This blog doesn’t see much use, but if there’s one thing I want to be clear for anyone that stumbles upon it, now or in the future, it is my unconditional condemnation of Israel’s genocide in Gaza. I’m no subject matter expert on the conflict, but killing children and journalists like Israel is doing is wrong, full stop. My views on this have been shaped by much better…
When debugging InnoDB foreign key errors, the most detailed error message is found in the LATEST FOREIGN KEY ERROR section of show engine innodb status . This will helpfully include a binary dump of the index tuple that failed, something like this: Foreign key constraint fails for table ` foo ` . ` #sql-7_146`: , CONSTRAINT ` some_fk ` FOREIGN KEY ( ` bar_id ` ) REFERENCES ` bar ` ( ` id ` )…
checkov is a pretty neat tool to verify that your Infrastructure-as-Code (IaC) repo doesn’t do or omit anything that unintentionally impacts your security posture. The best kind of feedback is early and localized feedback, thus better than having a failed test run is a message directly in the PR diff about where something went wrong. Luckily GitHub has decent support for letting Actions…
Do you use a git commit hash so identify artifacts from your build process? And if something goes wrong on a deploy, do you use git revert or similar to revert the change? I do, it’s a pretty easy process to automate, but the main problem is that if your builds are a bit slow (ie a couple minutes or more), the revert takes about the same time as a regular change, and thus you have broken…
When setting up a CI/CD pipeline you might find that you need to set some variables depending on which branch you’re on. With GitHub Actions there’s good support for setting global variables which can be overridden on a per-job or per-step basis, but setting branch-specific variables is a bit less straight forward. This post outlines the cleanest approach I’ve found for this so…
Since the entire world seems to have picked up baking bread now I figured I’d share the recipe that literally carried Megacool through four years in San Francisco. We all took turns to bring loaves to the office for lunch, and it’s been my staple breakfast for the last three years. This is a low hassle, cheap and super quick recipe for extremely tasty bread. No kneading necessary! Prep…
I had an idea recently of presenting a commit of the week, as a way to showcase good software engineering in a bite-sized show and tell fashion. The thinking is that a lot of good practices, principles and computer science fundamentals can be easily taught with actual code from actual projects, which ensures that it’s relevant and applicable. I want to showcase work from a variety of people…
Many *nix utilities default to sending mail for status reports. For example cron will send output from jobs to the email specified in $MAILTO , or to the owner of the crontab. Unattended-upgrades can send email reports when packages are updated, and sudo can send reports whenever someone fails to enter a correct password, or whenever anyone authenticates at all. For several of these use cases it…
So you’ve started your first virtual machine in the cloud somewhere, and you’re ready to make something people will love. You just need to put it out there, so you open up your terminal, type in the magic letters ssh and some IP address, and suddenly you’re in some cypherpunk dystopia and have to wrangle with the moral dilemma of whether to trust an arbitrary sequence of…
This post comes to you in three parts: An introduction to the most underutilized feature of argon2, introducing a python project to utilize that feature, and a rant about the current terminology on password storage. argon-wat? argon2 is the algorithm that in 2015 came out as the winner of the Password Hashing Competition . The goal of PHC was to find an algorithm that was thoroughly analyzed by…
A lot of jobs exist in a field where you get to combine several interests. Take photography. It’s impossible for photography to exist in a vacuum, something has to be depicted, which is determined by the photographers interests. Portrait photographers are drawn to people, and are great communicators, being able to tell the stories of the people they portray while getting them to tell their…
I recently had to set up a new postgres instance at work. While we’re already using Heroku Postgres for production loads, we had some requirements for this one that couldn’t be solved without being database admin, and thus had to go self-hosted. That process in itself is fairly straightforward and not worthy of a post in itself, but this instance was one we’d use to run ad-hoc…
Don’t use cron’s environment variables for storing secrets. Like I did. MAILTO = notactuallymyemail@thusoy.com PASSPHRASE = K5mzQ6VMk1NpCQEGjakbgq80H678fsxpKeErO8aV # uh-oh 0 5 * * * duplicity --verbosity warning /home s3+http://mybucket/mybackupdir It’s certainly often convenient and the quickest solution, but leads to a risk of them being compromised if you’re using email…
I’m not going to rant about CAs vs. DANE here, there’s tons of reading on that on the web already, but for a primer the DANE RFC is quite good. I’ll merely here point out two useful tools for starting to migrate away from CAs. The first is a short snippet for creating the TLSA DNS record you’ll need: $ echo 3 0 1 $(echo | openssl s_client -connect thusoy.com:443 | sed -n…
Ever been frustrated that you can only create crypt(3) compatible password hashes on *nix machines? Me too! But I figured, the crypt(3) implementation in glibc can’t be that hard to port to python, so I gave it a go, and can now present the Python package pcrypt . pcrypt uses a pure-python implementation of the crypt(3) algorithm, and is nearly 5 orders of magnitude slower than the glibc…