Julien Roncaglia
@vbfox.net
Software developer 🇫🇷 🇪🇺
Mostly on Mastodon, https://hachyderm.io/@vbfox (Bridged at @vbfox.hachyderm.io.ap.brid.gy)
Mostly on Mastodon, https://hachyderm.io/@vbfox (Bridged at @vbfox.hachyderm.io.ap.brid.gy)
Reposted by Julien Roncaglia
Gouvernement Français % Any World Record
October 6, 2025 at 8:11 AM
Gouvernement Français % Any World Record
Reposted by Julien Roncaglia
Stream à 16h on a beaucoup de choses à se dire mdr
October 6, 2025 at 8:30 AM
Stream à 16h on a beaucoup de choses à se dire mdr
Reposted by Julien Roncaglia
Update on Protocol Moderation
Where account takedowns happen is important
pfrazee.leaflet.pub
September 18, 2025 at 4:47 PM
Reposted by Julien Roncaglia
Good lord:
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens - dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens that Microsoft uses in their backend for service-to-service (S2S) communication, called “Actor tokens”, and a critical vulnerability in the (legacy) Azure AD Graph API that did not properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.
dirkjanm.io
September 17, 2025 at 3:05 PM
Good lord:
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
"While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find."
Reposted by Julien Roncaglia
stop 👏 anthropomorphizing 👏 the 👏 chatbot 👏
July 20, 2025 at 10:18 PM
stop 👏 anthropomorphizing 👏 the 👏 chatbot 👏
Reposted by Julien Roncaglia
Oui, la canicule de 1976, c’était du pipi de chat. Un épisode aujourd’hui ridiculisé par la violence et la répétition des canicules de ces dix dernières années.
[1/4]
[1/4]
July 7, 2025 at 10:00 AM
Oui, la canicule de 1976, c’était du pipi de chat. Un épisode aujourd’hui ridiculisé par la violence et la répétition des canicules de ces dix dernières années.
[1/4]
[1/4]
Reposted by Julien Roncaglia
Les États-Unis cette nuit, en violation de tout droit international, ont bombardé l’Iran.
Quel sera le prix en retour de ces bombes ?
Trump et Netanyahou, deux dirigeants d’extrême-droite, sont en train de faire basculer le monde face à une Europe muette et paralysée.
Quel sera le prix en retour de ces bombes ?
Trump et Netanyahou, deux dirigeants d’extrême-droite, sont en train de faire basculer le monde face à une Europe muette et paralysée.
June 22, 2025 at 6:27 AM
Les États-Unis cette nuit, en violation de tout droit international, ont bombardé l’Iran.
Quel sera le prix en retour de ces bombes ?
Trump et Netanyahou, deux dirigeants d’extrême-droite, sont en train de faire basculer le monde face à une Europe muette et paralysée.
Quel sera le prix en retour de ces bombes ?
Trump et Netanyahou, deux dirigeants d’extrême-droite, sont en train de faire basculer le monde face à une Europe muette et paralysée.
Reposted by Julien Roncaglia
Even accepting the premise that AI produces useful writing (which no one should), using AI in education is like using a forklift at the gym. The weights do not actually need to be moved from place to place. That is not the work. The work is what happens within you.
April 15, 2025 at 2:56 AM
Even accepting the premise that AI produces useful writing (which no one should), using AI in education is like using a forklift at the gym. The weights do not actually need to be moved from place to place. That is not the work. The work is what happens within you.
Reposted by Julien Roncaglia
Les gens qui gueulent contre Hidalgo et les décisions dans Paris devraient regarder ce genre de cartes et voir la réduction absolument dingue des émissions de dioxyde d'azote en 18 ans.
April 12, 2025 at 4:55 PM
Les gens qui gueulent contre Hidalgo et les décisions dans Paris devraient regarder ce genre de cartes et voir la réduction absolument dingue des émissions de dioxyde d'azote en 18 ans.
Reposted by Julien Roncaglia
But if you want me to answer the question of "Can atproto scale down?" my answer is still: no. :)
ATProto still cannot scale down and scale wide, not towards meaningful decentralization.
Thanks for listening!
ATProto still cannot scale down and scale wide, not towards meaningful decentralization.
Thanks for listening!
March 20, 2025 at 1:10 PM
But if you want me to answer the question of "Can atproto scale down?" my answer is still: no. :)
ATProto still cannot scale down and scale wide, not towards meaningful decentralization.
Thanks for listening!
ATProto still cannot scale down and scale wide, not towards meaningful decentralization.
Thanks for listening!
Reposted by Julien Roncaglia
TypeScript team: rewrites compiler in Go.
Go community: what do you mean your new compiler takes more than a minute to compile? Unacceptable. Dishonorable even. We are so sorry for this sub par experience. Not how we do things around here.
Two days later: WIP 5x speedup.
HN: why pick Go anyway?
Go community: what do you mean your new compiler takes more than a minute to compile? Unacceptable. Dishonorable even. We are so sorry for this sub par experience. Not how we do things around here.
Two days later: WIP 5x speedup.
HN: why pick Go anyway?
cmd/compile: slow escape analysis in large package in the typescript compiler · Issue #72815 · golang/go
Go version go version go1.24.1 linux/amd64 Output of go env in your module/workspace: AR='ar' CC='gcc' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_ENABLED='1' CGO_FFLAGS='-O2 -g' ...
github.com
March 13, 2025 at 12:53 AM
TypeScript team: rewrites compiler in Go.
Go community: what do you mean your new compiler takes more than a minute to compile? Unacceptable. Dishonorable even. We are so sorry for this sub par experience. Not how we do things around here.
Two days later: WIP 5x speedup.
HN: why pick Go anyway?
Go community: what do you mean your new compiler takes more than a minute to compile? Unacceptable. Dishonorable even. We are so sorry for this sub par experience. Not how we do things around here.
Two days later: WIP 5x speedup.
HN: why pick Go anyway?
Reposted by Julien Roncaglia
269% !!
Arrivera-t-on aux 270 % avant ce soir ? Aux 300% avant la fin ? Le suspens est INSOUTENABLE !
Mais sinon, vous, vous pouvez toujours précommander le tome 2 de Pour Quelques Moutons de Plus ici : www.exemplaire-editions.fr/exemplaire/p...
(ou RT, ça aide bien, le RT)
Arrivera-t-on aux 270 % avant ce soir ? Aux 300% avant la fin ? Le suspens est INSOUTENABLE !
Mais sinon, vous, vous pouvez toujours précommander le tome 2 de Pour Quelques Moutons de Plus ici : www.exemplaire-editions.fr/exemplaire/p...
(ou RT, ça aide bien, le RT)
February 25, 2025 at 12:16 PM
269% !!
Arrivera-t-on aux 270 % avant ce soir ? Aux 300% avant la fin ? Le suspens est INSOUTENABLE !
Mais sinon, vous, vous pouvez toujours précommander le tome 2 de Pour Quelques Moutons de Plus ici : www.exemplaire-editions.fr/exemplaire/p...
(ou RT, ça aide bien, le RT)
Arrivera-t-on aux 270 % avant ce soir ? Aux 300% avant la fin ? Le suspens est INSOUTENABLE !
Mais sinon, vous, vous pouvez toujours précommander le tome 2 de Pour Quelques Moutons de Plus ici : www.exemplaire-editions.fr/exemplaire/p...
(ou RT, ça aide bien, le RT)
Reposted by Julien Roncaglia
Took me a while to see it, but it’s a simple vulnerability.
The API takes messages as hex strings like “AB12” and passes them to the bignum library.
That library supports negative numbers like “-AB12”.
However, the sign is dropped when calculating the nonce. Different messages, same nonce 💥
The API takes messages as hex strings like “AB12” and passes them to the bignum library.
That library supports negative numbers like “-AB12”.
However, the sign is dropped when calculating the nonce. Different messages, same nonce 💥
February 16, 2025 at 10:08 AM
Took me a while to see it, but it’s a simple vulnerability.
The API takes messages as hex strings like “AB12” and passes them to the bignum library.
That library supports negative numbers like “-AB12”.
However, the sign is dropped when calculating the nonce. Different messages, same nonce 💥
The API takes messages as hex strings like “AB12” and passes them to the bignum library.
That library supports negative numbers like “-AB12”.
However, the sign is dropped when calculating the nonce. Different messages, same nonce 💥
Reposted by Julien Roncaglia
Since we don't have polls:
Repost if you want _less_ generative AI in your tech in 2025.
Repost if you want _less_ generative AI in your tech in 2025.
December 22, 2024 at 5:37 AM
Since we don't have polls:
Repost if you want _less_ generative AI in your tech in 2025.
Repost if you want _less_ generative AI in your tech in 2025.
Reposted by Julien Roncaglia
Blogged: StackOverflowException vs. OutOfMemoryException.
This is the first blogpost in a series, based on recent production incidents I was investigating.
sergeyteplyakov.github.io/Blog/csharp/...
This is the first blogpost in a series, based on recent production incidents I was investigating.
sergeyteplyakov.github.io/Blog/csharp/...
StackOverflowException vs. OutOfMemoryException
I was investigating crash dumps for one of our services and faced a puzzling group of crashes. These crashes were caused by a StackOverflowException with relatively short stack traces. It wasn’t due t...
sergeyteplyakov.github.io
December 11, 2024 at 5:27 AM
Blogged: StackOverflowException vs. OutOfMemoryException.
This is the first blogpost in a series, based on recent production incidents I was investigating.
sergeyteplyakov.github.io/Blog/csharp/...
This is the first blogpost in a series, based on recent production incidents I was investigating.
sergeyteplyakov.github.io/Blog/csharp/...
Reposted by Julien Roncaglia
Visual Studio 2022's splash screen shows up approx. 100ms later than Visual Studio 2013 manually testing it.
This was confusing to me after I traced it, as relative to their main method entry point, they both take about the same amount of time to render and show the window.
What was going on?
This was confusing to me after I traced it, as relative to their main method entry point, they both take about the same amount of time to render and show the window.
What was going on?
November 18, 2024 at 1:08 AM
Visual Studio 2022's splash screen shows up approx. 100ms later than Visual Studio 2013 manually testing it.
This was confusing to me after I traced it, as relative to their main method entry point, they both take about the same amount of time to render and show the window.
What was going on?
This was confusing to me after I traced it, as relative to their main method entry point, they both take about the same amount of time to render and show the window.
What was going on?
Reposted by Julien Roncaglia
Si vous voulez du mindblown, regardez comment on respirait juste avant de naitre, c'est *vraiment* fascinant youtu.be/6BwM0SNubv0
Comment respirait-on avant de naître ? C'est vraiment fou !
YouTube video by Scilabus
youtu.be
November 18, 2024 at 2:49 PM
Si vous voulez du mindblown, regardez comment on respirait juste avant de naitre, c'est *vraiment* fascinant youtu.be/6BwM0SNubv0
Reposted by Julien Roncaglia
it's so funny when bluesky automatically labels most screenshots of gay men kissing as "sexually suggestive" lmao and you have to appeal the app to get that label removed. framing pg or pg-13 queer intimacy as inherently explicit is literally a conservative talking point like what are we doing
November 14, 2024 at 6:35 PM
it's so funny when bluesky automatically labels most screenshots of gay men kissing as "sexually suggestive" lmao and you have to appeal the app to get that label removed. framing pg or pg-13 queer intimacy as inherently explicit is literally a conservative talking point like what are we doing