CVE-2025-10630: REDoS in Zabbix plugin for Grafana dashboard (fixed in v6.0.2) To anybody relying on some PCRE engine (such as github.com/dlclark/regexp2): either forbid users to submit arbitrary patterns or enforce some reasonable timeout on matching. #websecurity #golang youtu.be/Z_mYyBYP4ZI

🤦 #AIslop in action! Grafana's fix to CVE-2025-10630 in v6.0.0 of their Zabbix plugin happened to be way off base, but this AI tool fails to figure it out and happily lulls Grafana users into a false sense of security. www.miggo.io/vulnerabilit...

💡 Judiciously ponder the design of a function that operates on user input and returns a slice or a map, lest it constitute a denial-of-service vector. If you're not careful, a single malicious request may cause a huge spike in allocations. cwe.mitre.org/data/definit... #golang #websecurity

I did a talk at the UK GopherCon last month about what my team does, and I only let my laptop fall asleep twice! www.youtube.com/watch?v=oLtq...

And now it looks like #GopherConUK started publishing videos!

My talk from #gopherconuk is up on YouTube! My take on how map is implemented in Go, and what changed from Go 1.23 to 1.24 and 1.25. youtu.be/M05t7Q6LbFs * Talk contains no AI, but does contain pictures of cats.

The recording for my latest research has been released! If you prefer to listen rather than read, now is your chance. P.S. It may be worth listening to it at a slower speed due to my tendency to talk at the speed of light...

When the stars align, a one-character change can have a surprisingly significant impact on performance. 🤩 In this case, omitting a superfluous index in a slice expression was enough to make the enclosing function inlineable. ⚡ github.com/golang/go/pu... #golang

⚡ If you find yourself implementing an iterator on some recursive data structure, do check out the doc comment of golang.org/x/tools/gopls/internal/analysis/recursiveiter. Very useful performance tip by @adonovan.bsky.social! #golang

Making `DecodeRuneInString` is inlinable #golang github.com/golang/go/is...

The GopherCon EU videos are online. I really enjoyed @misago.org’s about testing/synctest. But there were so many good talks, maybe watch them all? youtu.be/oIC3zhTAOsY #gopherconeu #golang

My GopherCon EU talk about Swiss Table maps is now available! youtu.be/aqtIM5AK9t4

⚡ I've been contributing micro-optimisations to Go's standard library in my spare time: github.com/golang/go/co... 💸 I don't intend to stop any time soon, but if you benefit from my work and would like to support it, consider sponsoring me on GitHub: github.com/sponsors/jub... #golang #OpenSource

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

I enabled sponsorships on Github for cspbypass.com. The main goal is to cover hosting fees etc. So if you want to support my work, I would highly appreciate it if you could become a sponsor. github.com/sponsors/ren... Thanks!

new blog after who knows how long - a deep dive into how a bunch of web protections fit together and also an example of how you can mess that up so bad you find CSRF in a GraphQL API notateamserver.xyz/blog/cors-xs...

We may still get a generified version of errors.As in #golang's standard library! 🤞 github.com/golang/go/is...

Here are the slides for my "What's coming to Go 1.25" talk at #GopherConUK! #golang

I'm generally skeptical of tools labelled as "AI", but the podcasts that pi.dev can generate from changes to a repo are quite impressive. Here is an example: pi.dev/shows/github...

jub0bs/cors has now reached 100 ⭐s on GitHub! 🤩 github.com/jub0bs/cors #golang

Now live on tools.honoki.net/smuggler.html Let me know what you think! ✨

@hacker0x01.bsky.social's triage: "Your report is out of scope because your bug chain involves an open redirect, which is out of scope." 🤡🤡🤡

🎺 Unpopular opinion: to illustrate the presence of a #websecurity vulnerability, security researchers should rely, not on Rick Hastley's "Never Gonna Give You Up", but on Herb Alpert & the Tijuana Brass's "Spanish Flea". Way funnier! www.youtube.com/watch?v=aBE9...

"We take security and privacy very seriously." have long become code words for "We won't bother fixing vulnerabilities that are reported to us." #websecurity 🤷

💡 Did you know that you can craft URLs that bypass X/Twitter's URL shortener (t[.]co) and domain deny list? For instance, try sharing x.com/login?redire... in a tweet and clicking the link; you will ultimately be redirected to ddosecrets.com (which is banned by X) without ever traversing t[.]co!

We've published episode 24: Go's Error Handling Is Handled. Happy Listening!

🎉 I've just released v0.7.0 of jub0bs/cors, my #CORS middleware library for #golang! 💀 Now that Private-Network Access (PNA) has been put on indefinite hold in favor of a new permission-based mechanism named "Local-Network Access", I've removed all support for PNA. github.com/jub0bs/cors

🍪 Cookies: the gift that keeps on giving! Ingenious ways of exploiting cookie tossing by @tomanthony.bsky.social. The Path cookie attribute, far from drawing any effective security boundary, is actually useful to attackers for achieving focused session fixation. www.youtube.com/watch?v=76aW...

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!

It's been five years since @zlz.bsky.social and @rhynorater.bsky.social reported this bomb to Starbucks' #bugbounty programme and I still can't believe that they only got $4k for it. They deserved a lot more than that! 💰💰💰 Sam's post about it is still a great read: samcurry.net/hacking-star...

Epic Firefox XSS vectors by Masato Kinugawa. Now available on our XSS cheat sheet including variants found by me. Link to vectors👇 portswigger.net/web-security...

HackerOne once was my favourite #bugbounty platform. Sadly, @hacker0x01.bsky.social's triage is objectively getting worse and worse, no doubt due to a combination of over-reliance on "AI" tools and hiring less than competent triagers who don't bother trying to understand a report's Impact section. 😬

Is anybody else getting logged out of #Bluesky multiple times a day? Pretty annoying... 😠

🫡 "For the foreseeable future, the Go team will stop pursuing syntactic language changes for error handling. We will also close all open and incoming proposals that concern themselves primarily with the syntax of error handling, without further investigation." go.dev/blog/error-s... #golang

FWIW, I think it is highly rationale & pragmatic for the core Go team to take this step. It follows one of the core tenets of Go, which is that in the absence of consensus, the default is to not make a change. As I understand it, it is also follows the tenet of "No is temporary. Yes is forever".

New blog post! 🤓 jub0bs.com/posts/2025-0... #golang #iterator

This is the kind of stuff that "optics" conjures up in my mind when I chance upon it in a news article. Nothing else. 🤷

For those who missed it, check out my talk, “Widgets Gone Wild: Exploiting XSS through Flawed postMessage Origin Checks.” 📺 Watch here: www.youtube.com/watch?v=qgB0... 🖥️ Follow along with the slides: 0-a.nl/nahamcon/

I hadn't kept up with Chromium's progress on implementing Private Network Access, but it looks like they've killed it in favour of some alternative, permission-based proposal. 🔍 groups.google.com/a/chromium.o...

If you’re into bug bounty hunting and like finding weird XSS bugs (like me 😊) in places most people overlook, come check out my talk at NahamCon 2025 this Friday, May 23. "Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Checks"

Bounds-checks-elimination hints strike again! ⚡ github.com/agnivade/lev... #golang

Do you think that the following program prints "true" or "false"? #golang package main import "fmt" func main() { const n = 10 var i int for i = 0; i < n; i++ { } var j int for j = range n { } fmt.Println(i == j) }

Many people believe that OPTIONS must be listed as an allowed method in the Access-Control-Allow-Methods response header for CORS preflight to succeed. 🙅 This playground (courtesy of @jakearchibald.com) may be enough to convince you that this is a misconception: jakearchibald.com/2021/cors/pl...

I find myself in strong agreement with John Ousterhout about #TDD: it encourages an approach to software development that is more tactical than strategic and typically takes a toll on design. Like Ousterhout, I tend to resort to TDD only when I'm fixing a bug. www.youtube.com/watch?v=lz45...

The Cool Maze blog — eighth article 🚀 Performance, part 2 How we deliver a payload to a recipient before knowing which recipient blog.coolmaze.io/posts/008-pe... 📱➡️💻 #performance

New blog post! 🤓 jub0bs.com/posts/2025-0... #golang #optimization

Oh yeah! Shorter certificates are coming!! 😎🔒🌍⌚ scotthelme.co.uk/shorter-cert...

The new json/v2 #golang stdlib package is still a proposal, but was merged yesterday behind a GOEXPERIMENT. Two ways to play with it: 'gotip' and the Go Playground. gotip: $ go install golang.org/dl/gotip@latest $ gotip download $ GOEXPERIMENT=jsonv2 gotip doc encoding/json/v2 Playground example:

testing localhost.engineering

I don't understand why some people are bent on improving error handling in #golang. Leave it alone; it's fine as it is. github.com/golang/go/is...