Author’s note: originally published in 2019, revised January 2026. Having witnessed the NFT and crypto boom and bust of 2021, these arguments have only grown more relevant. Why blockchains work for cryptocurrencies # Blockchains work for cryptocurrencies because the asset being traded is the blockchain record itself. When you “own” Bitcoin, what you actually own is a cryptographic entry on a…
In view of the recent Shai-Hulud supply chain attack where a malicious package install script exfiltrated the current user’s environment variables and static secrets found in their files, I am describing a solution to eliminate static tokens in favor of dynamic, machine/workload-specific credentials that are time- and scope-limited. Note that this does not aim to prevent malware attacks per se; an…
If you’re using Django (or any standards-compliant web application using cookie-based sessions) behind Cloudflare, you need to be aware of a massive limitation in their cache implementation that could lead to caching and leakage of private responses (intended for a specific user presenting their session cookie) to everyone . Background: the Vary header # The Vary response header is used by an…
This might be of interest if you are interfacing with the Wise (formerly TransferWise) API from a Python project. Note that you need to have regulatory approval to be able to access 2FA/SCA-protected endpoints - speak to your contact at Wise for more info. But once you get your private key enrolled, this code should work. import typing from base64 import b64encode from datetime import datetime…
When the latest ills of social media are discussed, someone will inevitably bring up the fediverse - the decentralized ecosystem of alternative social networks like Mastodon - as the miracle cure. Yet even a decade after its release, Mastodon remains largely unknown outside technical circles. The reality is that the fediverse solves few (if any) problems while introducing many new ones - and it…
Let’s say we have the following model and we have the current version of the application already running and writing to it: class LogRecord(models.Model): timestamp = models.DateTimeField(auto_now_add=True) message = models.TextField() We’d like to add a severity column to it in a zero-downtime fashion, meaning we will not interrupt the currently-running app (it is running some mysterious and…
If you are using Django’s LiveServerTestCase to do browser-based testing, you might be running into sporadic database failures in between individual test methods. The root cause is that the server is bound to the lifetime of the test case (aka class), where as its parent TransactionTestCase class does database changes before & after each individual test method (by calling setUp , tearDown and so…
Improve performance # When running projects locally (for development or running tests), you may be able to speed up database performance by adjusting its data durability settings. This would for example translate in faster setUp() / tearDown() in between tests as well as faster database migrations in Django. The default config Postgres config favors data safety/reliability, but in a local case the…
In the context of Django reusable apps, I often need to provide a way for the user to configure a connection (or set of) to some database or third-party service, and optionally be able to substitute the driver/adapter class with a custom one. In that case I’ve settled on what I call the “backend” pattern (not sure if there is a generally-accepted name for this), similar to what Django already does…
Note: this is an old post from 2016 and hasn’t been updated nor reviewed since. Nowadays I would recommend using Wireguard which is harder to configure insecurely, or at least use something like OpenWrt which provides a nice GUI to configure IKEv2. Here’s a really basic Strongswan configuration for a single client, authenticated using a PSK. This has been successfully tested with iOS 10 but should…