The vhost ffuf missed
First HTB writeup, an easy box where the automated vhost enum returned clean and a ten-line bash loop found the LocalStack S3.
blog
writeups, notes, journal
7 entries · sorted desc by date
Why release-please went quiet on my first tag
Three traps adopting release-please on a Python repo — bootstrap-sha, package-name, and the trigger that never fires. Each fix is a one-line config delete or a workflow restructure.
Jekyll, Ruby 4, and a `tainted?` that isn't anymore
How `github-pages` pinned me to a Liquid that bit-rotted, and why the fix was to drop the gem entirely and build with GitHub Actions.
Authentication doesn't belong on the sticker
How the DockPulse adoption QR went from a COSE_Sign1 Ed25519 claim at version 17 down to plain SERIAL:HEX at version 3. The smaller QR was a side effect — the actual fix was that the signature was in the wrong place.
No CRL, just 90-day device certs
How DockPulse runs two parallel root CAs for an MQTT bus, and why short-lived device certs let me skip the revocation problem entirely.
The hashmap header lives at `entries[-1]`
A C pointer trick from lwhttp's header map. The public type is Entry*, but the capacity and count live at entries[-1].
Byte stuffing won't save you from a missed SYNC
Notes from the crypt-chat framer on a bit-banged RISC-V UART. Why the framer needed a per-frame timeout, and what I almost forgot to stuff.