Building my first browser extension
Sometimes a website is almost right, but not quite to your liking. Maybe an element is out of place, the colors feel wrong, or the font just doesn’t work for you. I run into that a lot.
Security and coding write-ups by Darius Pirvulescu
Practical write-ups, tutorials and other musings on software engineering, web security, Ruby and Rails, C#, Linux, and Docker.
Latest posts
SSE, Clerk, and rotating tokens: A debugging story
This is the story of a subtle workflow error that polluted our logs and kept triggering pointless alerts. It lingered in the background long enough. I decided to track it down and fix it for good. Enough is enough.
Loading related DB entities in EF Core
For my latest client, I’ve been working with C# and ASP.NET Core, using Entity Framework (EF) Core as the ORM. This gave me the chance to explore how relationships between entities are modeled and and how EF Core loads related data.
Exploring the ANSI escape injection in Active Record logging [CVE-2025-55193]
Last week, two security patches were added to Rails. One of them was meant to guard against the ANSI escape injection [CVE-2025-55193], a vulnerability affecting Active Record logging. I was curious what an attacker could achieve by exploiting this vulnerability. Here, I logged my findings and created a simple PoC.
5 simple steps to a lean Docker image
Docker is a tool I often use, both for developing personal projects and also during my Cybersec studies. Recently, I researched how Docker builds an image and discovered ways to limit the image size.
Safeguard against DoS in Rails helper
One recent contribution to the Rails codebase caught my attention. It concerns the distance_of_time_in_words method. The fix is meant to prevent a possible Denial of Service while using this method.
DNS lookup from scratch
My findings after implementing the DNS query without any library. This domain name system is nicely tucked away in the network drawers, so you don’t even notice it. Nonetheless, it is used by everyone on the internet multiple times a day.
2024 annual review
I’m continuing the practice of reflecting on the year that passed.
Place an SSH honeypot
After deploying my VPS and taking steps to secure it, I had the original SSH port (22) inactive. But it kept me curious about the default SSH activity going on there. How much brute forcing is happening on a publicly exposed server? I started experimenting with honeypots to find out more.
Benchmark your ruby code
Ruby offers an easy way to benchmark the code. Here is some syntax for basic benchmarking.