Last week we proudly open-sourced our authentication worker.
This week...
Someone actually read the code.
Community member Prakhar Gupta noticed something we had completely missed.
Because the worker acts as a secure proxy between applications and our backend services, one part of the implementation was unintentionally forwarding requests with elevated permissions. While it wasn’t an easy bug to exploit, it wasn’t something we were comfortable leaving in production either.
So we dropped everything and fixed it.
The new version is significantly faster, more secure, and lays the groundwork for an even bigger Version 3 that’s already in development.
This is exactly why we believe in open source.
More eyes don’t make software weaker.
They make it better.
Huge thanks to Prakhar Gupta for taking the time to responsibly report the issue instead of ignoring it.
If you’re reading this thank you. ❤️
Community Spotlight
Prakhar Gupta
Software Developer • Sugar Labs
GitHub: https://github.com/Prakharrdev
LinkedIn: https://linkedin.com/in/prakharrdev/
That’ll feel really cool.
We thought we’d be selecting around 100 teams.
We were wrong.
Very wrong.
The quality of submissions this year made the decision much harder than we expected, so instead we’ve selected 375 teams to move forward.
If your name is on the list congratulations.
If not, thank you for building something and putting it out into the world.
The detailed confirmation email, including venue information, payment instructions and everything you’ll need for the next stage, will be arriving later this week.
For now...
Just make sure your email address and phone number on the portal are correct.
We’d love to tell you everything went smoothly.
That would be a lie.
The same day we announced FarAway results also happened to be the day half our infrastructure decided to protest.
Servers complained.
APIs complained.
The engineering team definitely complained.
But after a few very long hours (and probably too much coffee), everything was back online.
As always...
Thank you for your patience whenever our ambition grows slightly faster than our servers.
Anyone who’s organised an event knows certificates are surprisingly annoying.
So we’ve been fixing that too.
Our Digital Certificate platform is now much easier to deploy on your own website.
It now supports:
QR-code verification
CSV imports
Bulk email merge
One-click deployment
We’re also experimenting with AI-generated certificate templates, which should make designing certificates much less of a headache.
Coming soon.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.