It sure seems that a bunch of companies are trying to ship a git product of
some kind as of late. Wonder why that is.
Either way, I’m building a Git server backed by object storage as an
open-source project. It sounded simple
enough to start: ...
The power of science is staggering! Every day we're making new advancements in the field of generative artificial intelligence via judicious application of large language model inference technology. However, as we approach the next critical threshold in capability, we must l...
After a year of work, hundreds of commits, 5 generations of pull requests, dozens of tests, rewriting part of Anubis in Rust, the first compiler bug of my career, and at least three times making my tower run out of ram I think I have finally done it. The next versio...
One of the hardest problems in distributed systems is conflict resolution, or
the same basic problem as merge conflicts in Git. Git merge conflicts happen
when your branch differs from upstream in a way that Git can’t easily work its
way around so it ...
In the hours following the release of CVE-2026-41992 for the project GNU gzip, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix decompressing two files in the same invocation of gzip (that's possib...
Tigris has a pretty advanced replication scheme for writes. What happens when
you actually need to delete things? Turns out deleting things is hard in
distributed systems. Especially when you have a geo-replicated active-active
database like Tigris do...
Anubis v1.27.0 (Moenbryda Wilfsunnwyn) is now available via Docker and direct download from GitHub releases. This release adds Windows Server support, automatically renames cookies based on settings to avoid infinite challenge loops, adds two new localizations, and ...
SigV4 looks simple: sign a request, check the signature. Then you implement
canonicalization, clock skew, and a cache that isn't allowed to hold your key.
Tigris is a drop-in replacement for AWS S3 (or GCS, anything S3API compatible).
As such, we need...
A presigned URL is a replay attack you did on purpose.
Replayable auth tokens are the textbook way to create vulnerable systems, but
Tigris ships them as a first-class feature with presigned URLs and so does every
other object storage system on the pl...
In the hours following the release of CVE-2026-8461 for the project FFmpeg, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in the MagicYUV decoder (libavcodec/magicyuv.c) c...
In the hours following the release of CVE-2026-55200 for the project libssh2, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in ssh2_transport_read() due to a missing upper...
What happens if I just point a git server at an object storage bucket?
Back when I was porting
agent sandboxes to Go, I
built everything on top of
billy, a filesystem
abstraction for Go. The whole trick of the project was teaching a Ti...
In the hours following the release of CVE-2026-45447 for the project OpenSSL, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a heap use-after-free in PKCS7_verify(). This is due to the affected c...
Tigris is S3-compatible, which means you can point the AWS SDK at it and most things just work. The catch is that the Tigris-exclusive features—bucket forking, snapshots, object renaming, and the like—need verbose workarounds because the AWS SDK doesn't know they exist.
...
In the hours following the news that Redhat Insights' JavaScript packages fell
victim to a supply chain attack via NPM, developers and systems administrators
scrambled ensure all of their projects were unaffected from a supply chain attack that steals credent...
In the hours following the news that art-template fell
victim to a supply chain attack via NPM, developers and systems administrators
scrambled ensure all of their projects were unaffected from a supply chain attack where attackers have controlled the reposit...
In the hours following the release of CVE-2026-45250 for the project FreeBSD, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a kernel stack overflow when validating permissions of the setcred(2) ...
In the hours following the release of CVE-2026-45584 for the project Microsoft Windows, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a memory safety vulnerability resulting in arbitrary code ex...
Subscribe
