Alex Kolovsky

dev from 2011

[Alex Kolovsky @kolovskydev]

@fayazara @CloudflareDev fwiw family blackholes malware domains too. the security resolver is the malware only one, diff the two if you want just the adult hits

[Alex Kolovsky @kolovskydev]

@RyanCarniato Their own table kinda says it. The client-only Vite preset drops 70%, the Next.js one barely moves. Once a framework is on top the runtime isn't the heavy part

[Alex Kolovsky @kolovskydev]

@taylorotwell every secret someone cats mid-debug is in a recording now, retention knob?

[Alex Kolovsky @kolovskydev]

@cramforce Right, so the CLI token in auth.json walks straight past it either way

that's the one a stealer actually lifts off a laptop

[Alex Kolovsky @kolovskydev]

@kettanaito yeah i'd just put continue-on-error on the artifact upload step, a flake there shouldn't get to cancel the actual tests

[Alex Kolovsky @kolovskydev]

@SheriefFYI iirc tcg only learned AVX2 in qemu 7.2, so a couple of years ago that workaround wouldn't even have been on the table

[Alex Kolovsky @kolovskydev]

@rakyll namespaces or a microvm underneath? that's the difference between an agent's mistakes staying contained and just staying tidy

[Alex Kolovsky @kolovskydev]

@AdamRackis STRICT tables fix the coercion half, text in an integer column errors instead of being stored

still nothing for scale though, money ends up as integer cents

[Alex Kolovsky @kolovskydev]

@jarredsumner does it do excess property checks or only the declared fields?

[Alex Kolovsky @kolovskydev]

@danluu The dictionary loader ones went to security@ first and got bounced

Tom's call was that a dictionary file is trusted input

[Alex Kolovsky @kolovskydev]

@RhysSullivan AWS doesn't fix the Railway failure mode if the keys still sit in env vars

Lambda decrypts those for you the same way, imo the key belongs in a secrets manager behind a role

[Alex Kolovsky @kolovskydev]

@yusukebe did memory drop too? the post claims 70% less than 7.0 at the same worker count

[Alex Kolovsky @kolovskydev]

@cramforce The WAF covers inbound only though, fetch in Node auto decompresses any reply marked br so an outbound call to a bad upstream hits the same decoder

[Alex Kolovsky @kolovskydev]

@RhysSullivan the newest one isn't even rust, vercel ported tsc back to typescript and compiled that, reportedly faster than the go port

[Alex Kolovsky @kolovskydev]

@EricParker Revoking is half of it, the email also says to review recent usage. From the reports the drain ran overnight so the bill is already there

[Alex Kolovsky @kolovskydev]

@shantanugoel Yeah, their email says the keys sat on a legacy system mid-decommission, so a per-key cap was the only control that would've held

[Alex Kolovsky @kolovskydev]

@JackEllis yep. and the google key had no business sitting in a file next to the deploy config in the first place

[Alex Kolovsky @kolovskydev]

@RhysSullivan Tbh that one isn't impossible, check then write with a demote landing in between is a textbook authz race

The model just can't tell rare from irrelevant

[Alex Kolovsky @kolovskydev]

@sweis base points for everything above P-192 are still open per the writeup, so one hat stays on