yossarian

open source interloper; attracts bugs easily

אַ ביסל ייִדיש־פּאָסטינג

website: https://yossarian.net
blog: https://blog.yossarian.net
github: https://github.com/woodruffw
bluesky: https://bsky.app/profile/yossarian.net
OID: 1.3.6.1.4.1.55738

Public Key

npub1cgn080uwn73neyld4lnq878uw6t42aelpkmgtu8xzax2j6lhcxqss95g53

NIP-05 Address

yossarian_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsvyfhnh78flgeuj0k6lesrlr78d964wulsmd597rnpwn9fd0murqgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy8hwumn8ghj7mn0wd68ytnwdams94q7pm

Publishing to

relay.momostr.pink

nostr.now

relay.primal.net

Author Public Key

npub1cgn080uwn73neyld4lnq878uw6t42aelpkmgtu8xzax2j6lhcxqss95g53

Show more details

Last Notes

2026-10-28 05:09:39 UTC

GitHub's macOS runners are unfortunately still vulnerable to the eMudhra CA compromise, meaning that any TLS traffic that goes through the system Git, curl, etc. is MITMable.
(success in the CI matrix below means the runner made a TLS connection that it absolutely should not have.)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/516/803/602/417/463/original/94fd4442e176a1c0.png

2026-10-21 18:29:24 UTC

Apple appears to have rolled the eMudra distrust into their native root program, but **not** into `/etc/ssl/cert.pem`, meaning that macOS supplied tools like `curl` and the system Python are still affected by the compromised intermediates.
setting `CURL_SSL_BACKEND=secure-transport` redirects the system curl to the platform verifier, but it's not great that every macOS host is trivially MITM-able by default at the moment.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/480/312/069/146/810/original/3681f6fafe82e27a.png

2026-08-11 14:36:00 UTC

following PEP 833, Python packaging now considers the HTML index representation frozen!
I’m really happy we got this out: IMO it’s a small but very important step towards nudging clients to prefer the JSON index, which is better in every regard.
https://blog.pypi.org/posts/2026-08-11-html-index-is-frozen/

2026-07-07 12:58:23 UTC

You shouldn’t trust Trusted Publishing
https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing
#python #security #oss

2026-06-29 14:28:17 UTC

TIL: Some surprising numeric conversions in Python
https://yossarian.net/til/post/some-surprising-numeric-conversions-in-python
#til #python

2026-05-12 12:48:56 UTC

it's not pull_request_target
there's no way it's pull_request_target
it was pull_request_target

2025-06-11 14:02:20 UTC

Bypassing GitHub Actions policies in the dumbest way possible
https://blog.yossarian.net/2025/06/11/github-actions-policies-dumb-bypass
#security

2025-05-30 18:28:42 UTC

npm is getting trusted publishing soon!
https://github.com/orgs/community/discussions/161015
helping build and design the original version of trusted publishing for PyPI is easily in the top 3 moments of my career so far -- it's really amazing to see it get adopted by RubyGems, Rust (in progress), and now the JS ecosystem.

2025-05-15 17:44:24 UTC

- reply

(to be clear, it seems like a reasonable technical response to what's happening to them re: LLM spam. but it's equally clear to me that MSFT is in a large part responsible for this situation, and seems more willing to implode their position of trust/responsibility within the OSS community than admit that the current wave of LLM chum might not actually be the best thing in the world)

2025-05-15 17:42:24 UTC

this ratelimiting stuff with GitHub makes me really think that MSFT might actually successfully kill their golden goose
trust arrives on foot and leaves on horseback, etc

2025-05-05 16:18:53 UTC

i have this nagging feeling that a lot of second-order content (podcasts, newsletters) in the infosec world is undergoing a marked, visible decline in quality as creators rely more and more on LLMs to summarize and editorialize their subjects

2025-05-01 13:35:31 UTC

my colleague @npub1t27…slmr has put out a new post on the @npub1rcs…7sw8 blog on how we worked with @npub1g52…8fy6's maintainers to slash PyPI test run times from ~160s to ~30s despite overall test counts growing by 17% (3900 to 4700+):
https://blog.trailofbits.com/2025/05/01/making-pypis-test-suite-81-faster/
this is some of my favorite kind of work: faster test suites means that developers run tests locally more often, and are less hesitant to add new tests (especially parametric ones). another great example of security and performance/reliability engineering dovetailing.
#opensource #security #python

2025-04-18 14:14:38 UTC

i'm very excited about this new work my team at @npub1rcs…7sw8 is doing: we're building an ASN.1 API for PyCA Cryptography, giving users direct access to the same memory-safe, high-performance DER parser that Cryptography already uses for X.509:
https://blog.trailofbits.com/2025/04/18/sneak-peek-a-new-asn.1-api-for-python/

2025-04-08 15:45:32 UTC

awesome feature, thanks meet team
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/303/084/551/165/453/original/4ab741575b902236.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/303/085/751/079/358/original/3cb813ad655ac1e8.png

2025-02-21 18:44:10 UTC

my colleagues Alexis and Brad at @npub1rcs…7sw8 put together a great post on a basic security mistake that we keep making: attacker-controlled recursion. my favorite thing about these is that they're (1) trivial to find and (2) *way* more impactful than normal DoS spam.
the post contains some great examples of these, including real vulnerabilities in Protobuf and ElasticSearch:
https://blog.trailofbits.com/2025/02/21/dont-recurse-on-untrusted-input/
they'll also be presenting their findings at @npub14f6…c7y5 tomorrow!
https://www.districtcon.org/bios-and-talks-2025/low-effort-dos-with-recursion

2025-01-28 16:35:58 UTC

don't talk to me or my son ever again
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/906/948/768/073/251/original/190eed2d5857f663.png

2025-01-20 23:55:59 UTC

there are only two scenarios in which you make that gesture with your hand: either you are completely bereft of knowledge of what a nazi salute is, or you’re intentionally doing a nazi salute to send a message. I find it impossible to believe that the world’s wealthiest and most pathetically online man does not know what a nazi salute is.

2024-12-26 16:44:03 UTC

hi all, i'm doing another round of donations this year.
i'll match up to $2000 total and my company will match up to another $2000, so matching me will get your donation tripled.
here are some of the organizations i'm supporting:
* Anera: https://www.anera.org/ -- food and relief in Palestine, Lebanon, and Jordan
* HIAS: https://hias.org/ -- resettlement and support for immigrants around the word
* ProPublica: https://www.propublica.org/ -- investigative journalism in the public interest
* Python Software Foundation: https://www.python.org/psf-landing/ -- financially hosts and supports the development of Python
send me your donation receipt, and i'll send you a matching one (public or private, your choice!)

2024-12-16 19:05:05 UTC

just had an interesting realization: one of the reasons people struggle to understand template injection in GHA is probably because lines like this:
```
echo "hello: ${{ expr }}"
```
...get lexed mentally as "variable expansion, followed by Jinja template."
in other words, people think the `$` comes from the shell and the `{{ }}` is the template syntax, and therefore the entire thing is quoted correctly.
in reality of course the entire `${{ .. }}` is template syntax, and has nothing to do with shell quoting/expansion rules. but `$` is mentally overloaded!
i wonder how much easier this would be to teach people if GitHub had chosen `@{{ ... }}` or even just `{{ }}` as their template syntax instead.
#security #opensource

2024-12-05 16:54:41 UTC

drinking coffee from a coffee mug:
* boring, played out
* visible caffeine dependency
drinking coffee from a ceramic berliner kindl stein:
* coffee stays extra warm
* extra large for more coffee
* keeps coworkers on their toes

2024-11-18 15:42:47 UTC

Security means securing people where they are
https://blog.yossarian.net/2024/11/18/Security-means-securing-people-where-they-are
#security #oss