

Julia for Visual Studio Code is a free, open-source integrated development environment designed for the Julia programming language, combining ease of use with strong performance to suit both beginners and experienced developers. The extension is officially supported within VS Code and aims to reduce the complexity of programming by providing a fully live environment. Installation guidance, configuration instructions and release notes are available within the documentation, which is currently undergoing revision. Users who encounter problems are encouraged to consult the FAQ before raising issues on the relevant GitHub repository or Julia Discourse forum, where support is provided by the development community.

Julia language: a concise tutorial

Created by Antonello Lobianco and supported by the French National Research Agency, this concise tutorial on the Julia programming language serves two purposes: to document the author's own learning of Julia and to provide an accessible entry point for those looking to start coding in the language without having to read through the full official documentation. Pitched somewhere between a traditional tutorial and a quick reference guide, it covers the core elements of the language including data types, control flow, functions, custom structures and error handling, as well as domain-specific topics addressed through a section on useful packages.

The material is aimed at those who already have some familiarity with programming in other languages, and has evolved over time into both a published book through Apress and a free online MOOC course covering scientific programming and machine learning with Julia. The tutorial maintains compatibility notes across multiple Julia versions dating back to 0.5, and is kept updated to reflect changes in key packages and the language itself.