📌 Today’s Picks
🟥 Baekjoon Online Judge shuts down — After 16 years, BOJ officially closes on April 28, 2026, with a farewell contest on the 26th.
🛡️ Vercel security incident disclosed — Internal systems breached via a hijacked third-party AI tool OAuth app; some environment variables may have been exposed.
⚙️ Zig 0.16.0 released — I/O promoted to an interface. Injected like Allocator — a major design shift.
💸 DigitalOcean → Hetzner migration — From $1,432/mo to $233/mo. A real-world cutover recipe using mydumper and binlog.
📧 Notion editor emails leaking — Scraping public pages exposes every editor’s email address.
🌳 SkipTree — Antithesis adapts skip lists to optimize BigQuery point lookups.
🟥 1. Baekjoon Online Judge shuts down on April 28, 2026
Baekjoon Online Judge (BOJ), Korea’s largest algorithm problem-solving platform since March 2010, is ending its 16-year run on April 28, 2026.
Operator Startlink (a one-person shop) said in the official notice that "circumstances have forced us to shut down."
When the service closes, all data except problems, submission records, and contest information will be deleted. Problem-set and group creation features will be disabled in advance.
A farewell contest, ‘Good Bye, BOJ!’, will run for four hours starting 6 PM on April 26.
The notice leaves the door open: "Rather than disappearing entirely, we’re thinking about returning in a form where at least the problems are still browseable." But no official reopen date yet.
Why it matters
If you’re a Korean developer, you’ve almost certainly used BOJ for interview prep or coding practice at some point. Discussions about migrating to alternative platforms (Programmers, LeetCode, Codeforces) have dominated community channels all week. Honestly, this feels like the end of an era.
📎 Sources
→ BOJ official shutdown notice
→ GeekNews discussion (56 points)
🛡️ 2. Vercel April 2026 security incident — internal breach via AI tool OAuth hijack
On April 19, 2026, Vercel officially disclosed unauthorized access to portions of its internal systems.
The attack vector: a third-party AI tool’s Google Workspace OAuth app was hijacked. Impact is described as "a limited set of customers," and environment variables not flagged as sensitive may have been exposed.
Vercel states there’s no evidence that values marked sensitive were accessed. They’ve also published the compromised OAuth App ID as an IOC, so you can plug it straight into monitoring.
Three actions Vercel recommends
| Step | Action |
|---|---|
| 1 | Review account activity logs — check for abnormal access |
| 2 | Rotate any potentially exposed API keys, tokens, and secrets |
| 3 | Use the sensitive environment variable flag by default going forward |
Why it matters
If you ship to Vercel, audit your environment variables today. "Third-party AI tool OAuth chain compromise" is going to become a standard attack vector. The same pattern can extend to GitHub Apps and Slack Apps, so this is a good moment to run an org-wide OAuth permission hygiene check.
📎 Sources
→ Vercel April 2026 Security Incident bulletin
→ GeekNews discussion (HN 361 points)
⚙️ 3. Zig 0.16.0 released — I/O is now an interface
Zig 0.16.0 landed on April 14, with 244 contributors stacking 1,183 commits over eight months.
The headline change: filesystem, networking, timers, and synchronization are now unified under the std.Io interface. Code that touches I/O now receives an Io instance — injected the same way you inject an Allocator.
Three implementations shipped
| Implementation | Description |
|---|---|
Io.Threaded |
Fully baked thread-based — stable, the default choice |
Io.Evented |
Green threads — experimental |
Io.Uring |
Linux io_uring backend for Io.Evented — proof-of-concept |
On the compiler side, the LLVM backend now supports incremental compilation, and a self-hosted aarch64 backend is in progress. The standard library gains Deflate compression and AES-SIV/AES-GCM-SIV, while the @Type builtin has been removed — the breaking changes are significant enough that migration work is required.
If you’ve been watching Zig as a potential Rust alternative, this release is an inflection point. Allocator-style I/O injection makes testing and sandboxing dramatically easier, and there’s plenty to study here even from a pure language-design perspective.
📎 Sources
→ Zig 0.16.0 official release notes
💸 4. DigitalOcean to Hetzner — how $1,432/mo became $233/mo
A migration writeup from developer Isa Yeter has been making the rounds this week.
Moving from DigitalOcean to Hetzner dropped the monthly bill from $1,432 to $233. That’s $14,388 a year saved — and the specs actually went up, from 32 vCPUs to 96 logical CPUs (AMD EPYC 9454P).
The zero-downtime cutover, in two key phases
Phase 2 — file sync: roughly 65GB and 1.5 million files in /var/www/html replicated via rsync over SSH, with an incremental sync to catch the delta right before cutover.
Phase 3 — DB sync: MySQL master→slave replication configured for real-time sync based on binlog position. Instead of mysqldump, they used mydumper for 48-core parallel export/import, turning a multi-day job into a few hours.
A concrete case study for the "cloud costs are too high" debate. Real-world techniques like mydumper and binlog-position-based cutover are laid out as recipes you can copy. Even if you’re not migrating today, bookmark it — you’ll need it eventually.
📎 Source
→ DigitalOcean to Hetzner Migration (original)
📧 5. Every editor’s email is exposed on any public Notion page
It surfaced on HN this week that any public Notion page leaks the email addresses of every editor with edit permissions on that page — no special access required.
An attacker can scrape public pages to harvest the work emails of internal team members. That data fuels targeted phishing, spam, and social engineering campaigns directly.
Plenty of companies run marketing, resumes, portfolios, and job postings off public Notion pages. Right now is the time to audit whether your public pages leak editor emails, and decide whether to swap company-domain accounts for separate ones.
As of writing, Notion hasn’t published an official response. Since this is a flaw in user-data isolation design, a quick patch may not be feasible.
📎 Source
🌳 6. SkipTree — adapting skip lists for BigQuery in production
On April 16, Antithesis published a writeup on SkipTree, a skip-list variant they built to fix BigQuery’s inefficient point lookups in a SQL-native way.
If a skip list is a "linked list plus express lanes," SkipTree layers multiple tables so that a single SQL query can traverse ancestor nodes.
The author’s takeaway:
"You never know when an obscure data structure will save you serious time and money."
A nice counterexample for anyone who learned data structures in school and then filed them under "not useful in practice." When hierarchical queries get slow on columnar databases, this is a pattern worth reaching for.
📎 Source
→ What are skiplists good for? (Antithesis)
💬 Editor’s take
The story that hit hardest today is BOJ. A lot of us spent late nights as job-hunting students grinding away at a single problem on that site. They’ve hinted at keeping the problems around, but submission histories will almost certainly vanish unless you back them up. If you have a BOJ account, archive your submissions before April 28.
The real story in the Vercel incident is that an "AI tool OAuth" was the attack vector. Developers casually hand Google Workspace OAuth permissions to productivity tools these days — get one of those apps compromised and the connected SaaS dominoes start falling. I’m going to revisit my Google account’s connected-apps list this week.
I assumed Zig 0.16 wouldn’t be huge news given the small ecosystem, but making I/O an injectable interface like Allocator is genuinely elegant design. Plugging fake I/O into test code is about to get a lot cleaner.
🔗 All links in one place
🔗 Every story from today, in one block
🟥 Baekjoon Online Judge shutdown
🛡️ Vercel security incident
⚙️ Zig 0.16.0 release
💸 DigitalOcean → Hetzner migration
📧 Notion editor email exposure
🌳 SkipTree
This post is a daily curation summarizing and reframing publicly available sources as of April 20, 2026. Companies, policies, and figures may have changed since — please cross-check the originals before making important decisions.
This post is part of an English mirror of a Korean dev experiments blog. Cross-posted for the global developer audience.