Pinkary will shut down on December 1, 2026. You can continue using the site until then. Read more

tegos
tegos

Ivan Mykhavko

@tegos

Senior Backend Engineer, PHP/Laravel. Perf tuning, PHP internals. One fix in Laravel core.
30 Posts 450 Views
  • No matching results...
  • Searching...
hash_equals('', '') returns true, so a Basic Auth middleware with an empty credential in config accepts a request that sends no Authorization header at all. The wrong-password test stays green the whole time, which is why it survives review.

Wrote up why it happens, the three states of that config value, and the guard that fails closed.

dev.to/tegos/hashequals-is-...

31

Brought travian-elephant-finder, a Node tool that hunts the best oases to raid in Travian, back from three years dead in a weekend with an AI agent. It handled the boring rewrites (dead token scrape to a real login API, report cleanup), but the ideas that actually made it better were still mine. Short honest take on where AI helps and where it does not, with a demo video in the post.

dev.to/tegos/hunting-elepha...

39