Tom Forbes

Most-linked posts?

1. XPath injection issues are severely underrated
   3 people · 5 mentions · first linked 2018-12-10
2. Just How Slow are Django Templates?
   3 people · 3 mentions · first linked 2013-03-13
3. CVE-2022-0329 and the problems with automated vulnerability management
   2 people · 4 mentions · first linked 2022-01-29
4. I scanned every package on PyPI and found 57 live AWS keys
   2 people · 3 mentions · first linked 2023-01-06
5. Visualizing how S3 deletes 1B objects with Athena and Rust
   2 people · 3 mentions · first linked 2022-09-15
6. Breaking out of secured Python environments
   2 people · 2 mentions · first linked 2013-09-25
7. Counting Pizza with Python
   2 people · 2 mentions · first linked 2016-08-28
8. Automatically inline Python function calls
   2 people · 2 mentions · first linked 2013-08-07
9. AWS may have broken your CloudFront API for nearly a month
   2 people · 2 mentions · first linked 2022-11-21

What Hacker News says?

1. orf · 2019-05-01

   I found something similar to this a few years back[1], where the daemon would download and run anything if just “dell” was in the referring host. It seems they have improved the security somewhat by using white lists, but their coding practices seem a bit shoddy. Why have an SDK token at all if it’s public and globally shared? I wouldn’t be surprised if a lot of the code was shared between the previous incarnation t…

   Comment linking /dell-system-detect-rce-vulnerability/

   on “Remote Code Execution on Most Dell Computers”
2. orf · 2022-11-16

   Submitted Infosys leaked FullAdminAccess AWS keys on PyPI for over a year as a story · 502 points

   HN discussion
3. orf · 2018-06-20

   This is how the Dell system detect utility worked. Back in the day I found out that they only checked if the referring domain ended with dell.com, so 'notdell.com' passed their validation[1]. Instant easy unstoppable root RCE on a lot of dell machines from any website (it was a get request as well if I remember correctly). No built in auto update, no system tray icon, no idea if it's running. Good times. I found som…

   Comment linking /hp-support-solutions-framework-security-issue

   on “Certificates for localhost”
4. orf · 2021-05-18

   Submitted Dear Apple, I don't want your god-damn lossless audio as a story · 66 points

   HN discussion
5. orf · 2024-04-24

   Back in 2015 I discovered a security issue with some Dell software[1]. I remember vividly getting an email about a job opportunity based entirely on this from a company with a strange name, that after some googling made a thing called Vagrant. They seemed super nice but I was far too young and immature to properly evaluate the opportunity, so after a few emails I ghosted them out of fear of the unknown. In 2015 they…

   Comment linking /blog/dell-system-detect-rce-vulnerability/

   on “IBM to buy HashiCorp in $6.4B deal”
6. orf · 2016-03-07

   Submitted Segfaulting Python with afl-fuzz as a story · 48 points

   HN discussion
7. greysteil · 2022-02-26

   Ha! Well, there's a lot. On major strand is more work like this to make it easy for the community to collaborate. I expect we'll make a lot of iterative improvements to the database over the next few months, aimed at making it easier to contribute to, maintain and use. We need to improve our APIs for this data, for example (currently only available via GraphQL). Another big one that we're starting to think about is…

   Comment linking /cve-2022-0329-and-the-problems-with-automated-vulnerability-management/

   on “GitHub’s database of security advisories is now open source”
8. albertzeyer · 2013-08-07

   Submitted Automatically inline Python function calls as a story · 46 points

   HN discussion
9. Orf_ · 2012-06-07

   I wrote my own to use SQLAlchemy models you define: http://tomforb.es/using-a-custom-sqlalchemy-users-model-with... Its really not that bad or hard to do at all.

   Comment linking /using-a-custom-sqlalchemy-users-model-with-django

   on “Why Django Sucks”
10. orf · 2013-10-14

    Submitted Purchasing a £30,000 numberplate for the price of a bus ticket as a story · 44 points

    HN discussion
11. orf · 2016-01-25

    Import hooks are awesome, one of the cool things you can do is re-write the code as you load it. I made a toy loader that automagically inlines (some) Python function calls[1]. There are also cool projects like MacroPy[2] that do much more extensive things. 1. https://tomforb.es/automatically-inline-python-function-call... 2. https://github.com/lihaoyi/macropy

    Comment linking /automatically-inline-python-function-calls

    on “Use JSON files as if they are Python modules”
12. orf · 2014-02-13

    Submitted Opera is really nice. as a story · 35 points

    HN discussion
13. orf · 2018-03-17

    I experimented with something similar to this way back[1], but took a slightly different approach - you can replace the reference to the function itself inside the function with a new function[2], one that returns a 'Recurse' object. That way it looks like it's calling the original method but really it's doing your own thing. 1. https://tomforb.es/adding-tail-call-optimization-to-python/ 2. https://gist.github.com/o…

    Comment linking /adding-tail-call-optimization-to-python/

    on “Tail recursion in Python”
14. mooreds · 2022-09-19

    Submitted Visualizing how S3 deletes 1B objects with Athena and Rust as a story · 25 points

    HN discussion
15. orf · 2014-06-27

    I used to love Django, but after using it for a couple of years I've got a bit sick of it. The template language is horrible, as is the ORM. It's only redeeming features is the forms framework (only just) and the admin panel. That being said, it's super-awesome for getting a quick demo up or starting a project with unclear requirements. Edit: Why the downvotes? The templates are slow[1] and restrictive (no function…

    Comment linking /just-how-slow-are-django-templates

    on “Django 1.7 RC1”
16. orf · 2022-01-29

    Submitted CVE-2022-0329 and the problems with automated vulnerability management as a story · 21 points

    HN discussion
17. petters · 2020-11-01

    I thought XPath was terrible beyond 1.0? E.g. https://tomforb.es/xcat-1.0-released-or-xpath-injection-issu... But it does not seem to be mentioned as an argument.

    Comment linking /xcat-1.0-released-or-xpath-injection-issues-are-severely-underrated/

    on “Chrome unlikely to support XPath 3.1”
18. m0th87 · 2013-09-25

    Submitted Breaking out of secured Python environments as a story · 11 points

    HN discussion
19. orf · 2020-10-30

    XPath post 1.0 got ridiculous, like many things do. What started with a simple, elegant language morphed into one with a http client, filesystem methods, json support, functions, loops, extensions and the ability to read environment variables. I wrote a post about it a while back[1] (I regret some of the wording used there) and maintain a tool[2] that can exploit XPath injection issues. I'd recommend sticking with 1…

    Comment linking /xcat-1.0-released-or-xpath-injection-issues-are-severely-underrated/

    on “What Happened to XPath?”
20. orf · 2023-01-06

    Submitted I scanned every package on PyPI and found 57 live AWS keys as a story · 10 points

    HN discussion
21. orf · 2019-12-19

    I did this a while back: https://tomforb.es/segfaulting-python-with-afl-fuzz/ CPython bytecode will segfault Python if it’s slightly incorrect. And that’s fine, it’s not a security risk and it’s not worth the performance overhead of validating wonky bytecode.

    Comment linking /segfaulting-python-with-afl-fuzz/

    on “Make CPython segfault in 5 lines of code”
22. orf · 2015-03-23

    Submitted Dell Does a SuperFish: Exploiting Dell Service Tag Detector as a story · 10 points

    HN discussion
23. orf · 2014-09-07

    Very interesting read, I did something similar[1] on a Microsoft site. I didn't think of creating a code object from scratch though, great idea. I did a web app test once for an application created by IBM. They offered the ability for administrators to run Python code in a 'restricted' sandbox to manipulate data. The app was Java so it was run through Jython, and they locked down all the usual suspects like open(),…

    Comment linking /breaking-out-of-secured-python-environments

    on “Bypassing a Python sandbox by abusing code objects”
24. orf · 2013-10-02

    Submitted Breaking out of secured Python environments as a story · 9 points

    HN discussion
25. barosl · 2015-06-16

    This is certainly an interesting idea. A quick Google search gave me this toy example: [1][2] Of course making it work for all cases would be very hard due to the excessive dynamism of Python, but for simple arithmetic operations it could be made to work fairly well. [1] http://tomforb.es/automatically-inline-python-function-calls [2] https://github.com/orf/inliner

    Comment linking /automatically-inline-python-function-calls

    on “Python's Web Framework Benchmarks”
26. orf · 2015-03-25

    Submitted If (url.contains(“dell”)), or how not to secure your software as a story · 6 points

    HN discussion
27. orf · 2017-02-27

    Funny this comes up! Dominoes used to use a single integer ID per order, and I wrote a tool to find out how many orders they process each day[1]. After contacting them (and receiving no reply!) they switched to a proper implementation involving GUID's. Good work though, I had no idea the dominoes USA website lets you just enter a phone number to get order details. That's pretty poor 1. http://tomforb.es/counting-piz…

    Comment linking /counting-pizza-with-python

    on “I wrote a program that emails me when one of my friends orders Domino's”
28. orf · 2019-12-15

    Submitted Distributing malware with Google images, service workers and vegan Twitter bots as a story · 5 points

    HN discussion
29. orf · 2014-09-18

    I'm really impressed, PyPi only has about 37,000 packages[1] and it has been around for much longer. Really shows how far Node has come. It would also be interesting to see the average number of lines each package has. 1. http://tomforb.es/how-much-code-is-there-in-the-python-packa...

    Comment linking /how-much-code-is-there-in-the-python-package-index

    on “NPM registry in numbers”
30. orf · 2018-12-16

    Submitted XPath injection issues are severely underrated as a story · 4 points

    HN discussion

Search all of HN for tomforb.es