tarq.net - posts

This is a quick demo of a project I've been working on to bring Spritely Goblins and OCapN to Rust.

Action Relay gained a few features this week: It can directly run unsigned shortcut files It can compile workflows using cherri-lang This effectively gives us a code mode for shortcuts.

Flagging Without Feature Flags Every feature flag you ship is a promise you'll clean it up later.

One of the things I've always loved about macOS is how friendly it is to automation.

This is first entry in a series I'm calling "Fish of the Week", where I publish a nifty fish function I'm using in my local setup Overview Browse through GitHub releases using an interactive picker and choose a file to install into ~/.local/bin Usage ghin…

Using Cursor from the CLI is a handy way to automate some tasks.

If you've used Cursor, you've probably heard of the infamous "YOLO Mode".

Just over a week ago, I took the plunge and acquired the Apple Vision Pro, a decision that was somewhat spur-of-the-moment.

Feature flags are decision points in an application that change it's behavior based on context and a set of rules.

A highly public data breach is one of the most commonly realized nightmare scenarios of a compromise.

After reading about NPM Advisory 755 in Mahmoud Gamal's blog post, I decided to poke around a bit and see if there are other ways to trick handlebars into letting us escape the sandbox.

Background MaxScale is a MySQL proxy developed by MariaDB.

Here's a neat trick you can use to detect every time Chrome-Dev tools is opened. function onDevToolsOpen(fn) { var beacon = new Error(); Object.defineProperty(beacon, "message", { get: fn }); console.log("%c", beacon); } onDevToolsOpe…

In this article, we're going to mitigate tab-nabbing attacks in a cross-browser way that only requires adding a single JS file/function to your application.

VestaCP currently has a bug that allows root privilege escalation using PHP.

Using a combination of named locations along with the error_page directive, we can make it so nginx automatically serves error pages from a directory structure with support for wildcard/catch-all files.

I've been working on a project with rust that requires creating a pseudo-terminal and like many others, I've run into a lot of problems with the functions available to get a pair of master/slave fds for my PTY. openpty int openpty(int *amaster, int *aslav…

Several guides for integrating everybody's favorite caching plugin for Wordpress with Nginx tell you to include something like this in your nginx configuration: location / { include /var/www/wordpress/nginx.conf; } At the time of writing, this sugge…

mysqldump is a common utility used to create logical backups of MySQL databases and one of the SST methods used by Galera to bring out-of-sync nodes back into the cluster.

mysqldump is a common utility used to create logical backups of MySQL databases.

Although it is documented that the default binary distributions of MySQL/MariaDB/Percona all seem to be compiled with allow local infile enabled, the warning is misleading: The transfer of the file from the client host to the server host is initiated by t…

The Node HTTP Client checks for invalid characters such as new lines that can be used to perform HTTP Smuggling attacks, however, the rules for the path option are quite relaxed.