Artem Golubin

Real attackers don't think in bug bounty scopes

Sun, 20 Sep 2026 18:43:08 -0000

A recent post on Hacking OpenAI and a bug bounty of $6,500 reminded me of an old problem. A security company was able to hack into private OpenAI repositories, but only got a small bounty. A company with a valuation of $852 billion paid a few pennies to researchers. In comparison, such data could be sold for hundreds of thousands on the black market.

For those who don't know, a bug bounty program is a way for companies to pay white-hat hackers (security researchers) to find vulnerabilities in their services and software. Bug bounties allow researchers to perform security research in a legal way and get paid for it. The hack was initiated through a hosted Discourse forum, but that forum was out of the scope of OpenAI's bug bounty program.

In bug bounty programs, there is usually a list of services the company wants to be tested and the rest of the services do not receive any bounty. In the case of the OpenAI hack, accessing the private data (from repositories) was in scope,[......]

Astroturfing on Reddit and the dead internet

Fri, 11 Sep 2026 19:02:08 -0000

Reddit used to be a good source to find real recommendations. Well, not anymore. Years ago, I used to append "reddit" to my search queries to find real discussions about products.

If you search for managed Postgres on Reddit, you may stumble on posts like this:

If you look at the profile of the person who created it, their posting history is usually private:

u/xxx likes to keep their posts hidden, but check out their stats to learn more about them.

But when you do some research and look at their other posts from Reddit dumps to find their real identity, you see this:

By diving deeper, you notice that there are around 10 accounts that constantly ask about managed Postgres or recommend a specific provider. They are all connected to the same company.[......]

Writing arenas in Rust from scratch

Mon, 27 Jul 2026 17:02:08 -0000

Custom memory allocations and arenas are notoriously hard to deal with in Rust due to the ownership model.

In a lot of projects, they can significantly improve performance. For example, let's take databases. Sending a query to a database produces a lot of temporary objects, and if the default allocator is used, you will need to allocate and deallocate thousands of small objects for each query, which is wasteful.

Almost every database engine uses custom memory pools to improve performance. Some go so far as to statically allocate all the memory before the program starts.

Another good example is scripting languages. I have an article on how Python uses arenas to reduce the number of allocations for Python types. A simple web app in Python can allocate more than a million of objects after 100 HTTP requests.[......]

Domain registration information should be transparent

Wed, 22 Jul 2026 15:14:08 -0000

The single best signal for identifying a phishing domain is the domain registration date, and yet domain registrars still limit access to such data.

For certificates, we have Certificate Transparency Logs where every issued TLS certificate is publicly visible within seconds of issuance.

For domains, we used to use WHOIS protocol, which returned plaintext data:

It was pretty hard to deal with, because every domain zone used its own format that was hard to parse.

In the last five years, a new RDAP protocol has grown in popularity. Instead of plaintext, it now outputs JSON data.

It became a mandatory protocol in 2025 and more than 1440 TLDs (domain zones) support it now. Despite the new protocol, the problem persists - registrars are still rate limiting access.

[......]

Hexora v0.3: New features and improvements

Thu, 25 Jun 2026 15:14:08 -0000

Recently, I've improved my Python library, hexora. I wrote it to detect malicious Python code using static analysis.

In the new v.0.3.0 release, I've added new detections, and we now also use a simple machine learning model to analyze the whole file. The machine learning model uses code structure features, semantic features, and static code analysis to assess the entire Python file.

Although the model can detect malicious code without any detections coming from static analysis, its main use case is to filter false positives.

I've been testing it against newly published PyPI packages and it detects 2-10 new malicious packages each day.

Due to the number of published packages, before the machine learning model, I was getting around 5-10 false positives for 1[......]

Using local ClickHouse for data processing

Sat, 06 Jun 2026 14:14:08 -0000

I did a lot of data engineering work in my career.

When you work a lot with data, you often get quick requests to extract some cold data and process it. Since the data is cold, it usually resides on S3.

For example, one of the typical requests in the past was to count unique values from an old MongoDB backup or CSV dump with 100GB of compressed data.

I quickly learned that using throwaway Python scripts would not work well. Often, the data is too big to fit into memory to sort and deduplicate. Maintaining a Spark cluster was not worth it for this kind of work.

So, what I would do is something like this:

LC_ALL=C aws s3 cp s3://bucket/data.json.gz - \
  | gzip -dc \[......]



NULLs in ClickHouse can hurt performance
Wed, 03 Jun 2026 14:14:08 -0000
When coming from relational databases, NULLs are the go-to for optional fields.
Using them in ClickHouse can lead to unexpected and often unnoticeable performance degradation.
This article explain why.
PostgreSQL
When using null values in PostgreSQL, you rarely notice any difference.
In PG, columns are nullable by default and you can index them.
Internally, each row in PostgreSQL has a bitmap that indicates which columns are NULL. It's only present when
there are null values in a particular row using a bit flag.
PostgreSQL is a row-oriented database, so when you read a row, you read all the columns together.
ClickHouse
Unlike PostgreSQL, ClickHouse is a columnar database.
Instead of storing data by rows, it organizes them by columns.
Each column is stored separately as a contiguous block of data.
Let's suppose we have a table that stores HTTP logs.
We want to store the visitor's user ID, which can be empty for anonymous users.[......]


PyPI packages are increasing rapidly
Sun, 17 May 2026 14:14:08 -0000
PyPI is the main repository for Python packages.
One thing that I've noticed recently is the number of published packages per week.
Let's look at published counts of new package versions per week:


There are some dips in the data, but that's because of how the data was collected.
We can see a clear increase in the number of published packages, especially in the last few months.
Because of AI, the number of packages published per week has increased by 30% since 2025.
I'm working on hexora, a library that detects malicious Python code in packages.
It monitors newly published PyPI packages in real time and analyzes them.
A lot of packages, that have been published recently, are purely vibecoded, and they trigger false positive detections when my tool analyzes them.[......]


The rise of malicious repositories on GitHub
Sun, 15 Mar 2026 17:14:08 -0000
There is an ongoing surge of malicious repositories on GitHub, and the sad thing about it is that
GitHub seems not to care much.
About 10 days ago, I searched for a repo on DuckDuckGo and stumbled upon a fake GitHub repo.
It mimics a legitimate repository, but instead of providing usual releases, it only provides malicious Windows binaries.
Linux/MacOS binaries are not available, and the information on how to build the project was removed from the README file.
The description was also altered using LLMs, removing a lot of technical details.
I reported this repository to GitHub, explaining the problem and showing the report from VirusTotal.
To this day, the repository is still there, and the binaries are still available for download.
The repo has been active for two months. The README gets constantly updated every hour so that it will appear in the
GitHub search higher.

Today, I saw another case of this on X,[......]


Do not fall for complex technology
Thu, 22 Jan 2026 17:14:08 -0000
Fifteen years ago, I wanted to set up a note-taking system.
At the time, Evernote was the tool everyone was talking about, so choosing it seemed like the right and easy decision.
After storing around 500 notes for eight years, Evernote became a mess to use.
It was bloated, heavily monetized, and slow to work with. So I wanted to switch.
About that time came Notion. Everyone was talking about it. I jumped on the bandwagon and migrated a few hundred of
my notes to it that were still relevant. It did not even occur to me that switching from a bloated and slow app to
a web app would result in a similar outcome later. I followed a popular choice again.
After struggling for a year, I switched to Markdown notes and a plugin for an editor that renders inline images.
I'm still using this to this day. It is simple, and I will be able to open my notes 10-20 years later.
I can edit them in any editor. It works offline and does not depend on commercial products.
I encrypt my notes locally so they can be stored safely on any cloud service.[......]