In a small town, there was a bakers' club popular with professionals and hobbyists alike. Every Saturday, they would gather at the local cafe and bring their homemade cakes and pies; they ate, drank coffee, talked, and exchanged the latest recipes. It was nice. One day, a new visitor arrived …
This benchmark covers the most commonly used Python parsers for multipart/form-data (HTML5 forms) and tests them in different scenarios, comparing both blocking and non-blocking (async) APIs if available. Source code is available here: https://github.com/defnull/multipart_bench/ The multipart library is used as a baseline, because it is …
Did you also notice a repeating pattern with AI security reports lately? The attack chain just assumes a pre-existing breach, then continues to frame normal and expectable behavior as a security issue. Some examples that were actually reported to me in the past: A web application serves static files from …
BigBlueButton sometimes show an error with a 4-digit number but no further explanation. I could not find a complete list online, so I dug into the sources ( 1 , 2 ) and collected all error codes I could find: 1101 - 1121: Client errors ¶ Connection or media decoding issues detected by the client …
The 'multipart' python library got an independent security audit and I only know about that because they found something -> CVE-2026-28356 This is great, actually! Someone looked into it so thoroughly that they found an obscure single-character issue in a regular expression ... and didn't find anything else! Which means I can …
My latest FOSS Project: BBBLB is a modern multi-tenant capable load balancer for large BigBlueButton clusters. Not ready for production yet, but on a good path. The aim is to have something fast and easy(er) to maintain that can fully replace scalelite (the reference implementation) and fixes some of …
The python aiohttp library uses yarl for URLs internally, and yarl normalizes URLs by default. It silently decodes some %-encoded characters in the query string that do not strictly need to be encoded. Sounds harmless, but it isn't. Changing the URL breaks any protocol that signs important aspects of a …
The uv and uvx tools have a very particular way to make virtual environments relocateable: they replace the shebang in python scripts with some polyglot magic, so that the executable is both a valid bash script and a python script at the same time. Unfortunately this breaks with a SyntaxError …
Go to https://fediwall.social/ and press 'w' :D Sorry, no mobile support for this ultra useful feature, but it wouldn't look good on mobile anyway. Go touch some keyboards.
Coffee machine design flaw: My coffee maker has a floating magnet in its water tank and a reed switch to detect low water levels. The problem is that the machine stops immediately when this sensor is triggered, even in the middle of making a coffee and with enough water left …
Today is the day. Puppet is dead, long live OpenVox ! Background: Perforce bought Puppet in 2022, betrayed the FOSS community and changed the license. This resulted in a fork called OpenVoxProject , but old puppet releases still worked, so many admins did not care enough to switch. Yesterday the release key …
I recently experimented with BigBlueButton 3.0-RC4 again and tried do find out why hasura-graphql-server and postgresql are hogging half a CPU all the time on a fresh BBB server with just a single meeting and only one participant. This seems to be less of an issue if you actually …
A while ago I found CVE-2024-47874 in starlette (and FastAPI ). The same issue is also present in litestar and I repotted that as CVE-2024-52581 (CVSSv4 8.7). The reaction time from the team was very quick this time and a fix was published in less than a week. A new …
Werkzeug is a Web Server Gateway Interface (WSGI) library used to develop python web applications or frameworks. Applications using werkzeug.formparser.MultiPartParser to parse multipart/form-data requests (e.g. all flask and quart applications) were vulnerable to resource exhaustion (denial of service) attacks. A specifically crafted form submission request could …
I'm finally allowed to speak about this nice little DoS vulnerability I found in starlette (and FastAPI ). CVE https://www.cve.org/CVERecord?id=CVE-2024-47874 GHSA https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw The FastAPI devs published an update 3 days before the security release of Starlette that widened …
Digging through the most popular password 'leak' compilations for a side project and it's >90% fake. Only a tiny fraction of those passwords may have been used by a human at some point, the rest is computer-generated junk. Even the real passwords are probably stolen from other leaks. The reason …
I did a thing! Fediwall is a configurable social media wall for the fediverse, similar to all the Twitter walls that no longer work. It's opensource and easy to self-host if you want, but you can also use the public instance on https://fediwall.social/ and configure it yourself. Click …
This website exists mostly because t-online tends to block e-mails from mail servers that do not have a website and contact information attached. I probably won't post articles here. The About Me page is populated if you want to know more.
Diese Website existiert eigentlich nur, weil T-Online keine E-Mails von Mailservern ohne Website mit Impressum annehmen mag, was für private Mailserver natürlich Blödsinn ist, aber was soll's. Wahrscheinlich werde ich hier nurt sehr unregelmäßig Artikel veröffentlichen. Die About me Seite ist dennoch gepflegt, wenn du mehr erfahren willst.