Lightning talks

Speaker 1: Glenn, take it away.

Speaker 2: Yeah, I'll be brief. Hello everyone. I'm here to talk about an another PyCon conference that will be held in uh Italy, Bologna. from June 2nd to June 5th. And we are expecting a hundred a thousand attendees 100 speakers and it will be in English. There will be joining. There will be a around 40 countries that will be joining us. You're welcome to come. This uh non 2027 we will have our 20th anniversary, so expect some surprises that are coming. Here are here is the QR code for the early bird tickets if you want to join early.

Speaker 2: And that's it.

Speaker 1: Let's give Glen a big pause. Tommy And then Paris. Sorry.

Speaker 3: Thank you. Uh hello, I'm Tom. Um I'm on the board of the Giangle Software Foundation. I also do some other things. One of the other things I been doing recently is making this uh package uh for I would say better login rate limiting. Um so a bit of background about this. Uh about two years ago I wanted to get something like this into Django Core. Uh so I wrote like a very basic version of this package and I said on the forum, hey I have this This uh I have this uh package, I think it should be in core. And then the answer was nah, we should do something more generic instead. So uh fast forward to fast forward to um a couple of

Speaker 3: months ago. Um We had the pen testers in at work and we were using Django Access like everyone else to do uh login rate limiting. And the pen testers said I should probably use device cookies. So I went back to this old project and essentially used the AI to tell me everything that was wrong with it and rewrite the entire thing for me, essentially. um so what's it what's it better than well i i said already uh in in my opinion it's usually going to be better than django access which is what most people are probably using So you're probably either using that or you're not doing any rate limiting at all. Uh and if that is the case, please try this package out.

Speaker 3: It's I can guarantee it's very It's very stable. I've been using it at work now for about 30 hours. So I'm pretty sure it's uh it's good. So uh Django access by default, it uh will rate limit by IP address only. So that means that if you're in the office and someone in the office fails to log in three times or however many times Nobody in the office can now log into their account. Not amazing. You can also do it by username, which means that anyone on the planet can now stop that person from logging in just by trying to log in three times. Or you can do it by IP address and username, which is a little bit better, but um it's not very resistant if you have like an attacker with a botnet that can just generate Machines with like thousand different IP addresses

Speaker 3: doesn't quite work. So why are we trying to do this in the first place? We don't want people trying to guess everyone's passwords. Um getting into people's accounts by like looking at have I been pwned and grabbing all the public data breaches out. Not great. We want to do this without um basically without blocking legitimate users from logging in as well. So how does it work? This is my one LLM generated slide. The rest are all me. So anytime we log in, or you um go through the password reset flow, and we'll get to that a bit later. You get a cookie and that cookie is bound to your to your account. And um Yeah, so if someone then later comes and tries to log in as you

Speaker 3: Um it won't lock you out because you have this cookie, this magic cookie that lets you log in on that device still. So you don't need an IP address, so you don't even need to store a user's IP address, which might be a concern for like GDPR and stuff. If you don't have a cookie, then you go in this untrusted bucket per account and then you can kinda you can kinda lock people out of their account. Which is the yeah, the third limitation here. The other ones. Um because I didn't want to do roll locking in the database. Uh you can actually exceed the amount of times you're allowed, really, just by doing it really fast or in parallel. But you you can't keep doing it forever. Uh most times when you log in you have a request object, so you're good.

Speaker 3: But if you're doing something weird without a request object, then obviously we can't set a cookie. So that doesn't work. And if you do um lock someone out of their account, they can still get back in. By asking for a password reset and they just have to click the link. They don't have to actually change the password, but they then get a cookie because they've confirmed that they have that email address. So it's quite resistant to people getting blocked out of their account, but it's not perfect because yeah, you have to give them an error message saying You have to go and do the password reset, but not reset your password. Which is a little weird, and I would love to solve that problem a bit better, but I don't know.

Speaker 3: So yeah, please go here. All of you that are in those two groups of um people that are using Django Access or not doing anything at all, uh install this, it will work perfectly. Uh I can assure you. Thank you very much.

Speaker 4: Alright. Thank you very much for allowing me for a second time to get on stage. Nice t-shirt, by the way. The the junk on Europe Athens. So um I'm gonna talk about uh server sent events here. So is anyone building uh junk applications here that have to pull the server to to get um In real-time data? Okay, this ends today. So um I I have to be honest, uh I have a cousin, Costa, great programmer. And he was trying to to get me to get off WebSockets because he was telling me when you just need to send some data from the server, they are an overkill. You can use server sent events. I said I don't like the idea.

Speaker 4: Um because looked a bit flaky and I was wrong. Because server send events, they're amazing. I didn't know that they are just a normal HTTP response with the appropriate headers so that uh the client and the proxying, you know, and all these um uh you know components in in the pipeline they know to keep the connection open. So um it's one HTTP response, you set the content type, and it's one direction. Server to browser. We used uh server cent events to send in real-time logs in Facos, our new observability tool and this is how it looks pretty much. It's uh a three lines ID for the event um You can add some more metadata here, a comment below, and the data.

Speaker 4: This is what This is what uh you want to send us a content. This is your actual payload The the format is name, key, value, whatever. And you can have lines without a name, just a column means it's a comment. And end of line means uh it ends a message, no frames, text, UTF-8, and We created the data class here, which is the server cent event with all those nice things here. We you know the attributes I showed you before. We have an encode. Method that just, you know, encodes it the way uh the browser needs it. That sorry, the Django server needs needs it And a new line, as I said before, is a delimiter, so there are no new lines to add to anything other than uh data.

Speaker 4: In the case of data, it breaks in multiple keys. This is how it looks pretty much. We have implemented a server-cent events response uh subclass of the streaming HTTP response class. Um pretty straightforward. It's um the the only I I would say exotic thing here is that we say do not cast this and a custom Nginx header to avoid Buffering. This is it pretty much. And this is how sorry, finally, this is how this would look. You would have an asynchronous iterator and you would return a server cent events response um with your iterator and every time it yields um

Speaker 4: it returns the result so you add this Super package that we put everything that we want to push at some point upstream in Django. You import server cent event, the server cent event response and use it that way. Thank you very much for your time.

Speaker 1: Then we have Sarah. With a very large PDF.

Speaker 5: Yes, it's a big PDF. I'll try to be I'll try to be fast. Uh it's mostly pictures. So uh this is about hacker camps. Um and I mainly do that talk. I go to a lot of them. Uh and I think a lot of people who would generate Genuinely enjoy going to hacker camps and similar events, do not know it's for them. Um you can sort of imagine it a little bit like a scout chambere. We have a lot of people doing like Scouting stuff, but then we have also very high speed internet straight to people's tents. Actually Bonhec Bonheck is in the Wikipedia article about uh IP to tent. Um Yes, that's basically it.

Speaker 5: Very fast, and that leads to very relaxed nerds and hammocks and in tents that are hanging out and are nerding together. Um In all kinds of uh in all kinds of areas. There is hardware um as well as software at at at hacker camps. We have these batches that are like little devices that do something. thing. Right now the really hype thing is uh mesh networks so we'll you will find a ton of batches that are doing something with mesh core mesh test But it can be all kinds of things. You can see here the uh somebody is uh taking the speed of their train with their little batch and all kinds of really, really fun things

Speaker 5: Um there's robots. There's uh this is one of my favorite. This is uh world of techno. Uh it generates music based on its geographic location, so you can walk around with it and uh die Soundtrack changes. Um yes, there is also Software. Oh. Oh. Yeah, it it is a big yeah I I now it has skipped to so there is a lot of light, yes. It's very slow. My laptop can easily Do this. Anyway, yes. We have software also and it works. Um there is like game jams, uh all that kind of stuff there, little hackathons on all kinds of things.

Speaker 5: There is meetups. Uh this this one is called a pixel flood. It's a lot of fun. You can send You can set a pixel by sending a a packet in a specific color so everybody fights for this screen space with their graphics There's a lot of light, uh there is a ton of art, uh, there's all kinds of stuff. Uh a lot of the people that go there are actually not necessarily uh that much into computer computers. Um yeah, and like I think the reason a lot of people don't go to hacker camps is because they think I'm not a hacker. Um but I think the definition of a hacker is perceived very often wrong, like people think it's somebody in InfoSec

Speaker 5: or some such thing. Uh but that doesn't have to be at all uh the case. You you might be hacking wood, that is the classic Holzhacker. Um you might be hacking language. We have people speaking Tokipona and Esperanto and uh doing all kinds of things. It could be a hacking beer. This is a very nice Cisco beer router from our friends in Anderstop Festival There's bleaching t-shirts, making jewelry from electronics music from spreadsheets, just many, many good things. It is run by these uh beautiful volunteers. Um yes, you should absolutely bring your kids.

Speaker 5: Uh it's it's awesome environment for kids to be in. They learn a ton of things, they go around and do things and everybody just makes stuff happen like your kid is gonna come and then everybody makes everything happen. Uh because we're so happy when they're around. Yes this is some old uh hashtags this is uh I did not update the slide because I only have this in PDF and it's horrible to update. But this is a couple of the ones that are happening uh across Europe. They have various sizes and uh but most of them are absolutely lovely. I mean I assume actually all of them are lovely. I just haven't been to all of them.

Speaker 5: If you really don't like the outdoors, things like that also exist indoors. I could also only come up with these two uh CCC events, but there is there's Plenty of these of these events out there. Yes.

Speaker 1: Then we have Lewis and then Ivers Lewis, I think it was Lewis. Maybe I couldn't Yeah, cool. Stop it. Thank you. Can you take this?

Speaker 3: Uh yeah, I'll see. Yeah, thanks. Whoa, whoa, whoa. Okie dokie. Hello everyone. I'm Lewis. This is my first presentation outside of school. And I also made it during my lunch break, so please bear with me. No, how embarrassing it's all gone wrong. Fuck. Excuse me. So uh but now I need to see it, so how do I do this? Uh yeah, yeah, yeah, yeah, yeah. Alright, now you'll never know what I'm looking at. Okay. And let's Let's do this.

Speaker 6: Do I get an extension on my time? Thank you. Okay, so I'm not reading off a script. But I'm a programmer, I'm sure I'm not alone when I say I'm a bit dissatisfied with the current state of programming. um at the moment. And I'm not going to go into the whole AI took my job part of the conversation because I don't have anything to add to it. We've heard it all before. But I loved programming in my spare time, but now it feels a little bit uh fruitless since the advent of AI. So I've pivoted a little bit into DevOps and Kubernetes. So this bad boy is a four-node Raspberry Pi Kubernetes home server. I run a bunch of uh Django projects on it and I would encourage you all to experiment with this.

Speaker 6: as it's never been more accessible before. And here's one of the projects. It's my girlfriend's laptop. Basically I ripped it apart and created this carpentry monstrosity. But this is yeah, some some little uh what do you call it weather uh thing that I made. Very cool. And it was great uh for a while. Um and then I got a message from my friend and this is actually the video that he sent me um on discord uh and I'm gonna play it hopefully you get the sound it'd be great if you did. All right, you don't get the sound. But uh sorry Sam. Um he basically uh is talking about how there's two Um video games which look awfully similar to one another.

Speaker 6: You've got museologists tidy up the museum and Dino Bones tidy up the museum. Oh, maybe it's because I haven't played it? No, it's playing. Here it is. Um and he's just basically in his uh own way saying uh this is the same game, what the hell's going on? Uh and that is Is that so? It turns out it has a name. Um it's called copy slop. And uh AI it turns out is really really good at reverse engineering client-side code. So, uh, has anyone played skate three by chance here? Skate three? Anyone? Oh one? Okay. Great game. Okay, one person, thank you. Um great game. Someone copyslopped it and made it in Rust. And when I first saw that, I was like, this is really cool. Because uh you get like 600 FPS and you can drive like a a Mario Kart, you know, like

Speaker 6: car in it. Like they fully modded it. Um but then I was a bit sad because it seems like we probably won't get another skate game uh if people can just do this. uh nowadays. So um how do we defend against reverse engineering AI? Uh we're obviously backend engineers, so Maybe we think it doesn't matter too too much. Um and I don't expect anyone to really have the answer. I certainly don't. Um but I thought it might be an interesting discussion worth bringing forward. forward. But a tech billionaire once said, uh in the future our phones won't do the thinking. They'll just be screens and AI will be a box somewhere and it just streams the content to the phone and the phone is just you know like a visual aid it's just the pixels it doesn't really do anything there's no CPU uh on it anymore

Speaker 6: calculating stuff um so this is more about where the secret source kind of lies and the main kind of point of the discussion is maybe we need to bring the secret source completely to the back end so maybe your tasks end up being a little bit more or uh front end being generated on the back end. Who knows at this point? But maybe we need to do it a bit like multiplayer games and how they are tackling cheating when people cheat. It's all client side code. Uh maybe we need to bring it a bit more authoritative, where you have an authoritative server, if anyone knows. what that means. Um so instead of the clients deciding whether you know a bullet hit another player, it's the server that decides and confirms it and sends it to all of the clients.

Speaker 6: clients effectively. So maybe, who knows, in the future our APIs or responses might not look anything like this. We've You know, reveal discount rate. 15. That's reverse engineerable. That's your secret source. Everyone knows about it now. Perhaps the API looks a little bit more like this, uh obfuscated and what do you call it a little bit more you know this sector of this screen should look like this and this obviously isn't a solution it's it I mean people could just record uh you know the user flow and then they have your uh what do you call it secret source that way but they're all talking about moats nowadays uh the what do you call it um investors.

Speaker 6: So if you have no moat, um yeah, you don't really have anything at the moment. That was it. If you have any questions, we don't have questions now, but um chat with me uh because it's an interesting uh conversation. Thank you everyone.

Speaker 1: Yes, Ivers and then Marike If it's gonna work? Fingers crossed.

Speaker 7: Okay, so this is a strange title for a talk, but uh just keep in mind I did this talk on my way to the PyCon in France. And I actually did this talk in PyCon inference and I came back all good, so well except I uh resigned from my work. during the same conference but this unrelated so uh there's this movie the king on netflix about the henry the fifth and then the battle was battle of Asian core or something like that, the battle in France. And uh I watched this movie after reading about some cyber attacks, so That inspired me.

Speaker 7: So there 's this inspirational speech bit uh before the battle and it's something like England is you And it is the space between you. Fight not for the yourselves, but f fight for that space. Fill that space, blah blah blah, and then uh make it yours, make it England England, make it England. So let's make it England Uh so I have this short Python code. Starts with Eval. So what it does, it actually prints England. So it's Eval of the speech. So how does it work? Let's take it apart. So first, so obviously it looks like this formatted, so it's

Speaker 7: uh So what happens there? So it it generates a string that says sprint England. So it generates that creating characters from integers And so this uh yeah, so and then joining them together. So then this int uh with base two, it creates integers from the binary numbers. So it here are some samples of integers. Then how do these integers come? So those are grouped, uh ones and zeros grouped into groups by of eight, so a byte. And then uh and then these ones and zeros

Speaker 7: are created from uh String version of integer of Boolean. So basically Boolean converts to either zero or one. Now the real question is what the hell is this? So if you think about this line, how does it work? Why does it prov uh what kind of uh if C is greater than space and if C is less than space then it's and it's just pro uh produces this true truth and false uh so the answer to that is uh in the space between the words so there are a lot of funky unicode characters and then the There are like spaces and uh there's this one is called filler

Speaker 7: and then is one is like half filler and they both are available. So actually what you don't see is that it's Some special spaces, it's not not a regular space, there are different kinds of spaces. And then it kind of starts making sense. And then the whole text, of course, is filled with these special spaces And yeah, kind of I filled that space and I made it England so

Speaker 1: Yes, then we have Marike and then Belta.

Speaker 8: Not sure if this one works. I I have the screenshots, but There we are again. Um we're actually going back accidentally to my previous code. Um this one I always do, um when I make admin uh Pages or when I make models I always put like tests on the admin pages just to see if there's a HTTP 200 when you do a GET request. This is the quickest way to see if you messed something up in your model. So I'm not testing if the admin works

Speaker 8: Because that works like I trust Django. So for example for my to-do app I had all these pages. Like I had a change list app, blah blah blah blah blah blah blah blah. Um and I kind of have to reverse all these paths and do a GET request. And has anyone ever used loops in unit tests? Well, you technically shouldn't, but you can with something very awesome called subtests. Um Let me comment this for a moment. This is really hard with one hand. Ignore the race system exit. I have

Speaker 8: a little For loop here, which reads Oh, there we go again. This this git lens has been the bane of my day today. It's my goodness. I have a very I have a oh shut up dude I have a for loop that loops through all these paths so I have a path name path name and the arguments and Normally you shouldn't do loops in in tests, but here hidden in this cute little line is a context. manager for subtest. There's actually also a suppression in there you can ignore the suppression part because that's another context. A subtest turns

Speaker 8: your test into multiple tests. And it's really cool, you can give it like any type of keyword argument. In my case, I give it a path name to distinguish it. So just to show you Spoilers? These are spoilers. I also cannot type. So just to show you that these things work. By the way, I use just just files are awesome. Check them out. But that aside. So I have 14 unit tests that pass. And if I make them fail again, I love race system exit. It's one of the best ways to crash your app

Speaker 8: You get all these errors. And there's a whole lot of text in here. Let me do this again. But you can see it's just one test that failed, but you can see lots of errors. That's because all the subtests also failed And it shows you, oh, error, this test failed, this is the name, this is the whole path, blah blah blah. And here's the identity unique path name one. This is super useful if you have like a loop. And this recently also landed in PyTest, which is awesome because I love PyTest. And the funny thing about subtest is you can do use instance variables because

Speaker 8: I love PyTest parameterize. Anyone heard of it? Yes, it's awesome. But it's a decorator and it cannot take instance. variables but with subtest you can do it and somewhere not even too long ago they added subtests to py test as well which is amazing but in this case I used unit test So subtests, awesome, use them, try them, really cool stuff.

Speaker 1: We have Belta, then Silas. But

Speaker 6: uh I like that the two people with the most HDMI problems come up But at the same time my laptop somehow okay. Yeah. No pressure. New pressure. Yeah. Um let 's see if I can Here we go. Um so uh

Speaker 3: thanks to Mohammed for bringing up the topic of pre-commit.

Speaker 6: Um I will not uh spend any time explaining what it is. Um but Uh I have an aspect of uh using pre-commit because I've been using it uh for as long as I can remember. Um That um it's uh it it feels unsafe. Like you run things directly on your developer laptop and This one contains secrets for various things, uh in uh uh to an extent that I I I know that there's other ways to solve this. But let's just say that it worries me that I would uh run a bunch of things that come from some Git repositories

Speaker 6: and they're kind of uh um

Speaker 3: unvetted sometimes. So um and and and git repositories aren't really uh software uh um or package management uh solutions

Speaker 6: that kind of lack some security features that we that we have for other

Speaker 3: things.

Speaker 6: Um so the concept here is that instead of just running pre-commit directly

Speaker 3: um and installing it directly um for

Speaker 6: various uh

Speaker 3: uh conveniences

Speaker 6: uh I installed a global pre-commit always so

Speaker 3: So I didn't have to install it again and again for every project, but I could keep one pre-commit updated.

Speaker 6: I want to continue doing that, but instead of running pre-commit directly, I want to run it in Docker. I'm not saying that Docker is a perfect sandbox, but it gets you uh some decent way. And the the idea then is that pre-commit when it's running should only be able to access the project that it's running in. So if it does get somehow exploited, you have a malicious hook running. At least it doesn't also immediately go and snatch your SSH keys. Then it has to break through Docker. Um and this is how it actually looks. Um I just wanna highlight that um It does have a consistent uh pre-commit cache.

Speaker 6: So we can run the same thing again and again. It's not gonna be slow. And I'm actually using it, and it is actually fast. Um and uh then you can also uh define these things that kind of circumvent the most common uh dogger uh Dogger um permission issues with files and and folders because precommit does often edit uh files by adding uh little PT ID and PUID there. Um and that's picked up by um some stuff that uh oh that was Too fast. Okay. Listen, uh it it's on my blog.

Speaker 6: Um there's a little bit more motivation, and uh there is a git repository where you can find the script that gets you starting with this and it's very easy to actually get started and uh I I really recommend uh trying it out and I hope to hear some more feedback 'cause this is the first time that I try to present it on a on a stage. All right. I have one more minute. All right. Um yeah it does uh have neck network access because it needs that to like download and install all of these uh pre-commit hooks. Um I I would I don't know how to uh get around that.

Speaker 1: Yes, then we have Silas and then Dennis.

Speaker 6: Can you see what's on the on the up here? Okay, I just want to bring something really down to earth. I like this idea. We all do that things are generic and uh The crowd talk also taps into this. Thank you for that. And especially in the beginning when I was doing Django, I found myself creating HTML file upon HTML file. upon HTML5. Yeah. Many HTML files. So at some point I just thought, well

Speaker 1: I want to make a more generic HTML file for my form, create and update forms. And this is it. So I just want to show it to you. Hopefully, if you're new, you will find it inspiring. If you haven't made some generic HTML forms, you can do it. Um weekle? So if I can't show it now I've just told you and go home and do it So oh ah what So wiggle the mouse.

Speaker 1: I I just okay, cool. Okay, so um so this is just it. Uh a regular HTML file. And uh um what I did is uh that uh When you use these generic um HTML files, where do you put the things that are different And uh most often you just have to put them in the context data. Let me just show you an example of a view here.

Speaker 6: It's just um a regular uh uh form with a form class and template name and then I put the generic form there HTML and then you could put some stuff in here that you want to do I in this file I haven't put all the business logic that we have where I come from but I just put some examples uh backual if you if URL if you want to go back uh Custom form title if you want that and maybe some extra panels uh below the form. Um Yes. So this is it. I start with some

Speaker 1: bootstrap divs and then you can see if I've provided a form title, it will just print that Else I want to display if I'm updating or creating something and I do that based on the primary key Often we don't really want to delete things, so that will be an update too. And then I just uh set uh a delete action to true. Um yeah, times go fast. So uh um so but we create uh update something And then we write the class name of what

Speaker 1: you are handling and I've done a little filter here. And then if it's a primary key, I will just print what it is we are handling Yes. And if I just go down, you will see that this is just a regular form. You have the form messages and the token. If it's a form set You'll just show the form and down here you have the submit buttons. There's a regular one. Um if it's a delete action, you might want to use custom text for your delete or just a delete uh button and if uh it's not a delete action it's just a s a regular submit button

Speaker 1: unless you have a custom text sent in the context data. You can put some extra button. Yeah 60 seconds I'm there. Um Uh there's the back URL. If uh a back URL is not defined I uh I go and uh uh Using a naming convention that we use so I can just calculate what the back URL will be, the class name to lower, and then Just detail if it's an update or list if it's a create when you go back. You can put a custom button. There's your extra panels And then I also

Speaker 1: have a date picker module. So to date fields, you can just put a class in and then you have a nice date picker in your Generic form. Yes, and last there is a submit on enter disabled. That means that when you push submit, then you're done. And it won't submit twice if you push twice There you go. Yes, then we have Dennis and then we have Ivers for a second round, if he's up for it. I have that one. Yeah, I I wanted to type also.

Speaker 1: Hi, I'm Dennis and I want to browse the web with you.

Speaker 3: We Django people like personal blogs that are not on some other platform, so many of us have websites. And let's maybe look at that website. That's a Carlton. He seems to have redone his website. How do we know to trust this guy and that this is even a real human writing there? I've no idea, but If you say you trust my judgment on if other people might actually be writing on the internet. Then you see a little plug-in uh there which shows a blue dot. And that is there because there is a human JSON included on that side.

Speaker 3: And when I decide to trust my own site, this and reload that thing, it turns green because I trust that site. And in that document, I also said that I trust this Kalan guy that he is doing writing that he's actually doing and not just prompting an LLM or something. So it's green here. And let's look briefly at the magic behind that. It's not really that much magic. I am also reading the blog of Malikasins quite some time. And it's gray. I don't know uh what is happening there. Let's also or I want to reference that block that this

Speaker 3: seems to be written by a real human. So what we are doing is on my website looking at the source, looking to the hat. Can I even zoom that in? Yes I can. There's a link rel humanjson pointing to human. json, which then points to that static file. And what I'm doing now is just add a new entry. Okay, that's actually stressful to do in a lightning talk. Uh, let's copy that URL in

Speaker 3: So I am vouching today for this. It's the third, right? Second. Oops. Okay. So let's vouch for her. Let's commit that and push it. That should Awesome. Okay, let's do this very quick. Did I already have the two minute mark or no? Okay. I think we can do it.

Speaker 3: Okay, let's do the rebase, push that. Awesome. So the pipeline takes 38 seconds approximately. And Behind that is a project called Human Jason, also hosted on Marik is favorite Code Burke, it's basically just that we as humans can vouch for other humans, that they're doing actual writing and build like a web of websites pointing at each other. Pretty simple, it's basically that JSON file. Now did the pipeline finish? Yes it did What could go wrong?

Speaker 3: Okay. Pot 's restarting. Awesome. Let's visit that site again. And now visit Marike again. And it didn't work. Nice! Okay, that should be green now, but who knows why it's not working like that. Maybe also use that, then we have it a little bit easier if we anyone knows one of us to know that there are actual humans writing stuff. Thank you

Speaker 1: Then we have Ivers as the last lightning talk and last speaker for today.

Speaker 7: Okay , so this is another a bit like cybersecurity stuff, but this is actually inspired by this page doubt. This is like magazine on the internet with the interesting kind of hackery like stuff. So there was a solution kind of uh problem for Python so there's the function called solve me It pa it receives some other function, it calls the function and the goal is to get this solve me function to print out this solved. But obviously we do like delete the result and then we check if the result That is true. So uh there are several ways how to solve this. Uh so my favorite one is So obviously it can be solved.

Speaker 7: So the favorite one is this one. I cleaned it up a bit from the original and I made it work with the Python 3. 12 So it's even not that large, so let's just break it down. So this is like formatted file. So let's go line by line. It's not that crazy. So first uh we are reading this uh process file system. So we are reading process self maps. So the self here is refers to the PID of the process itself, so it's a simlink. So it always points to the self-process. And we read maps and then we split each line on the white space and then we uh split the first field on this minus sign and we look if the

Speaker 7: there's W in the second field. So what this uh file contains is the address range of the process And so it starts with address range and then they we are looking for this writable bits. So the end goal of us for us is Yeah, so we are selecting those highlighted lines. Then what we do we Convert hacks into numbers and we uh open another uh process file system file. It this time it's self-mem, so it's the memory of the process itself. And then we read from this memory. But first we do this g.

Speaker 7: seq at the end, so we go to certain location and then we read. Some number of bytes. So why why do we have to do that? So this memory represents the whole like 64-bit process memory space. If we just try to read it, it doesn't work. That's why we got the maps, so we got uh ranges that are actually assigned to something and I will kind of like I know that we are looking for this heap Uh without like some extra hints, but we just know that heap is also writable and there's some range of it. So once we read the data from this writable region, we are looking for the actual Python bytecode for this solveMe

Speaker 7: function. Uh there are some changes, so before uh Python 3. 11 it it was the code actually that was executing. was called C O code. Uh since 311 it's underscore C code adaptive. So we are looking for this adaptive code. So we find are actually locating the function itself in z in the memory. And then we are overwriting four bytes. But first we seek to this specific location some X and Y and the magic number 18. So the question is why 18 and why four bytes? So this is the kind of Python code. If we dissemble it into the bytecode, then at the offset

Speaker 7: two we have like uh four bytes uh which what they do is they uh perform the truth comparison and then perform the jump. We could also target this deletion of the result And that would be offset 16 and 2 bytes. So yeah, and this magic bytes 09, those actually are bytecodes for no operation, nope. So in the end we the code that's executing is like this and so that's how you solve it

Speaker 7: Yeah. Yeah.

Speaker 3: Sorry about that. Um where is the HDMI cable? It's on the floor. Okay. So it's been a super nice day. Um that was the end of my lightning talk um and somewhere in another browser tab thank you since i can I can't use the mouse because I can't see what's going on. I will try to do it like this. Very okay. And No pressure. Yes. Yes. All right. We wanna uh close the day in a

Speaker 3: in a in a proper way. Uh we have a party after. that again um by uh just saying a few couple of things uh before we we we let you go but uh maybe also um Mentioning uh photography before I forget that too. But uh let's say thank you to everyone who's a corporate supporter uh of this event.

Speaker 6: Thank you to Semaphor, thank you to Skypuzzler, Xam Vision, Foxley Talent and Ticket Butler. Let's give them a big applause. Thanks And to uh everyone who came here and spoke today, thank you so so much. Uh including uh lightning talks. I think that we have a Fair share of speakers in the room today. And also uh we passed our talk number 50. If you count the number of talks that have been on Django Day and are now on uh on YouTube. So we have a 50 talk anniversary.

Speaker 1: Yay. And

Speaker 6: thanks to all of you. And thank you to the organizers, which by the way are me and Vidya and Megelda in the back and Sarah and uh

Speaker 3: yeah

Speaker 1: and we 're

Speaker 3: who couldn't be here today.

Speaker 1: Yes

Speaker 3: And thank you to Union, which especially goes out to

Speaker 6: uh

Speaker 3: Fernando sitting behind

Speaker 6: uh

Speaker 3: a lot of buttons and cables doing the streaming, making sure the sound is great.

Speaker 6: Making sure to remind people to put the microphone in front of their mouth. And yeah, so we're almost done with all of this. Please note that

Speaker 3: everything will be shared later. So we have the streaming is live and so on, but then we'll chunk it up and upload each individual talk so you can uh watch it again and share it with others who couldn't be here today Um and Django Day, do we do it again? Yes, of course.

Speaker 1: Of course.

Speaker 3: Which uh just to uh there's no surprises here really. It's gonna be next year, it's gonna be in the fall. Uh Yeah. But uh we'd love to uh meet new organizers, so uh please uh let us know if you want to be part of this. This can be, you know, like uh finding a program. Um And and being here during the day or like helping to organize it before we start or yeah.

Speaker 1: It's quite low effort. Yeah, okay. Yeah. But it's nice to have help on the on the day itself and the day before. That's when we do a lot of stuff.

Speaker 3: And uh thanks to everyone who uh submitted a talk by the way, that helps tremendously with doing uh an event like this when people submit talks so you know you have a program. So thanks once again for that.

Speaker 1: So hit us up on Sulip if you want to help out.

Speaker 3: Yeah, and uh

Speaker 6: of course we have a party and that party is going to be here but we are going to reorganize a little bit um and uh also uh everyone should probably eat some food. Uh so that's why it starts in uh what is that?

Speaker 1: Two hours. Two hours, yeah. Um and uh are we aiming for

Speaker 6: pub quiz?

Speaker 1: I don't know. Nobody's has planned anything. Yes

Speaker 6: Alright.

Speaker 1: Thanks. Maybe. Maybe someone's gonna do it. Okay, there's half a ban. Cool. Nice.

Speaker 6: Alright. And two hours to uh to make it happen.

Speaker 3: And um

Speaker 6: yeah then uh I think that uh the closing time is like kind of

Speaker 3: around eleven. Uh

Speaker 6: the party here ends. Uh but we know that uh of course people don't get tired of talking about Django and meeting new friends.

Speaker 3: friends and so on. So

Speaker 6: uh we're gonna head off uh after that uh whoever can walk and talk to uh place called uh too old to die young which is uh very close to here. Yeah

Speaker 1: quite nice next to it Yeah, and uh if you want to uh help us clean up the place uh later on, then you can uh say it in the bar. Um yeah.

Speaker 6: Yeah, that also turns out to be the last slide. Um and uh so how about we take a group photo up here?

Speaker 1: Yeah, we usually do like a group photo where everybody comes up here somehow and then we get Fernando to take a picture. So if you want to uh be in a group photo, come up to the stage. Woo!