Plurrrr

Mon 28 Mar 2022

Pickle Serialization in Data Science: A Ticking Time Bomb

Unfortunately, pickle’s incredibly simple interface comes at a cost. Pickle’s deserializer, which is called into whenever we invoke “pickle.load” (or “torch.load”!), is a full-fledged virtual machine, able to run arbitrary code within the process that loads the object. It is expressly built to allow serialized objects to come with arbitrary instructions on how to deserialize them. In other words, Pickle deserialization readily supports running arbitrary code specified by the serializer (the original author of the file).

Source: Pickle Serialization in Data Science: A Ticking Time Bomb, an article by Hank Lee.

Elliptic Curve Cryptography for Beginners

Elliptic curve cryptography (ECC) is a type of public-key cryptographic systems. This class of systems relies on really difficult "one-way" math problems – problems that easy to compute one way and intractable to solve the "other" way. Sometimes these are called "trap-door" functions – easy to fall into, extremely difficult to get out of.

Source: Elliptic Curve Cryptography for Beginners, an article by Matt Rickard.

Understanding Layout Algorithms

When I started digging into the layout algorithms, everything started to make more sense. Mysteries that had bothered me for years were solved. I realized that CSS is actually a pretty darn robust language, and I started to really enjoy writing it!

Source: Understanding Layout Algorithms, an article by Joshua Comeau.