The Curious Engineer

All blogs / Security

Frank DENIS random thoughts.

00f.net

Frank DENIS blog

SecurityPerformance / optimizationRust

’10’15’20’25
Posts
283 from 4 Mar 2007 to 8 Oct 2026
Posting
weekly (25 in the last year)
Kind
personal blog
Feed
https://00f.net/atom.xml

2026 24

  1. Branches in branch-free code
  2. Zeroization, part 3: Copies you can’t wipe
  3. Zeroization, part 2: Clearing the stack and registers
  4. Zeroization, part 1: Wiping can make things worse
  5. Do your employees actually use your product?
  6. Semi-public Git repositories
  7. Base84 deserves a place in file names
  8. Why compiling Rust to WebAssembly is slow
  9. An improved attack on 7-round AES
  10. AES gets swizzled
  11. The best WebAssembly runtime may still be no runtime at all
  12. Performance of WebAssembly runtimes in 2026
  13. Faster signatures for WebAssembly
  14. Feeding a PRF its own tail
  15. AI slop is hard to fork
  16. Pushing to a pull request that isn't yours
  17. Bun's problem may be developing in the open
  18. aHash is not a PRF
  19. Swival is the AI agent I actually wanted
  20. Configuration flags are where software goes to rot
  21. Fast sorting, branchless by design
  22. Don't pass on small block ciphers
  23. An introduction to XET, Hugging Face's storage system (part 2)
  24. An introduction to XET, Hugging Face's storage system (part 1)

2025 13

  1. A vulnerability in libsodium
  2. Why IP address truncation fails at anonymization
  3. Length-extension attacks are still a thing
  4. The state of the Rust dependency ecosystem
  5. Why we trust strangers’ open source more than our colleagues’
  6. Why most MCP servers won’t last and that’s okay
  7. LLMs don't need your secret tokens (but MCP servers hand them over anyway)
  8. Apps shouldn’t let users enter OpenSSL cipher-suite strings
  9. Building a smarter chatbot - Why you need FAQ-links + RAG (and why everyone else gets it wrong)
  10. How to enable post-quantum key exchange and AEGIS in Nginx
  11. A simple tweak to make static shared keys suck less
  12. Options for full disk encryption on Linux
  13. Why your pull request might not be merged

2023 3

  1. The best WebAssembly runtime may be no runtime at all
  2. LLVM performance improvements for WebAssembly
  3. Performance of WebAssembly runtimes in 2023

2021 2

  1. It doesn't work
  2. Benchmark of WebAssembly runtimes - 2021 Q1

2019 7

  1. Stop using ridiculously low DNS TTLs
  2. Go is the new Ruby
  3. Updated WebAssembly benchmark using libsodium
  4. CI is awesome. CD makes me uncomfortable.
  5. DNSCrypt - how expired certificates became a thing of the past
  6. Benchmarking WebAssembly using libsodium
  7. Compiling C to WebAssembly using clang/LLVM and WASI.

2018 3

  1. WebAssembly doesn’t make unsafe languages safe (yet)
  2. On user authentication
  3. Building a parental control system from scratch

2017 1

  1. How I changed my body shape in 7 months

2016 1

  1. CVE-2015-7547: don't panic, don't spread fear

2015 2

  1. IPv6, DNS and Windows
  2. Where are the self-tuning systems?

2014 1

  1. When suspended accounts are actually targeted attacks [updated]

2013 4

  1. Taking down botnets is not ineffective
  2. Getting prepared for the next Cryptolocker DGA
  3. Security and privacy issues of edns-client-subnet
  4. Learn from marketing/sales people.

2012 4

  1. On dnscache poisoning and how SipHash can help
  2. mod_pagespeed as a proxy for your phone
  3. On the distribution of DNS TTLs
  4. Akamai vs public DNS servers

2011 5

  1. DNS records and TTL - how long does a second actually last?
  2. Programmatically changing network configuration on OSX
  3. Redis as a recommendation engine
  4. Pagination and HTTP caching
  5. Thoughts on PHP sessions

2010 7

  1. Back and forward buttons considered harmful
  2. What happens during the AppStore review process?
  3. Using Pincaster for autocompletion
  4. A transparent, client-side fragment cache.
  5. Goodbye Mephisto, Hello Jekyll
  6. How the way you deploy code can ruin performance
  7. Choosing a NoSQL data store according to your data set.

2009 42

  1. Twonav for iPhone is now available
  2. Application-controlled browser cache using local storage.
  3. Is Twitter a blog killer?
  4. Enter webhooks
  5. Elliptics Network 2.5.0 has been released
  6. PHP-FPM might get merged into PHP
  7. Stealing your browser history without Javascript
  8. Bayon, a fast clustering tool
  9. Yet some more good presentations
  10. Embracing events
  11. ICANN to open up the TLD namespace
  12. A sneak peek at the Google IO conference
  13. UCARP 1.5.1
  14. Hardening MacOSX against the Java vulnerability
  15. New benchmarks of Elliptics Network published
  16. Slides and videos from MWRC2009
  17. Pinba: a real-time statistics server for PHP
  18. A critical vulnerability in IE8
  19. MurmurHash: now in 64-bits flavor
  20. Pure-FTPd 1.0.22 has been released
  21. Beyond horizontal scalability
  22. A critical one-shot remote Linux kernel vulnerability
  23. Ubuntu Jaunty: made on MacOSX with Photoshop
  24. Online file converter that really rocks
  25. Running a Realtime Stats Service on MySQL
  26. A presentation about Q4M
  27. Natural Docs: yet another documentation generator
  28. MapReduce vs DBMS for large-scale data analysis
  29. Cloudkit, Hypertable, HyperRecord
  30. Ruby on Google App Engine
  31. An overview of modern SQL-free databases
  32. 10 Reasons why PHP is Still Better than Ruby
  33. Messages queues evaluated for Second Life
  34. MacRuby, soon based upon the LLVM infrastructure
  35. An introduction to RestMS
  36. A complete search engine in 200 lines
  37. A killer template system in pure Javascript
  38. Security assessment of the TCP protocol
  39. Ruby 1.9.1 is released
  40. An introduction to Tokyo products
  41. High Availability of Web Server Using UCarp
  42. QuickPwn annoyed by iTunes

2008 76

  1. CloudKit: RESTful versioned storage of JSON data
  2. Signals and slots in Javascript
  3. Scientists extract images directly from brain
  4. PHP-FPM 0.5.10 has been released
  5. A MySQL UDF for top N sort
  6. Google's browser security handbook
  7. 0MQ 0.4 has been released, now under LGPL
  8. Running native code on the web
  9. PHP 5.2.8 is out
  10. New version of Ruby Enterprise Edition released
  11. Fix iTerm crash in multi-user mode
  12. Easily download the files of a web site
  13. Bypassing face-recognition systems
  14. An iPhone temperature app using... crickets as sensors
  15. A YARV to LLVM compiler
  16. Need an emergency DNS cache?
  17. Don't upgrade to PHP 5.2.7 now
  18. Speed up page loading on your iPhone
  19. OpenBSD-current is slow!
  20. How to flush the resolver cache on OSX
  21. Recent security flaws you might care about
  22. Yet another fast CSS3 selector implementation
  23. What's the fastest in-memory associative arrays library?
  24. Big life secret: how I manage my money
  25. Source Wars, an overview of OpenBSD 4.4 by its coders
  26. A zero-knowledge password authentication method
  27. Yes, 6 x 9 = 42
  28. GEMA is now open source
  29. Online version of OpenOffice.org 3
  30. C++ backend for haXe and AS3->haXe converter
  31. Don't forget that clickjacking is still with us
  32. Ruby off Rails
  33. Optimize your Firefox SQLite databases
  34. Matthew Dillon's NYCBSDCon 2008 slides
  35. A messy list of worthy software, part #1
  36. How to avoid IE CSS hacks using conditional classnames
  37. An unofficial Prototype and Scriptaculous Wiki
  38. A lookup at Google's data centers
  39. Closing the users browser connection whilst keeping your php script running
  40. Prototype 1.6.0.3 has been released
  41. Using libpuzzle in order to find the cue point of a video
  42. Extensions for the prototype.js library
  43. Multiple vendor ftpd - Cross-site request forgery
  44. Lesser-known PHP vulnerabilities
  45. The IP address assignments map
  46. Pacman in Javascript
  47. Nostalgia
  48. A Ruby VM in Javascript
  49. Hans Reiser history, by DittoBox
  50. First Google Chrome vulnerability disclosed
  51. OSBF-Lua is still the best spam filter in the world
  52. A DragonflyBSD live DVD
  53. An actual solution to the current weakness of the DNS protocol
  54. DNS servers still vulnerable after patching
  55. Solaris remote root exploit
  56. Details for Kaminsky DNS vulnerability leaked
  57. Another OpenSSH-portable vulnerability?
  58. A simple, powerful and fast mail delivery agent
  59. Linux is dying
  60. BSD is dying
  61. Cross-subdomain AJAX made simple
  62. A presentation of the HAMMER filesystem
  63. RAID0 vs RAID1 benchmark
  64. Persistent storage without cookies
  65. Avoid pie charts
  66. Let extensions run with new Firefox versions
  67. A library for lockless and transaction-capable hash tables
  68. XMLHttpRequest browser bugs and and implementation with sniffing capabilities
  69. Opera doesn't load some sites
  70. Fast sinus and cosinus approximation
  71. MySQL gets Maria, yet another storage engine
  72. Microsoft to buy Yahoo
  73. Thin: a fast and simple Ruby web server
  74. MonetDB / X100, a revolution in the database world
  75. UCARP 1.4 has been released
  76. Tokyo Tyrant : a network layer for Tokyo Cabinet

2007 88

  1. Next Internet Explorer to pass the Acid 2 test ?
  2. Easily embed PHP within C++
  3. Ruby on Rails 2 is out!
  4. Bob Jenkins super fast hash for PHP
  5. VMWare Server 2 beta is now available
  6. Highly scalable architectures : lessons learned at Qcon 2007
  7. Optimizing require_once with xend
  8. Java 6 has been ported to MacOS X
  9. Improving MyISAM read/write concurrency
  10. PHP 5.2.5 + Suhosin + FastCGI = unstable trio
  11. Tokyo Cabinet, Mikio did it again
  12. JumboMem: expand your memory at will
  13. Liste de tous les codes postaux et communes de France, avec géolocalisation
  14. Update your DNS cache servers
  15. Internet Explorer memory leaks
  16. Rest in peace, Jun-Ichiro Hagino Itojun
  17. Stop 1970 programming
  18. A nice alternative to osCommerce
  19. Optimizing MyISAM tables with a pair of disks
  20. A wonderful project-management tool
  21. Off-by-one in OpenSSL
  22. OpenBSD 4.2 song and lyrics are online
  23. Hot news in the Ruby on Rails world
  24. Swiftiply: boost your framework-driven web applications
  25. Pixelmator 1.0 is available
  26. Vulncheck updated
  27. New project: the puzzle library
  28. PHP : notes about integers
  29. ChironFS, filesystem redundancy made simple
  30. Pure Java™, Pure Evil™ Popups
  31. Why PHP is a mess
  32. UCARP 1.3 is out
  33. Playing with Ruby 1.8, Ruby 1.9 and PHP
  34. OpenBSD is now running on Xbox
  35. Emacs 22 is out!
  36. OpenOffice.Org for OSX
  37. EyeOS 1.0 has been released
  38. An age is not a duration
  39. New TLB shootdown code in OpenBSD
  40. Gentoo 2007.0 is there!
  41. MaxKeepAliveRequests: keep it high
  42. Cunninlynguists: f*cking good sh*t
  43. PHP 5.2.2 has been released
  44. STF scheduler for OpenBSD
  45. Easily create config files for Nginx from YAML files
  46. Google releases patches that enhance the manageability and reliability of MySQL
  47. Excel as an exchange format is a nightmare for developpers
  48. Enable IPv6 and kill the internet
  49. OpenBSD is being ported to the Xbox
  50. PHP and its horrible hash/array mixup
  51. Mozilla Thunderbird 2 is there!
  52. lighttpd 1.4.15 has been released
  53. OpenBSD finally got UFS2
  54. Myths of XHTML and why HTML is probably the way to go
  55. OpenBSD 4.1 song and lyrics now available
  56. Submitting a form without changing the window's content
  57. Internet Explorer and multiple connections to same the web server
  58. Backslashes in SQL strings are illegal
  59. PHP WebDAV extension 1.1 released
  60. YouGetIt : the next big thing?
  61. Rage against free Broadcom drivers
  62. Moderating bulletin boards with text classifiers
  63. Timing a process out
  64. Preventing cross-domains scripting attacks
  65. No more 2D acceleration for free operating systems?
  66. MySQL 5.0.37 for OpenBSD
  67. 800x600 is not dead
  68. LSI Megaraid cards and slow write performance
  69. Sniffing Bluetooth with common hardware
  70. PHP with FastCGI on OpenBSD
  71. Skyrock Blog launched
  72. MySQL proxy and MySQL tricks
  73. Metasploit 3.0 has been released
  74. Gettext and accents in po templates
  75. Translating HTML templates
  76. DSPAM 3.8.0 unofficial release
  77. Patch for the OpenBSD mbuf issue has been updated
  78. Insono: linear auditive protections
  79. A security hole in the OpenBSD IPv6 stack
  80. OpenBSD 4.1 is available for preorders
  81. MySQL and persistent user variables
  82. OS counters are harmful
  83. A fast web browser for OSX
  84. Why are lightweight markup languages so heavy?
  85. PHP and multipart PUT data
  86. Announcing the PHP WebDAV extension
  87. phpinfo() XSS vulnerability
  88. 00F.Net is back