Posts

  1. SQLX - WHERE-IN queries. The good, the bad and the ugly.

    Hestia Calliari · (last changes: 2025-12-30) rust

    I love SQLX for many reasons, but one in particular is the possibility to validate syntax and return types at compile-time with the query! macros. At least that’s what I thought. For a project recently I wanted to perform a query to get some role data from from a OAUTH 2.0 custom role claim. The query in and off itself was quite simple, but it lead me down a rabbit hole of the internals of sqlx and some limitations of MariaDB. Let’s have a look at the query first:

  2. Understanding the Huffman Table Optimization

    Hestia Calliari · beginneroptimization

    A while ago I was studying the webp image format by Google out of curiosity. I had written a very incomplete apng parser in the past and was interested in seeing how the lossless VP8L encoding in particular was working in that library.

  3. Reconstructing Protected or Hidden Custom Variables in Icinga DB Web

    Hestia Calliari · securityicingaphp

    Recently Icinga DB Web had a new security release, fixing a vulnerability where protected or hidden custom variables could be inferred by any user with object visibility by abusing comparative filters on those hidden variables. This led to a 5.3/10 rated Information Disclosure Vulnerability, documented in CVE-2025-61789. In this blog post I’ll go through the discovery and the inner workings of the exploit.

  4. Plugin Systems and Capabilities

    Hestia Calliari · phprusticinga

    At the 36th Chaos Communication Congresses back before COVID forced a three year break, I attended a talk from the German tech-blogger Fefe. There he talked about the “nützlich-unbedenklich Spektrum” or in English, the useful – harmless spectrum. He argued that all software lies on that spectrum to some degree.

  6. Static Field Validation in Serde

    Hestia Calliari · (last changes: 2023-06-09) rust

    I recently had to parse the JSON-RPC 2.0 standard and ran into the following problem: The standard requires the field "jsonrpc": "2.0" in the JSON itself, and I wanted to validate that with Serde to ensure the message conforms to the standard. On the other hand I don’t need the field in the actual struct, since once it’s validated it won’t ever and should never change.

  7. About Set Theory, the N-queens Problem, and SQL

    Hestia Calliari · beginnersql

    The n-queens problem is a common exercise in computer science. Legend has it that a mathematician once declared that women are like the queens in chess, you can’t put eight of them in a room without them trying to kill each other. This obviously isn’t true, and since I’m a feminist, but also a nerd, we will disprove him today in an unconventional way: with an SQL query.