One of the weirdest OSS requests that I got: "Your library returns an error on specific input. Can you suppress it? I don't want to handle it. It's okay to ignore it."

Wrote a new blog post about my experience debugging hash tables in Go. https://t.co/MnnVNqOgEU

Yeah, let's trust file extensions. Reminds me of the good old days when some of the web engines disallowed uploading .php files, but were happy with file.txt.php. After uploading it, you could just go to the site[.]com/uploads/file.txt.php and it was happily executed on the

Writing a new rule to detect malicious code in Python scripts, and my binary is detected as malware because it checks for specific signatures in text that Apple also tracks in binaries 🫡

This is an excerpt from my recent blog post

Python is weird. It normalizes confusable homoglyphs to regular text. This can be abused to hide malicious code. Some of security linters won't detect this, because they search for regular "exec". #python

Thanks to @charliermarsh and the Ruff team for making parts of Ruff reusable for other projects. Good AST parser and semantic modeling saved me a lot of time.

Made a new library that statically analyzes Python code for malicious or harmful behavior. https://t.co/tMPLBeSF5H

Fun observation. If you insert a null byte in a Google search query, the query will be trimmed.

Just block such submitters. They should be ashamed. Their incentive is to get some contributions for a resume without knowing a thing about your code/project. This was a thing even before LLMs.

Since Python functions are objects too, you can assign variables to them. This can be abused in many ways, although not for production code.

You can message yourself on X

One thing that I like testing on websites that support sending private messages is the ability to message yourself. Funny enough, LinkedIn requires a premium subscription when you attempt to do this.

"in 2025 we will have flying cars" 😂😂😂

fml linkedin is unusable

Threat Hunting Introduction: Cobalt Strike

Here is a 72-byte alphanum MD5 collision with 1-byte difference for fun: md5("TEXTCOLLBYfGiJUETHQ4hAcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak") = md5("TEXTCOLLBYfGiJUETHQ4hEcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak")

I’ve spent the last 20 years of my career riding the gravy train of “being good at Google,” but now that Google search results are awful I guess I’ll need to become good at something else.

Something didn’t go as planned for this guy. Oh well.