Ah, sorry, benchmark had a bug. The FastAPI request handler was not async, which means FastAPI wrapped it as if it were a blocking function, even though it was a pure function.
After fixing the mistake, I get 52k req/s with FastAPI. So my experimental framework is only twice as fast, not 7x. Mea culpa.
Still awesome :D
Wow, a modern #Python #ASGI web application can actually reach 100.000 requests per second on a 7+ year old mid-range consumer CPU (AMD Ryzen 5 3600).
Benchmark tool: `oha` with default settings.
ASGI Server: `uvicorn+zttp+zuvloop` with 12 workers (one per CPU thread)
ASGI Framework: my own (not released yet)
Application: `return b"Hello world!"`
Fun fact: #FastAPI struggles to reach 14.000 req/s with the exact same test setup. My experimental framework is 7x faster than FastAPI :awesome:
I wonder on how many fediwalls I appear with random post because people forgot to remove me from the https://fediwall.social default config for their custom walls :breadpeek:
Only 442 of the nearly 38,000 vulnerabilities claimed to have been found using Anthropic's Project Glasswing have received a CVE identifier, and only two of those have been exploited in the wild.
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
hey its new blogpost time
this one is about my $1,333,337 google vrp bounty and how twitter and ai are just great at preventing the spread of misinformation :p
enjoy <3
RE: https://hachyderm.io/@isntitvacant/117588007590928085
Fun, and true, fact, I once sat down with the inventor of GraphQL and after 30 minutes of him trying to explain the technical merits he finally came out with it: “GraphQL exists so Facebook frontend devs don’t have to talk to Facebook backend devs”.
Since today is the "shit on the FSF" day, our partners have poked and motivated us to finally get the blost about EUPL off our chest. Been a long time coming, we have been sitting at this for years.
https://nixalted.com/eupl.html
Why should you care? Well, EUPL is a neat license that is just better than the GPL family at doing the whole "copyleft" thing. And also FSF is salty about it, and what makes FSF mad - makes us happy.
Could you tell we're nervous as fuck about this? Yeah, we are. Well, go read it, we put our heart and soul into it.
But the silicone around the bathtub is still moldy, a lamp is broken and the heating in the bathroom does not work because the smart thermostat is not paired correctly. Not sure about the priorities here.
In the B&B I'm currently in, the salt and pepper grinders cost more than two nights of stay for two people. The trashcan is worth 3 nights. The dish scrubber can buy you a decent meal at a restaurant. The decorative chair in the corner? Four months of rent. I mean, it's a nice chair I guess?
[ACTION REQUIRED] All known versions of Puppet and OpenVox are vulnerable to both client impersonation and a remote code execution. Please upgrade to the following OpenVox versions as soon as possible. If you are unable to upgrade then see our blog post for mitigation efforts.
* Agent versions 9.3.0 or 8.32.0
* Server/DB versions 9.2.0 or 8.18.0
https://voxpupuli.org/blog/2026/11/03/critical-cve-updates/
This is fascinating and also kinda scary: With enough effort, it is possible to pinpoint the exact location and time of an audio recording by isolating and analyzing background airplane noise (or the lack thereof). This means that basically any audio recording from a somewhat quiet outside location in the US or other areas with high air traffic could be geo-tagged using public data only.
#quart is close, API wise. No surprise, quart mimics #flask and flask mimics bottle.py and bottle is my own project. But after what I have experienced during a past security issue responsible disclosure I would never use quart (or flask) in production ever again. And it's as slow as FastAPI, despite doing much less.
I have an actual real productive project built on top of #ASGI. When I was looking for a framework back then, #FastAPI was my first choice, but it didn't survive the prototyping phase because it is WAY to opinionated and inflexible. It just couldn't do what I needed and extending it is a nightmare. Real django vibes. In the end it was easier to built on top of #starlette that to rip out and replace FastAPI core concepts. But I'm not happy with starlette either. No framework really hits the spot.
Fun fact: An minimal but usable #ASGI web framework (think bottle.py, but async) can be 20x faster than #FastAPI and 4x faster than #sanic for a trivial {"hello": "world"} JSON API benchmark. No surprise. Doing less is faster. But still... I wonder what I'm missing. All required steps for this specific scenario are fully implemented.
Looks like 17 years after bottle.py I'm building a #noai web framework again. For fun of cause, because being successful in this area is almost impossible now.
If you want to create a wall of Fediverse posts, there's a site called Fediwall which lets you do that:
You can adjust what the wall shows by clicking on the bar at the top of the page with the hashtags and account address on it.
I ordered #baklava online: 10 mails and two push notifications so far. My baklava has not arrived yet. :thisisfine:
I see #Microsoft #GitHub is now experimenting with rate-limiting #git.
$ git fetch
fatal: remote error:
This request was rate-limited due to too many requests. Reduce the frequency of your requests or try again later.
For more on scraping GitHub and how it may affect your rights, please review our Terms of Service (https://docs.github.com/en/site-policy/github-terms/github-terms-of-service).
…which is quite ironic, given it's my first "git fetch" in… an hour? But well, you sell #slop, then you get hurt by slop, and you use slop to block real people doing real work.
Oh, and I'm actually using authorized SSH session.
Those false-positives are extra common if there are some checks to prevent honest programming errors, but the checks can be bypassed by an actively malicious developer. The AI sees checks, so it assumes the input is not trusted, but it can't find a path through a public API to trigger the non-bug, so it just assumes an unrelated RCE to justify the security report. That pattern is so common that it's the first thing I check: If the PoC directly attacks an internal API, the whole report is slop.
Another example: Security in depth. A function that is only called internally and with strict security assumptions (input is trusted) does not validate its input. If called with malicious input, bad stuff may happens.
AI absolutely loves to suggest additional checks there, because it does not understand the security boundary. Those checks do not improve security and hurt performance.
I received 8 interdependent security reports for the exact same non-issue in one of my projects.
For example: Some HTTP headers allow tab and space characters in certain places, but no known client emits headers with tabs instead of spaces. It's technically still a bug if a server does not accept those, but those old RFCs carry decades of backwards compatibility and allow way more than necessary. Modern non-malicious clients usually handle those protocols WAY stricter than the RFC, and for a good reason: To reduce attack and bug surface or unnecessary computational overhead.