The Curious Engineer

All blogs / Security

ENOSUCHBLOG

blog.yossarian.net

Programming, philosophy, pedaling.

SecurityPythonDevOps / SRE / infrastructureGo

’15’16’17’18’19’20’21’22’23’24’25’26
Posts
208 from 10 Feb 2015 to 31 Aug 2026
Posting
monthly (10 in the last year)
Kind
personal blog
Feed
https://blog.yossarian.net/feed.xml
Also at
https://yossarian.net/

2026 7

  1. Introducing vulnbrocards.com
  2. Running for the Python Packaging Council
  3. GitHub Actions needs OIDC audience constraints
  4. README, not
  5. You shouldn’t trust Trusted Publishing
  6. Registering my dissatisfaction with GitHub
  7. Brocards for vulnerability triage

2025 11

  1. Some flexibility with Go’s sumdb
  2. Dependency cooldowns, redux
  3. We should all be using dependency cooldowns
  4. Sep 22 - Dear GitHub: no YAML anchors, please
  5. Sep 14 - One year of zizmor
  6. Aug 14 - Fun with finite state transducers
  7. Jun 17 - A new adventure
  8. Jun 11 - Bypassing GitHub Actions policies in the dumbest way possible
  9. May 7 - A Discord server and new GitHub organization for zizmor
  10. Jan 10 - Be aware of the Makefile effect
  11. Jan 2 - zizmor 1.0

2024 11

  1. Dec 6 - zizmor would have caught the Ultralytics workflow vulnerability
  2. Nov 18 - Security means securing people where they are
  3. Oct 27 - Introducing zizmor: now you can have beautiful clean workflows
  4. Sep 10 - YAML feature extraction with yamlpath
  5. Aug 18 - Tracking and publishing my TILs
  6. Aug 12 - Approximating sum types in Python with Pydantic
  7. Jun 12 - Python wheel filenames have no canonical form
  8. Apr 30 - Reducing my blogging cadence
  9. Mar 20 - More thoughts on vulnerabilities and misaligned incentives
  10. Feb 26 - High-quality Rust data models for GitHub Actions
  11. Jan 23 - A new release of ff2mpv

2023 13

  1. Dec 24 - You don't need analytics on your blog
  2. Nov 19 - Function interposition in Rust with upgrayedd
  3. Oct 18 - Some concerns with OpenPubKey
  4. Sep 22 - GitHub Actions could be so much better
  5. Aug 20 - Two quick hacks for laptop in-flight Delta Wi-Fi with T-Mobile
  6. Jul 27 - Introducing shaq, a CLI for Shazam
  7. Jul 16 - Looking for additional maintainers on a few projects
  8. Jun 27 - Software-defined (Internet) radio with Liquidsoap
  9. May 21 - PGP signatures on PyPI: worse than useless
  10. Apr 14 - Introducing pgpkeydump
  11. Mar 20 - Introducing awair-local-api.rs
  12. Feb 11 - The unsafe language doom principle
  13. Jan 9 - A few small PulseAudio configuration tricks

2022 14

  1. Dec 28 - ReDoS "vulnerabilities" and misaligned incentives
  2. Dec 14 - Going write-only on Twitter (and introducing autopost)
  3. Nov 7 - Modernizing my 1980s sound system
  4. Oct 4 - This blog is now automatically deployed
  5. Sep 14 - Tornado Cash and bullets
  6. Aug 20 - Why don't we do email verification in reverse?
  7. Jul 25 - age encryption in Python with pyrage
  8. Jun 29 - kbs2 0.6.x
  9. May 9 - A most vexing parse, but for Python packaging
  10. Apr 30 - LLVM internals, part 5: a very brief update
  11. Mar 10 - Things I hate about Rust, redux
  12. Feb 21 - Enjoying music curation again
  13. Feb 2 - Setting up Navidrome with Nginx as a reverse proxy
  14. Jan 23 - ff2mpv now supports Chromium-based browsers

2021 13

  1. Dec 12 - Calculating my open source blast radius
  2. Dec 5 - Blockchains don't solve problems that are interesting to me
  3. Nov 29 - LLVM internals, part 4: attributes and attribute groups
  4. Oct 25 - A small DOCUMERICA Twitter bot
  5. Sep 14 - LLVM internals, part 3: from bitcode to IR
  6. Aug 10 - LLVM internals, part 2: parsing the bitstream
  7. Jul 19 - LLVM internals, part 1: the bitcode format
  8. Jun 1 - Playing with Apple's weird compression formats
  9. May 3 - kbs2 0.3.x
  10. Apr 13 - Tools that I want
  11. Mar 16 - totally_safe_transmute, line-by-line
  12. Feb 28 - Weird architectures weren't supported to begin with
  13. Jan 21 - Introducing usb-ids.rs

2020 20

  1. Dec 24 - A few HiDPI tricks for Linux
  2. Dec 16 - Static calls in Linux 5.10
  3. Dec 6 - kbs2 0.2.x
  4. Nov 30 - How many registers does an x86-64 CPU have?
  5. Nov 5 - Towards an automated changelog workflow
  6. Oct 23 - Understanding static single assignment forms
  7. Sep 19 - LLVM's getelementptr, by example
  8. Aug 16 - Hiding messages in x86 binaries using semantic duals
  9. Aug 2 - Writing and publishing a Python module in Rust
  10. Jul 18 - kbs2 0.1.x
  11. Jun 20 - Goodbye KBSecret, hello kbs2
  12. Jun 13 - How x86_64 addresses memory
  13. Jun 3 - You may not use my projects in a military or law enforcement context
  14. May 20 - Things I hate about Rust
  15. May 7 - Locating a compiler bug with git bisection
  16. Apr 12 - Developing an intuition for soundness and completeness
  17. Mar 9 - Implementing the Clipper chip cipher in Rust
  18. Mar 2 - Totally ordered enums in Python with ordered_enum
  19. Feb 3 - Finding treacherous encoding permutations with baseperm
  20. Jan 23 - Anybody can write good bash (with a little effort)

2019 13

  1. Dec 25 - A (shallow) dive into the American banking system
  2. Nov 2 - Hacktoberfest Wrapup
  3. Oct 23 - Flexible Travis CI stages with YAML references
  4. Sep 26 - Introducing llvm-passgen
  5. Aug 18 - Introducing cazart
  6. Aug 10 - Exploring Square's S6 reader at DEF CON
  7. Jul 24 - Reasoning about faithless actors with undercutting semantics
  8. Jun 9 - Pipelines in Ruby with Open3
  9. May 18 - Basic disassembly with libopcodes
  10. Apr 23 - Make is (probably) fine
  11. Mar 7 - Self-encrypted mail in NeoMutt (with GPGme)
  12. Feb 23 - Thoughts on Perpetual Peace
  13. Jan 20 - General Project Updates and Thanks

2018 27

  1. Dec 18 - Kernelspace syscall interception, or: How to write a rootkit without really trying
  2. Nov 11 - Scanning the .nyc gTLD
  3. Oct 10 - Introducing netstring.cr
  4. Oct 3 - A Month of Robocalls
  5. Sep 20 - Kant, Happiness, Moral Worthiness
  6. Sep 1 - yossarian.net now supports IPv6!
  7. Aug 25 - Introducing bindef, a DSL for defining binary files
  8. Aug 20 - Disagreement: Language and Metalanguage
  9. Jul 5 - ruby-macho 2.0.0
  10. Jun 18 - Introducing notify.cr
  11. May 26 - How many GDPR notices did I get?
  12. May 14 - Introducing abbrev.cr
  13. May 8 - CMSC389R: A Wrapup
  14. May 5 - How I Write
  15. Apr 27 - KBSecret 1.6.x
  16. Apr 8 - Introducing qrencode.cr
  17. Apr 4 - KBSecret 1.3.x
  18. Apr 1 - Code coverage with SimpleCov across multiple processes
  19. Mar 26 - Thoughts on building better (online) communities
  20. Mar 24 - What does Facebook have on me?
  21. Mar 15 - blog.yossarian.net is now self-hosted
  22. Mar 3 - Moral Worth in Arpaly's Philanthropic Cases, from a Kantian Perspective
  23. Feb 10 - KBSecret has a new website
  24. Jan 22 - Reading Manpages Like a Pro
  25. Jan 17 - KBSecret 1.0
  26. Jan 6 - Introducing i3.cr
  27. Jan 3 - Megabus: A Study in Guessability

2017 31

  1. Dec 30 - Introducing x_do.cr
  2. Dec 18 - Installing Pi-hole on a Pi
  3. Dec 11 - KBSecret 0.9.x: Many, Many Things
  4. Nov 27 - Announcing CMSC389R — "Introduction to Ethical Hacking"
  5. Nov 21 - The Zone of Indifference Should be Pretty Small
  6. Nov 1 - Hacktoberfest Wrapup
  7. Oct 26 - Keybase on the CI
  8. Oct 17 - Thoughts on Thoughts on Motive
  9. Oct 3 - A Programmer's Programmer
  10. Sep 5 - Philosophy Summarized: The Euthyphro Dilemma
  11. Aug 18 - KBSecret has a website now
  12. Jul 21 - Introducing ruby-inih
  13. Jul 19 - KBSecret 0.7.x: Secret Generators, Internal Fields, and Session Notifications
  14. Jul 5 - KBSecret 0.6.x: Sensitive Fields, Error Handling, and DRYer Sessions
  15. Jun 28 - Spotify is (Still) Violating CAN-SPAM
  16. Jun 25 - Fragments, 1
  17. Jun 23 - KBSecret 0.5.x: Packages, Typed Arguments, and More
  18. Jun 7 - KBSecret is Maturing
  19. May 30 - One Month with the Pebble Time
  20. May 16 - Is Stasis Possible?
  21. May 5 - Cleaner Function Wrapping in C
  22. Apr 27 - Team Photos are Here
  23. Apr 24 - Proxying ZNC Without a Subdomain
  24. Apr 16 - Task Management with kbsecret
  25. Apr 8 - Augmenting my Workflow with kbsecret
  26. Apr 5 - Ballad of a D Racer
  27. Mar 5 - Random Mosaics with ffmpeg and Ruby
  28. Feb 2 - Thoughts on Aristotelian Determinism and Future Contingents
  29. Jan 22 - Mini-post: New Domain and More
  30. Jan 16 - Mini-post: Introducing ruby-mpv
  31. Jan 2 - Muzak, Week 5

2016 19

  1. Dec 25 - Muzak, Week 4
  2. Dec 19 - Muzak, Week 3
  3. Dec 12 - Muzak, Week 2
  4. Dec 5 - Muzak, Week 1
  5. Nov 29 - Introducing Muzak - A "Metamusic" Player
  6. Oct 15 - Mini-post: Switching to i3 on Ubuntu
  7. Oct 7 - Decoding the MetroCard, Part 2.5: Early Results
  8. Aug 20 - State of ruby-macho, GSoC 2016 Wrap-Up Edition
  9. Aug 13 - State of ruby-macho, Weeks of 8/1 and 8/8
  10. Jul 31 - State of ruby-macho, Weeks of 7/11, 7/18 and 7/25
  11. Jul 17 - Decoding the MetroCard, Part 2: Research and Past Attempts
  12. Jul 7 - State of ruby-macho, Weeks of 6/27 and 7/4
  13. Jun 26 - State of ruby-macho, Weeks of 6/13 and 6/20
  14. Jun 12 - State of ruby-macho, Weeks of 5/30 and 6/6
  15. May 18 - Neat Things I've Found This Week
  16. May 13 - Moving woodruffw.us to Let's Encrypt
  17. Mar 13 - My School Wants My Palm Print
  18. Feb 13 - An rwx Theory of Programming Languages
  19. Jan 20 - Mini post: Testing Out Multiprocess Firefox

2015 29

  1. Dec 29 - Thoughts on the "Universality" of Consciousness
  2. Dec 19 - Analyzing UMD Arrest Data
  3. Dec 7 - Mini-post: Abusing to_s for Brevity in Ruby
  4. Nov 9 - Mini rant: Emoji and Git
  5. Nov 1 - Session Management in Sublime Text
  6. Oct 5 - Death To Clickers
  7. Sep 28 - Five Things I Hate About Ruby
  8. Sep 1 - Thoughts on Motive
  9. Aug 23 - A Week On Dialup
  10. Aug 13 - String Formatting With Ruby Dynamic Hashes
  11. Jul 22 - The Dismal State of HTML
  12. Jul 14 - Abusing Signals for Shell Synchronization
  13. Jul 2 - CAN-SPAM Compliance is Important
  14. Jun 29 - Mini-post: Glitch Art with RMagick
  15. Jun 24 - Decoding the Metrocard, Part 1: Introduction and History
  16. Jun 9 - Mini-post: Dates That Don't Exist
  17. May 28 - IRC Phishing with Typosquatting
  18. May 8 - The 'Death' of IRC
  19. Apr 26 - Administrivia: RSS and Google Analytics
  20. Apr 23 - Mini-post: More Power User Tools
  21. Apr 6 - Amazon Dash: Those Who Cannot Remember The Past...
  22. Apr 2 - Mini-post: Digraphs and Trigraphs
  23. Mar 20 - Identifying and Enumerating IRC bots with IBIP
  24. Mar 14 - Who Needs Toolkits When You Have Xlib?
  25. Mar 9 - Mini-post: Introduction to Pointers
  26. Mar 3 - Paste Scraping: Lessons (Not) Learned
  27. Feb 27 - The Problem with $PATH
  28. Feb 18 - Mini-post: ++x++
  29. Feb 10 - Configuration for Fun and Profit