iiinova — where your digital self keeps evolving

Florian Apolloner

@florian.apolloner.eu

49 followers 46 following 13 posts

Dabbling in many things. Mostly Ops and Python stuff.

Posts Replies Media

Florian Apolloner @florian.apolloner.eu · 10/05/2025

Afaik becoming a CNA will allow you to prevent such CVEs in the first place.

100

Florian Apolloner @florian.apolloner.eu · 10/05/2025

So basically a "get or create"? Haki has a great article about the ups and downs of the individual approaches: hakibenita.com/postgresql-g...

hakibenita.com

How to Get or Create in PostgreSQL

And why it is so easy to get wrong...

150

Florian Apolloner @florian.apolloner.eu · 02/04/2025

@brongondwana.bsky.social / @fastmail.com Hi, since today (?) I am seeing avatar icons for some automated mails from domains that don't have bimi etc set. How/where from does fastmail source the avatar icons? favicon from the TLD?

000

Reposted by Florian Apolloner

djangochat.bsky.social @djangochat.bsky.social · 05/03/2025

Ep177: Sticking with Django w/ Florian Apolloner @florian.apolloner.eu is a long-time Django contributor who previously served on the Steering Council and Security Team. We discuss changes to Django, switching to `uv`, and drawing inspiration from other frameworks. djangochat.com/episodes/sti...

djangochat.com

Sticking with Django - Florian Apolloner | Django Chat

Florian is a long-time Django contributor who previously served on the Steering Council and Security Team. We discuss changes to Django over the last 20 years, switching over to `uv`, why he’s not a f...

035

Florian Apolloner @florian.apolloner.eu · 09/12/2024

Certainly "as we know it". I am so sorry, I just couldn't resist.

110

Florian Apolloner @florian.apolloner.eu · 25/11/2024

Thanks, that brings me to my next question: would you recommend NATS or rather not use it again (independent of Channels). It looks really great, but I don't have any experience with it yet.

100

Florian Apolloner @florian.apolloner.eu · 24/11/2024

@carltongibson.bsky.social @aeracode.org Did either of you ever tried writing a channel layer for NATS?

110

Florian Apolloner @florian.apolloner.eu · 24/11/2024

I wonder why that often happens? I think Kubernetes really seems off-putting at first due to the sheer size. Docker Swarm and Hashicorp Nomad seem so much simpler in comparison (but also offer less I guess).

100

Florian Apolloner @florian.apolloner.eu · 24/11/2024

I nearly spilled my coffee 😂 Funny enough we are just working out a plan to start using k8s. I think I still hate it but one cannot deny the benefits.

110

Florian Apolloner @florian.apolloner.eu · 22/11/2024

No argument on cibuildwheel which is why I was explicitly asking about stage 1 -- ie source bundling. downloadLocation might be indeed an answer but most likely means using all the security analysis you'd get otherwise

110

Florian Apolloner @florian.apolloner.eu · 22/11/2024

And while I agree that a name & version is better than nothing, it is pretty much close to nothing imo. Maybe it helps someone looking at the SBOM manually but I do not have the feeling that it will help any software using that SBOM.

100

Florian Apolloner @florian.apolloner.eu · 22/11/2024

But do Package URLs actually work? I mean if I embed libpq what would be the correct purl for it -- there doesn't seem to be a scheme for the actual source without having a repository (might miss something). I am trying to use purls over CPE where possible due to all the false positives with CPEs :/

110

Florian Apolloner @florian.apolloner.eu · 22/11/2024

Nice post, some questions though. Stage 1: what are suitable identifies for bundled software (purl/packageUrl)? Stage 2: Even without extra dependencies like Maturin etc shouldn't the build backend inject itself as well?

100

Florian Apolloner @florian.apolloner.eu · 22/11/2024

Uff, can't wait to read that. Will it have tooling advice as well? All the generators I tried till now seem to have issues one way or the other. 🙈 So I am kinda afraid of even trying to merge sboms 😂

210