#infosec enthusiast • #golang dev & trainer • minor contributor to the Go project • minimalist • atheist • chaotic good • trying to make sense of the Web • he/him
Free Go course: https://github.com/jub0bs/go-course-beginner
Free 🇵🇸!
Difficult to disagree with this post by Efron Licht: Gin, #golang's arguably most popular Web framework, is pretty bad and should be avoided at all costs. 🙅
Your weekly reminder to migrate from rs/cors to jub0bs/cors. 😇
Problem Presumably for performance, the library (v1.11.1 and some older versions) reuses some non-exported slice variables and struct field from one middleware call to the next: package-level var h...
Monotonic Collections: a middle ground between immutable and fully mutable
This post covers several topics around collections (sets, lists, maps/dictionaries, queues, etc) that I’d like to see someone explore more fully. To my knowledge, there are many alternative collection libraries for Java and for many other languages, but I’m not aware of any that provide support for monotonic collections. What is a monotonic collection, I hear you ask? Well, I’m about to answer that.
"A good API should be, not only easy to use, but also hard to misuse." (Josh Bloch)
CVE-2025-10630: REDoS in Zabbix plugin for Grafana dashboard (fixed in v6.0.2)
To anybody relying on some PCRE engine (such as github.com/dlclark/regexp2): either forbid users to submit arbitrary patterns or enforce some reasonable timeout on matching.
🤦 #AIslop in action! Grafana's fix to CVE-2025-10630 in v6.0.0 of their Zabbix plugin happened to be way off base, but this AI tool fails to figure it out and happily lulls Grafana users into a false sense of security.
https://www.miggo.io/vulnerability-database/cve/CVE-2025-10630
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.
Neil Madden
James Kettle