Nostr notes by yossarian

GitHub's macOS runners are unfortunately still vulnerable to ...

2026-10-28T05:09:39Z

GitHub's macOS runners are unfortunately still vulnerable to the eMudhra CA compromise, meaning that any TLS traffic that goes through the system Git, curl, etc. is MITMable.

(success in the CI matrix below means the runner made a TLS connection that it absolutely should not have.)

Apple appears to have rolled the eMudra distrust into their ...

2026-10-21T18:29:24Z

Apple appears to have rolled the eMudra distrust into their native root program, but **not** into `/etc/ssl/cert.pem`, meaning that macOS supplied tools like `curl` and the system Python are still affected by the compromised intermediates.

setting `CURL_SSL_BACKEND=secure-transport` redirects the system curl to the platform verifier, but it's not great that every macOS host is trivially MITM-able by default at the moment.

following PEP 833, Python packaging now considers the HTML index ...

2026-08-11T14:36:00Z

following PEP 833, Python packaging now considers the HTML index representation frozen!

I’m really happy we got this out: IMO it’s a small but very important step towards nudging clients to prefer the JSON index, which is better in every regard.

https://blog.pypi.org/posts/2026-08-11-html-index-is-frozen/

You shouldn’t trust Trusted Publishing ...

2026-07-07T12:58:23Z

You shouldn’t trust Trusted Publishing

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

#python #security #oss

TIL: Some surprising numeric conversions in Python ...

2026-06-29T14:28:17Z

TIL: Some surprising numeric conversions in Python

https://yossarian.net/til/post/some-surprising-numeric-conversions-in-python

#til #python

it's not pull_request_target there's no way it's ...

2026-05-12T12:48:56Z

it's not pull_request_target

there's no way it's pull_request_target

it was pull_request_target

Bypassing GitHub Actions policies in the dumbest way possible ...

2025-06-11T14:02:20Z

Bypassing GitHub Actions policies in the dumbest way possible

https://blog.yossarian.net/2025/06/11/github-actions-policies-dumb-bypass

#security

npm is getting trusted publishing soon! ...

2025-05-30T18:28:42Z

npm is getting trusted publishing soon!

https://github.com/orgs/community/discussions/161015

helping build and design the original version of trusted publishing for PyPI is easily in the top 3 moments of my career so far -- it's really amazing to see it get adopted by RubyGems, Rust (in progress), and now the JS ecosystem.

(to be clear, it seems like a reasonable technical response to ...

2025-05-15T17:44:24Z

In reply to nevent1q…q4he
_________________________

(to be clear, it seems like a reasonable technical response to what's happening to them re: LLM spam. but it's equally clear to me that MSFT is in a large part responsible for this situation, and seems more willing to implode their position of trust/responsibility within the OSS community than admit that the current wave of LLM chum might not actually be the best thing in the world)

this ratelimiting stuff with GitHub makes me really think that ...

2025-05-15T17:42:24Z

this ratelimiting stuff with GitHub makes me really think that MSFT might actually successfully kill their golden goose

trust arrives on foot and leaves on horseback, etc

i have this nagging feeling that a lot of second-order content ...

2025-05-05T16:18:53Z

i have this nagging feeling that a lot of second-order content (podcasts, newsletters) in the infosec world is undergoing a marked, visible decline in quality as creators rely more and more on LLMs to summarize and editorialize their subjects

my colleague @npub1t27…slmr has put out a new post on the ...

2025-05-01T13:35:31Z

my colleague dm (npub1t27…slmr) has put out a new post on the Trail of Bits (npub1rcs…7sw8) blog on how we worked with Python Package Index (npub1g52…8fy6)'s maintainers to slash PyPI test run times from ~160s to ~30s despite overall test counts growing by 17% (3900 to 4700+):

https://blog.trailofbits.com/2025/05/01/making-pypis-test-suite-81-faster/

this is some of my favorite kind of work: faster test suites means that developers run tests locally more often, and are less hesitant to add new tests (especially parametric ones). another great example of security and performance/reliability engineering dovetailing.

#opensource #security #python

i'm very excited about this new work my team at ...

2025-04-18T14:14:38Z

i'm very excited about this new work my team at Trail of Bits (npub1rcs…7sw8) is doing: we're building an ASN.1 API for PyCA Cryptography, giving users direct access to the same memory-safe, high-performance DER parser that Cryptography already uses for X.509:

https://blog.trailofbits.com/2025/04/18/sneak-peek-a-new-asn.1-api-for-python/

awesome feature, thanks meet team ...

2025-04-08T15:45:32Z

awesome feature, thanks meet team

my colleagues Alexis and Brad at @npub1rcs…7sw8 put together a ...

2025-02-21T18:44:10Z

my colleagues Alexis and Brad at Trail of Bits (npub1rcs…7sw8) put together a great post on a basic security mistake that we keep making: attacker-controlled recursion. my favorite thing about these is that they're (1) trivial to find and (2) *way* more impactful than normal DoS spam.

the post contains some great examples of these, including real vulnerabilities in Protobuf and ElasticSearch:

https://blog.trailofbits.com/2025/02/21/dont-recurse-on-untrusted-input/

they'll also be presenting their findings at DistrictCon (npub14f6…c7y5) tomorrow!

https://www.districtcon.org/bios-and-talks-2025/low-effort-dos-with-recursion

don't talk to me or my son ever again ...

2025-01-28T16:35:58Z

don't talk to me or my son ever again

there are only two scenarios in which you make that gesture with ...

2025-01-20T23:55:59Z

there are only two scenarios in which you make that gesture with your hand: either you are completely bereft of knowledge of what a nazi salute is, or you’re intentionally doing a nazi salute to send a message. I find it impossible to believe that the world’s wealthiest and most pathetically online man does not know what a nazi salute is.

hi all, i'm doing another round of donations this year. ...

2024-12-26T16:44:03Z

hi all, i'm doing another round of donations this year.

i'll match up to $2000 total and my company will match up to another $2000, so matching me will get your donation tripled.

here are some of the organizations i'm supporting:

* Anera: https://www.anera.org/ -- food and relief in Palestine, Lebanon, and Jordan
* HIAS: https://hias.org/ -- resettlement and support for immigrants around the word
* ProPublica: https://www.propublica.org/ -- investigative journalism in the public interest
* Python Software Foundation: https://www.python.org/psf-landing/ -- financially hosts and supports the development of Python

send me your donation receipt, and i'll send you a matching one (public or private, your choice!)

just had an interesting realization: one of the reasons people ...

2024-12-16T19:05:05Z

just had an interesting realization: one of the reasons people struggle to understand template injection in GHA is probably because lines like this:

```
echo "hello: ${{ expr }}"
```

...get lexed mentally as "variable expansion, followed by Jinja template."

in other words, people think the `$` comes from the shell and the `{{ }}` is the template syntax, and therefore the entire thing is quoted correctly.

in reality of course the entire `${{ .. }}` is template syntax, and has nothing to do with shell quoting/expansion rules. but `$` is mentally overloaded!

i wonder how much easier this would be to teach people if GitHub had chosen `@{{ ... }}` or even just `{{ }}` as their template syntax instead.

#security #opensource

drinking coffee from a coffee mug: * boring, played out * visible ...

2024-12-05T16:54:41Z

drinking coffee from a coffee mug:

* boring, played out
* visible caffeine dependency

drinking coffee from a ceramic berliner kindl stein:

* coffee stays extra warm
* extra large for more coffee
* keeps coworkers on their toes

Security means securing people where they are ...

2024-11-18T15:42:47Z

Security means securing people where they are

https://blog.yossarian.net/2024/11/18/Security-means-securing-people-where-they-are

#security #oss