SGued

Draw A Box 250 Boxes challenge

2026-02-21T00:00:00+00:00

Pictures of the exercises of the 250 boxes challeng from Draw a box</a>

Lessons learned from React's RCE

2025-12-14T00:00:00+00:00

In the last few weeks, 3 vulnerabilities where found in the React web application framework. The first one, a server-side remote code execution (CVE-2025-55182</a>) is the worst a vulnerability can get for a web framework. The two other ones are a denial of service (CVE-2025-67779</a>), and a source code exposure (CVE-2025-55183</a>), much less dangerous, yet still impactful.

There are already a lot of writeups published talking about how these vulnerabilities happened, but I didn't see much about being said about preventative measures that would have limited the damage.

In this entry, I'll explore potential mitigations that could have been applied ahead of time to prevent these vulnerabilities or at least limit their severity.

Play local multiplayer games with remote friends

2025-11-11T00:00:00+00:00

Many games have some form of support for local or LAN multiplayer. This can be quite practical when all the players are in the same place, but is not useful when playing with remote people.

I developed a simple Linux tool</a> that in the right conditions, enables you to make your locally-hosted game accessible over the public internet, at no additional cost.

Why people are mad at Framework

2025-10-26T00:00:00+00:00

This 9th of october, Hyprland's twitter account announced that they had received a financial contribution from Framework</a>, a company building modular, repairable computers. Given Hyprland's messy history of being a toxic community people started publicly questioning Framework's decision. People also noticed that Framework's twitter account recently promoted Omarchy, a "distro" by DHH, a very controversial figure from the Ruby community. In this entry I will explain what happened, why Hyprland is still a toxic community, and why Framework's response to the controversy was disappointing.

Draw A Box lesson 1

2025-08-09T00:00:00+00:00

Pictures of the exercises of the first lesson from Draw a box</a>

Signal stories shows what I want social media to be

2025-07-11T00:00:00+00:00

I initially didn't understand the point of stories in apps like WhatsApp or Snapchat. I never really used any app with such a feature. Three years ago, my messaging application of choice Signal</a> added a stories feature</a> and their implementation makes me think that an instant messaging app like Signal could actually fill the exact use-cases that social media like Facebook are trying (and failing) to fill.

You should still use CSRF tokens

2025-05-17T00:00:00+00:00

You may think that thanks to cookies being set to SameSite=Lax</code></a> by default, CSRF</a> (Cross-Site Request Forgery) is mostly a solved problem, but It's not and CSRF tokens</a> are still good practice to implement.
Is this certificate DER or PEM encoded ? It turns out, both at the same time 2025-03-15T00:00:00+00:00 X509 certificate can be encoded either as DER</code> or PEM</code>. DER</code> encoding is an efficient binary format, while PEM</code> encoding is a wrapper around the Base 64 DER</code> encoding of the certificate. Usually, when dealing with a specific certificate, you know beforehand whether it's encoded as DER</code> or PEM</code>. For example, in the opennssl</code> CLI, you can give it the -inform</code> parameter, which accepts either DER</code> or PEM</code>. However, what if don't know the encoding of the certificate, can you figure it out on the fly? Using bevy for the 2024 GMTK game jam 2024-08-20T00:00:00+00:00 I used bevy to build a small game for the 2024 GMTK game jam</a>. Having no prior experience with game development, this was a fun ride! How to work with !Sized types in Rust 2024-01-21T00:00:00+00:00 Sizedness in Rust is a peculiar topic. I recently found myself having to work with unsized types when trying to reduce the use of const</code> generics in the heapless</code> crate. Here I will document the approaches I considered and the pros and cons of each of them. Disabling IPv6 when an IPv4 only wireguard config is up 2023-06-01T00:00:00+00:00 On linux, when using a wireguard VPN that only supports IPv4, the wg-quick</a> scripts and NetworkManager</a> will not do anything regarding IPv6, which will simply go through the default gateway and "leak". It's not easy to reliably prevent this. Here is how to do it with NetworManager. How to disable a CSS stylesheet with JavaScript 2022-09-27T00:00:00+00:00 Contrary to what every website out there is saying, the proper way to disable a remote stylesheet imported with <link rel="stylesheet" type="text/css" href="/url"></code> is not to use stylesheet.disabled = true;</code>, it's rather to use stylesheet.media = "not all";</code>. Using disabled</code> on <link></code> element is not standard</a> and should be avoided. It doesn't seem to even work properly in chrome. Resolving merge conflicts when introducing formatting to an existing codebase 2022-09-22T00:00:00+00:00 If a project doesn't use any formatting tool, introducing them can be a headache, and is almost guaranteed to cause merge conflicts with any ongoing PR. Here's how to fix them.