Viewing profile — miguelgrinberg

> One thing I’ve noticed is that different people get wildly different results with LLMs, so I suspect there’s some element of how you’re talking to them that affects the results. …

The OWASP CSRF prevention cheat sheet page does mention SameSite cookies, but they consider it defense in depth: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Re... .

Hi, author here. This was actually a mistake. If you look at the OWASP cheat sheet today you will see that Fetch Metadata is a top-level alternative to the traditional token-based …

Okay, now I understand where you are coming from. Confession, I did not read the PR. I assumed that what is currently published in the cheatsheet is the same as the PR. This is wha…

When I said "the maintainer is warming up to the idea" I meant to the idea of upgrading Fetch Metadata from the current status of defense-in-depth to a full solution that can repla…

Hi, blog post author here. With regard to state-changing GET requests, I do not recommend their use and I agree that they create some problems for CSRF protection, but you are corr…

That tells you how much I know about the feature. :) But in any case, I'm positive that the flag was enabled, so my results are with tail calls. I suppose part of the difference be…

FastAPI is a web framework, which by definition is (or should be!) an I/O bound process. My benchmark evaluates CPU, so it's a different thing. There are a ton of web framework ben…

There is no "realistic" benchmark, all benchmarks are designed to measure in a specific way. I explain what my goals were in the article, in case you are curious and want to read i…

The build of Python that I used has tail calls enabled (option --with-tail-call-interp). So that was in place for the results I published. I'm not sure if this optimization applies…

Thank you so much!

Keep in mind that the two scripts that I used in my benchmark are written in pure Python, without any dependencies. This is the sweet spot for pypy. Once you start including depend…

One reason is that I did not spend much time optimizing the Node and Rust versions, I just translated the Python logic as directly and quickly as I could. At least I did not ask an…

You have made my day, sir. :)

This is true for any kind of project, regardless of hardware or software stack. You always need to evaluate the performance for the specific use case you are targeting to make sure…

You got it backwards. If I were to release a benchmark for Microdot, everyone would say that it is biased! The article you are referring to is intended to benchmark microcontroller…

It's important to note that for most small devices that run MicroPython asyncio is the only available method of concurrency. These devices have no concept of processes, your applic…

Right. Microdot just gives you the support to build the web application. This is built on top of the standard asyncio Python library, so you are likely to find good support for mos…

You are more than welcome to evaluate Microdot on the specific device you are interested in. It is good to keep in mind that people don't run web apps on microcontrollers because t…

I wanted to use MicroPython for this. I have nothing against C, it is a language that I actually know and use for other projects, but I wanted the challenge to try to build somethi…

To clarify this, note that the extensions are entirely optional, and unlike what you are saying, most do not require any dependencies. The only two extensions that use dependencies…

Thanks. The smart heating device in question is one that is fairly popular in Ireland, but I believe it isn't sold elsewhere. The brand is Climote ( https://www.climote.ie/ ). As p…

Always a nice surprise to find my stuff on the front page. If you have any questions about Microdot, I'm here to answer them!

Thanks, will keep it in mind!

I have written a few microservices/APIs with Microdot, actually. Works really well for that.