The Curious Engineer

All blogs / Security

Alex Gaynor

alexgaynor.net/blog

Hi, I'm Alex. I'm a software resilience engineer. I care about building systems that work. I've worked for the government, in the private sector, and on open source. I'm based in Washington, DC.

SecurityRustSociety / politics / economy

’10’15’20’25
Posts
270 from 3 Nov 2008 to 7 Sep 2026
Posting
now and then (5 in the last year)
Kind
personal blog
Feed
https://alexgaynor.net/feed.xml

2026 3

  1. Is it correct?
  2. You can't bug fix your way out of the vulnpocalypse
  3. If it could have, why didn't it?

2025 15

  1. Unsafe Defaults in Statutory Severability Analysis
  2. Relish: A new serialization format
  3. Motion to Dismiss for Failure to State a Vulnerability
  4. So you want to serialize some DER?
  5. What is a Benchmark?
  6. Standard Libraries and their Discontents
  7. Putting a Price Tag on Open Source
  8. Postel's Law and the Three Ring Circus
  9. Notes on coreutils in Rust
  10. Things have reasons
  11. Generality
  12. Do tech workers have a reason to love monopolies?
  13. The SSO Tax is Smart Business, and Bad Security
  14. Stop Demanding Performance
  15. Challenges to funding open source

2024 5

  1. Risky Business
  2. Philosophies of Cryptographic Libraries
  3. Signatures are like backups
  4. The impact of memory safety on sandboxing
  5. Safer C++

2023 1

  1. Defining the memory safe problem

2022 1

  1. Buffers on the edge: Python and Rust

2021 1

  1. What's in a version number? (Or: Musings on backwards compatibility)

2020 5

  1. Why software ends up complex
  2. CSVs: The good, the bad, and the ugly
  3. What science can tell us about C and C++'s security
  4. Dayenu for Open Source
  5. Scaling Software Development

2019 10

  1. 2019 Security Wish List In Review
  2. On Safety Critical Software
  3. A Memory Safety Research Agenda
  4. Introduction to Memory Unsafety for VPs of Engineering
  5. Read code more
  6. Modern C++ Won't Save Us
  7. Notes on the challenges to the adoption of security keys
  8. Chrome + Windows Exploit: Security Beyond Bugfixes
  9. Notes on fuzzing ImageMagick and GraphicsMagick
  10. Security wish list for 2019

2018 5

  1. Optimize for Auditability
  2. The worst truism in information security
  3. Lessons learned at USDS
  4. Known unknowns - zero-days in the wild
  5. The mysterious case of (deny dynamic-code-generation)

2017 8

  1. A vulnerability by any other name
  2. Response to Deputy Attorney General Rosenstein's remarks on Encryption
  3. Surviving Apache Struts CVE-2017-5638
  4. Categorizing Security Engineering Work
  5. Forward secrecy is the most important thing
  6. Introduction to Certificate Transparency for Server Operators
  7. A year of tracking my HTTP requests
  8. SHA1 and Richard Feynman

2016 6

  1. Looking for work
  2. OSS-Fuzz initial impressions
  3. Intro to threat modeling
  4. Anatomy of a Crypto Vulnerability
  5. Announcing letsencrypt-aws
  6. Don't have environments

2015 10

  1. Shrinking your code review
  2. 5 critically important security projects
  3. Telemetry for Open Source
  4. Rust: A modern programming environment
  5. Tips for Improving Your Company's Security
  6. Tips for Scaling Web Apps
  7. Introduction to Fuzzing in Python with AFL
  8. Red Hat and the Open Source Community
  9. DevOps vs. Platform Engineering
  10. Software Of the People, By the People, For the People

2014 36

  1. The State of the News and TLS: Part II
  2. The West Wing Revisited: Let Bartlet Be Bartlet
  3. The State of the News and TLS
  4. I Hope Twitter Goes Away
  5. My Ideal Development Environment
  6. The West Wing Revisited: Six Meetings Before Lunch
  7. The West Wing Revisited: The White House Pro-Am
  8. The West Wing Revisited: 20 Hours in L.A.
  9. The West Wing Revisited: Celestial Navigation
  10. The West Wing Revisited: Take this Sabbath Day
  11. The West Wing Revisited: Take out the Trash Day
  12. Advocating for the Devil
  13. The West Wing Revisited: He Shall, From Time to Time?
  14. The West Wing Revisited: Lord John Marbury
  15. The West Wing Revisited: In Excelsis Deo
  16. The West Wing Revisited: The Short List
  17. The West Wing Revisited: Enemies
  18. The West Wing Revisited: The State Dinner
  19. The West Wing Revisited: Mr. Willis of Ohio
  20. How to Code Review Without Being a Jerk
  21. HTTP Considered Unethical
  22. The West Wing Revisisted: The Crackpots and These Women
  23. The West Wing Revisited: Five Votes Down
  24. The West Wing Revisited: A Proportional Response
  25. The West Wing Revisited: Post Hoc Ergo Propter Hoc
  26. Python for Ada
  27. The West Wing Revisited
  28. Math Games
  29. There is a flash of light! Your PYTHON has evolved into ...
  30. Quo Vadimus?
  31. Service
  32. Best of PyCon 2014
  33. House and Twitter
  34. Why Crypto
  35. Why Travis CI is great for the Python community
  36. PyPI Download Statistics

2013 21

  1. About Python 3
  2. Gender neutral language - An FAQ
  3. Affirmative action
  4. Security process for Open Source Projects
  5. Meritocracy
  6. Thoughts on Lavabit
  7. Effective Code Review
  8. Being negative
  9. Doing a release is too hard
  10. You guys know who Philo Farnsworth was?
  11. Your project doesn't mean your playground
  12. Why I support diversity
  13. An open letter to the security community
  14. You don't have to be a jerk to code review
  15. Your tests are not a benchmark
  16. Thoughts on OpenStack
  17. Weekly Updates
  18. Moving to Rackspace
  19. Perception
  20. Disambiguating BSON and msgpack
  21. Software Design: 80/20 libraries

2012 4

  1. Linux on the Desktop Dead
  2. The compiler rarely knows best
  3. Why personal funding
  4. 5 years, 2 months, and 28 days

2011 12

  1. The perils of polyglot programming
  2. Why del defaultdict()[k] should raise an error
  3. RCOS NumPy Talk
  4. The run-time distinction
  5. So you want to write a fast Python?
  6. DjangoCon Europe 2011 Slides
  7. This Summer
  8. My experience with the computer language shootout
  9. PyPy San Francisco Tour Recap
  10. Django and Python 3 (Take 2)
  11. Announcing VCS Translator
  12. PyCon 2011 is going to be Awesome

2010 44

  1. 2010 in Review
  2. Getting the most out of tox
  3. Programming Languages Terminology
  4. Symptoms and Diseases
  5. A statically typed language I'd actually want to use
  6. Not everything sucks
  7. The continuous integration I want
  8. National Blog Post Month
  9. Priorities
  10. Cui Bono
  11. Prohibition doesn't Work
  12. The Pakistan Problem
  13. US Interventionism and its Fallout
  14. Dynamic and Static Programming Languages and Teaching
  15. US Counterinsurgency and Terrorism Policy
  16. Afghani Elections
  17. django-taggit 0.9 Released
  18. Political Religion
  19. Democracy in Colonial Areas
  20. Upcoming Content
  21. DjangoCon 2010 Slides
  22. Education Slides
  23. PyOhio Slides
  24. Testing Utilities in Django
  25. MultiMethods for Python
  26. Hey, could someone write this app for me
  27. DjangoCon.eu slides
  28. PyPy is the Future of Python
  29. A Tour of the django-taggit Internals
  30. Why Utilitarianism Fails
  31. Cool New django-taggit API
  32. Making Django and PyPy Play Nice (Part 1)
  33. Designer Developer Relations
  34. Towards Application Objects in Django
  35. Languages Don't Have Speeds, Or Do They?
  36. PyCon Roundup - Days 2-4
  37. PyCon Roundup - Days 0 and 1
  38. Committer Models of Unladen Swallow, PyPy, and Django
  39. Thoughts on HipHop PHP
  40. Why Open Source Works
  41. I Have Talent
  42. Dive into Python 3 Review
  43. Hot Django on WSGI Action (announcing django-wsgi)
  44. A New Home

2009 48

  1. A few thoughts on education
  2. A month in review
  3. You Built a Metaclass for *what*?
  4. Getting Started with Testing in Django
  5. Django and Python 3
  6. Why Meta.using was removed
  7. Just a Small Update
  8. Final Review of Python Essential Reference
  9. Filing a Good Ticket
  10. Using PLY for Parsing Without Using it for Lexing
  11. A Bit of Benchmarking
  12. Things College Taught me that the "Real World" Didn't
  13. Announcing django-admin-histograms
  14. Another Pair of Unladen Swallow Optimizations
  15. Writing a Lexer
  16. My Next Blog
  17. Initial Review: Python Essential Reference
  18. Why jQuery shouldn't be in the admin
  19. Syntax Matters
  20. Why I'm not very excited about Go
  21. When Django Fails? (A response)
  22. The State of MultiDB (in Django)
  23. Software that deserves a thank you
  24. Another Unladen Swallow Optimization
  25. My Workflow
  26. Towards a Better Template Tag Definition Syntax
  27. The Pycon Program Committee and my PyCon Talk
  28. Django's ManyToMany Refactoring
  29. Diving into Unladen Swallow's Optimizations
  30. Introduction to Unladen Swallow
  31. Another month of blogging?
  32. Optimising compilers are there so that you can be a better programmer
  33. Django-filter 0.5 released!
  34. pyvcs .2 released
  35. Announcing pyvcs, django-vcs, and piano-man
  36. A response to "Python sucks"
  37. EuroDjangoCon 2009
  38. Ajax Validation Aministrivia
  39. ORM Panel Recap
  40. PyCon Wrapup
  41. Google Moderator for PyCon ORM Panel
  42. Announcing django-filter
  43. A Second Look at Inheritance and Polymorphism with Django
  44. Building a Magic Manager
  45. Django Ajax Validation 0.1.0 Released
  46. Optimizing a View
  47. New Admin URLs
  48. 2008 and 2009

2008 35

  1. Building a Read Only Field in Django
  2. Building a Function Templatetag
  3. Many Thanks to Webfaction
  4. PyCon '09, Here I come!
  5. Playing with Polymorphism in Django
  6. A month in review
  7. A Few More Thoughts on the Identity Mapper
  8. Fixing up our identity mapper
  9. Building a simple identity map in Django
  10. Other ORM Goodies
  11. Some thoughts on Blogging
  12. What aggregates are going to look like
  13. Home Sweet Home
  14. A timeline view in Django
  15. A quick update
  16. Thinking about netbooks
  17. My Programming Language - Status Update
  18. Why I don't use easy_install
  19. Uncoupled code is good, but doesn't exist
  20. What Python learned from economics
  21. Running the Django Test Suite
  22. What I'm excited about in Django 1.1
  23. Python Things
  24. And now for the disclaimer
  25. Django Models - Digging a Little Deeper
  26. What software do I use?
  27. Getting Started With PLY - Part 3
  28. How the Heck do Django Models Work
  29. Getting Started With PLY - Part 2
  30. Getting Started With PLY
  31. That's not change we can believe in
  32. Building a Programming Language with Python
  33. PyGTK and Multiprocessing
  34. More Laziness with Foreign Keys
  35. Lazy User Foreign Keys