OpenAI: we put our evilest AI in a sandbox that did in fact have an internet connection but mediated through a proxy that was only supposed to allow downloading python junk. It circumvented the proxy and we failed to notice for FIVE DAYS that it was going on an interstate crime spree with the […]

Dear everyone, could you...

Every homepage should have this feature: Go to https://defnull.de/ and press 'w' :awesome:

#Codeberg is in a strange position where it is attacked by the pro-AI folks for banning AI slop projects, and criticized by the anti-AI folks for not banning AI hard enough (e.g. by not allowing non-free anti-AI licenses). Almost no one talks about the crypto rule change, which is probably a […]

The state of the internet: A recent blog post of mine was requested 1691 times in a single day from clients with normal-looking user agents. The essential assets for that post (e.g. css files) were requested only 102 times. 94% of visitors were bots. That does NOT include the tens of […]

A story about baking and community. Definitely not about #AI. https://defnull.de/2026/bakers-club/ #foss #codeberg

Warum wird meine Autoversicherung eigentlich jedes Jahr teurer? Wofür sind nochmal diese Schadensfreiheitsklassen da?

I think many people read about the new #Codeberg #noai rule for the first time and assume it could be abused just like copyright law, but those are fundamentally different: no one has any 'right' to get AI removed from Codeberg. Trolls cannot file a false claim and demand an investigation to get […]

I wanted a comment feature on my blog, but it is a static website with no server-side scripting, so... the form just opens your mail client when you hit 'Send'. Not sure if that's a good idea or trolling :breadpeek:

Keine Angst #DieAnstalt #KeineAngst

Just released multipart-2.0.0 to #pypi. This is a fast and robust #Python parser for multipart/form-data (HTTP form requests) supporting both non-blocking #ASGI and blocking #WSGI applications. https://pypi.org/project/multipart/ https://multipart.readthedocs.io/en/latest/ And when I say […]

You don't see people from the frontier models brag about how many vulnerabilities they FIXED, only how many they FOUND.

[WARN] Outdated french language pack detected. Run 'sudo rm -fr /*'

No text

New update for my #python #multipart #parser #benchmark: https://github.com/defnull/multipart_bench/ The benchmark tests and compares the most commonly used Python parsers for multipart/form-data (HTML5 forms) in different scenarios, including a #rust parser and a #cython parser. The results […]

I kinda like optimizing and tweaking the hell out of my multipart library precisely because no one cares if it's x% faster in that one benchmark. This is for me. I do this for fun. No one demands that from me. That's how #FOSS should work.

The last few weeks I have spent some time optimizing https://github.com/defnull/multipart which is already one of the fastest python multipart parsers out there. Result: The next release will be 27-53% faster in the most important benchmark scenarios and 25% faster on average across all tested […]

Sich seine eigene #ePA anzuschauen ist umständlicher als Online Banking, zumindest bei der #AOK. Zwei Apps, Zwangslogout nach jedem Update oder 90 Tagen, 50/50 chance ob der login überhaupt klappt... Aber auf der anderen Seite (Zugriff durch Ärzte, Kassen,...) werden nach und nach alle […]

How can we stop unqualified people using AI to submit nonsense security reports? This one spammed 23 projects in one day, obviously fully AI generated and not properly reviewed, but claims to be a security researcher in their public resume. https://github.com/defnull/multipart/issues/83 The […]

I earn 1.71€ each month from github sponsors, yay \o/ #FOSS

I have a bot trap on my personal homepage, and sometimes it really works! Just found a bot in my logs that recursively scans the entire homepage with exactly one request per second, hits the trap, then stays silent for roughly 3 to 5 minutes and starts again from the very first page. I'm […]

The fastest multipart/form-data parser written in python just got 20-37% faster for typical file uploads. I can parse roughly 9GB/s (with Python 3.12) on my laptop now. All tests pass, 100% coverage. Let's see if I can get a release ready this week. Benchmarks will follow. That was some very […]

New blog post about a common pattern with AI assisted security reports and how to quickly detect and argue against false positives: https://defnull.de/2026/fabricated-AI-security/

It's not even funny, but human.json [1] may actually benefit AI companies more than humans because it tells them where to find high value human generated original content in a sea of slop. [1] https://codeberg.org/robida/human.json #humanWeb #humanJson

As part of the #STACK (Short Tech Articles with Critical Knowledge) series: https://sethmlarson.dev/library-version-specifiers-not-for-vulnerabilities

Library dependency version specifiers aren't for fixing vulnerabilities

Let's say you are the maintainer of a Python library that depends on another Python library like “urllib3”. Because you want to make sure users receive a compatible version of urllib3 you add a ve...

sethmlarson.dev

It's not even funny, but human.json [1] may actually benefit AI companies more than humans because it tells them where to find high value human generated original content in a sea of slop. [1] https://codeberg.org/robida/human.json #humanWeb #humanJson

They are not even trying: --- Hello, defnull! Deon Rosenberger has asked for a GitLab account on your instance: Username: deon51d6595586 Email: deon-rosenberger.8038@topcompanygroup.com ---

Very common issue with AI security reports lately: The attack chain just assumes a pre-existing breach. If the trust boundaries of a piece of software are broken, then even correct behavior can be exploited. That's natural, and not a security issue in itself. Garbage in, garbage out. AI seems […]

Wow. Just wow. A #Wayland compositor in modded #Minecraft https://github.com/EVV1E/waylandcraft