Python
173 posts
Trusting X-Forwarded-For Is How Rate Limiting Quietly Stops Working
If you read the leftmost X-Forwarded-For value, the client picks its own identity and a rotating header defeats your limiter entirely. Count hops instead.
An RSS Reader Is an SSRF Machine
An RSS-to-email service fetches arbitrary URLs on a schedule, forever. How emit guards its feed fetcher, and the hole it can only mitigate.
Deduplicating the Result Is Not Deduplicating the Work
A graph walk that collects into a set returns correct output while still enumerating every path. Why a visited set and an accumulator are two different things.
Validate At the Lowest Public Boundary
A Python wrapper that validates its arguments is not validation if the C extension underneath is importable. Anything importable is public API.
How Date Inference Works, and Why Ambiguity Is the Problem
Guessing a strptime format from examples is a scoring problem with ties. The dangerous outputs are the wrong guesses that still parse cleanly.
Bradley-Terry: Maximum Likelihood Ratings on an Elo Scale
Bradley-Terry fits every comparison at once instead of nudging after each game. Adding it to elote, and the four design choices that made it usable next to Elo.
Five Backtest Invariants Worth Enforcing In Code
A backtest simulates information availability, and every way it leaks the future flatters your returns. Five invariants, each with the test that pins it.
Same App, Ten Years Apart
Pedal Wrencher in 2015 and in 2026: identical product, zero shared code. What a decade of stack turnover actually bought, and what it didn't.
PyGeoHash v3.3.2: Reliability at the Edges
PyGeoHash v3.3.2 continues the reliability run with antimeridian fixes and stricter validation, plus native ARM64 wheels and smoke-tested artifacts.
Cache Keys Must Come From the Resolved Call
A memoization decorator that reads kwargs cannot see positional arguments, so distinct calls collide. How to build keys from the bound signature instead.