Artem Golubin

The future of the internet could be paywalls

Fri, 16 Oct 2026 18:29:08 -0000

I've been getting weird e-mails for quite some time now, and this got me thinking about the future of the internet.

LLM-generated e-mails are becoming harder to spot, and some of them are landing in my inbox.

We are at the point where generating such messages is cheap, and a lot of people think it is a cool idea to spam you with personalized messages that were not written by a real human. Their agents gather some info about you from the internet and make them look personalized.

What happens when the supply of text is almost infinite and generating it is even cheaper? How do we keep using our regular tools without getting bombarded with a lot of nonsense?

I think the future could be where you will have to pay a minimal amount to send an e-mail. And the money goes to the recipient. That's the only way I see to prevent stupid e-mails. So, if someone replies, you have not spent any money on it and get it back.

There is no solution that would work for everyone.[......]

Python's binary wheels and supply chain attacks

Thu, 15 Oct 2026 20:29:08 -0000

Python is known for fast packages despite being a slow language. The fastest Python packages are written in compiled languages such as C, C++, or Rust, with Python acting only as a glue.

Python users usually don't even notice that, because PyPI (Python's package index) provides precompiled binaries. They are called wheels, and when you run pip install, it prefers them over the source distribution. For example, each release of my packages ships up to 90 different wheels. You need a separate binary wheel for each Python version, platform, and architecture combination. The regular distribution only contains the source code.

Without Python wheels, the distribution would be much harder. When wheels are not available, a user has to compile the code when installing a package. That requires the correct compiler and system dependencies.

Since I've spent quite a while analyzing malicious packages on PyPI, this got me thinking about wheels.[......]

Real attackers don't think in bug bounty scopes

Sun, 20 Sep 2026 18:43:08 -0000

A recent post on Hacking OpenAI and a bug bounty of $6,500 reminded me of an old problem. A security company was able to hack into private OpenAI repositories, but only got a small bounty. A company with a valuation of $852 billion paid a few pennies to researchers. In comparison, such data could be sold for hundreds of thousands on the black market.

For those who don't know, a bug bounty program is a way for companies to pay white-hat hackers (security researchers) to find vulnerabilities in their services and software. Bug bounties allow researchers to perform security research in a legal way and get paid for it. The hack was initiated through a hosted Discourse forum, but that forum was out of the scope of OpenAI's bug bounty program.

In bug bounty programs, there is usually a list of services the company wants to be tested and the rest of the services do not receive any bounty. In the case of the OpenAI hack, accessing the private data (from repositories) was in scope,[......]

Astroturfing on Reddit and the dead internet

Fri, 11 Sep 2026 19:02:08 -0000

Reddit used to be a good source to find real recommendations. Well, not anymore. Years ago, I used to append "reddit" to my search queries to find real discussions about products.

If you search for managed Postgres on Reddit, you may stumble on posts like this:

If you look at the profile of the person who created it, their posting history is usually private:

u/xxx likes to keep their posts hidden, but check out their stats to learn more about them.

But when you do some research and look at their other posts from Reddit dumps to find their real identity, you see this:

By diving deeper, you notice that there are around 10 accounts that constantly ask about managed Postgres or recommend a specific provider. They are all connected to the same company.[......]

Writing arenas in Rust from scratch

Mon, 27 Jul 2026 17:02:08 -0000

Custom memory allocations and arenas are notoriously hard to deal with in Rust due to the ownership model.

In a lot of projects, they can significantly improve performance. For example, let's take databases. Sending a query to a database produces a lot of temporary objects, and if the default allocator is used, you will need to allocate and deallocate thousands of small objects for each query, which is wasteful.

Almost every database engine uses custom memory pools to improve performance. Some go so far as to statically allocate all the memory before the program starts.

Another good example is scripting languages. I have an article on how Python uses arenas to reduce the number of allocations for Python types. A simple web app in Python can allocate more than a million of objects after 100 HTTP requests.[......]

Domain registration information should be transparent

Wed, 22 Jul 2026 15:14:08 -0000

The single best signal for identifying a phishing domain is the domain registration date, and yet domain registrars still limit access to such data.

For certificates, we have Certificate Transparency Logs where every issued TLS certificate is publicly visible within seconds of issuance.

For domains, we used to use WHOIS protocol, which returned plaintext data:

It was pretty hard to deal with, because every domain zone used its own format that was hard to parse.

In the last five years, a new RDAP protocol has grown in popularity. Instead of plaintext, it now outputs JSON data.

It became a mandatory protocol in 2025 and more than 1440 TLDs (domain zones) support it now. Despite the new protocol, the problem persists - registrars are still rate limiting access.

[......]

Hexora v0.3: New features and improvements

Thu, 25 Jun 2026 15:14:08 -0000

Recently, I've improved my Python library, hexora. I wrote it to detect malicious Python code using static analysis.

In the new v.0.3.0 release, I've added new detections, and we now also use a simple machine learning model to analyze the whole file. The machine learning model uses code structure features, semantic features, and static code analysis to assess the entire Python file.

Although the model can detect malicious code without any detections coming from static analysis, its main use case is to filter false positives.

I've been testing it against newly published PyPI packages and it detects 2-10 new malicious packages each day.

Due to the number of published packages, before the machine learning model, I was getting around 5-10 false positives for 1[......]

Using local ClickHouse for data processing

Sat, 06 Jun 2026 14:14:08 -0000

I did a lot of data engineering work in my career.

When you work a lot with data, you often get quick requests to extract some cold data and process it. Since the data is cold, it usually resides on S3.

For example, one of the typical requests in the past was to count unique values from an old MongoDB backup or CSV dump with 100GB of compressed data.

I quickly learned that using throwaway Python scripts would not work well. Often, the data is too big to fit into memory to sort and deduplicate. Maintaining a Spark cluster was not worth it for this kind of work.

So, what I would do is something like this:

LC_ALL=C aws s3 cp s3://bucket/data.json.gz - \
  | gzip -dc \[......]



NULLs in ClickHouse can hurt performance
Wed, 03 Jun 2026 14:14:08 -0000
When coming from relational databases, NULLs are the go-to for optional fields.
Using them in ClickHouse can lead to unexpected and often unnoticeable performance degradation.
This article explain why.
PostgreSQL
When using null values in PostgreSQL, you rarely notice any difference.
In PG, columns are nullable by default and you can index them.
Internally, each row in PostgreSQL has a bitmap that indicates which columns are NULL. It's only present when
there are null values in a particular row using a bit flag.
PostgreSQL is a row-oriented database, so when you read a row, you read all the columns together.
ClickHouse
Unlike PostgreSQL, ClickHouse is a columnar database.
Instead of storing data by rows, it organizes them by columns.
Each column is stored separately as a contiguous block of data.
Let's suppose we have a table that stores HTTP logs.
We want to store the visitor's user ID, which can be empty for anonymous users.[......]


PyPI packages are increasing rapidly
Sun, 17 May 2026 14:14:08 -0000
PyPI is the main repository for Python packages.
One thing that I've noticed recently is the number of published packages per week.
Let's look at published counts of new package versions per week:


There are some dips in the data, but that's because of how the data was collected.
We can see a clear increase in the number of published packages, especially in the last few months.
Because of AI, the number of packages published per week has increased by 30% since 2025.
I'm working on hexora, a library that detects malicious Python code in packages.
It monitors newly published PyPI packages in real time and analyzes them.
A lot of packages, that have been published recently, are purely vibecoded, and they trigger false positive detections when my tool analyzes them.[......]