Post

thanks Github for unilaterally reclassifying the severity of this as "high" despite the fact that we went with "low" after much discussion <https://github.com/advisories/GHSA-3476-c5c2-fr73>

a bunch more of these are probably going to drop so I need to find ways to yell this from the rooftops more loudly: if your system is architected such that your availability depends entirely upon a *single-threaded protocol parser* running on a single core remains unblocked regardless of what […]

twisted is deficient here in several ways, chief among them that we do not ship a supervisor process that makes it easy for you to manage resource usage in multiple processes, or our own hardened internal load balancer. but the idea that "remote network traffic can cause memory allocation" (even […]

I hate how much work it is to operate internet-facing services these days too but for fuck's sake people you need to learn what watchdogs, ulimits, and load balancers are _before_ you expose something publicly. if you want to help the open source community sign up to actually add features that […]

every minute I spend thinking about this metrics-driven bullshit is a minute I am _not_ making any _substantive_ long-term improvements. and I'm mad _that_ I'm mad because it's actually great to get these as _regular bug reports_, allocations _should_ be bounded, I would like to gradually make […]

@glyph I never expose anything publicly. At least, not anymore.

@Perrin42 a lot of my infra doesn't have this type of protection and it's just… fine? I am not constantly under attack; if I were, I'd probably have to set up Cloudflare or whatever