Posts
- Search Console says "Possible phishing detected on user login" on a site with no login
A static blog with no accounts, no forms and no password field got flagged for phishing on user login, with no sample URLs. How to prove it is not a blocklisting or a compromise, and the two changes that removed every credential-shaped surface.
- curl exits 3 on a Jenkins API call: square brackets in tree= are not URL-safe
A Jenkins REST query that works pasted into a browser dies in the shell with curl exit code 3 and no request on the wire. Why the tree= filter's brackets are the cause, and how -G --data-urlencode fixes it for good.
- LibreOffice converts a PDF form to .docx and python-docx sees no paragraphs at all
A headless LibreOffice PDF-to-docx conversion produces a file that looks perfect in a word processor but reports zero paragraphs and zero tables to python-docx. Why the import filter gives you shapes, and how rebuilding the form with pdftotext is the cheaper route.
- openpyxl: copy_worksheet drops the page setup and insert_rows leaves merged cells behind
copy_worksheet() silently resets print scaling and insert_rows() leaves merged ranges on their old coordinates. Both look correct in the cell grid and wrong on paper. How I caught them by rendering to PDF, and the code that fixes each.
- The new Teams keeps its local chat cache in WV2Profile_tfw, not Default
Exporting your own Teams chat history without admin help: why the Graph route stops at an Approval required page, why the EBWebView Default profile looks empty, and where the IndexedDB data actually lives.
- openpyxl: the second save() of a workbook with images raises I/O operation on closed file
Editing a spreadsheet that contains a logo, saving it twice from the same Workbook object, and getting ValueError: I/O operation on closed file — plus a truncated output file that no longer opens. Why images are the trigger and why one load per save is the fix.
- A phone input mask that silently rewrote the number I typed
A jquery.mask field with a fixed national format did not reject a foreign number — it reshaped the digits into a different, valid-looking one. How to detect this class of bug and why fixed-length masks are the wrong validation tool.
- Cloudflare Email Routing rejects mail with 550 5.7.26 "not authenticated"
A forwarding alias accepts RCPT TO and still refuses the message: Cloudflare will not forward mail that lacks SPF/DKIM alignment. How to prove the alias exists, what the rejection means for your contact address, and what the forwarded headers look like when it works.
- HTTP 522 after pointing a domain at Cloudflare Pages (and the Search Console fallout)
Adding a custom domain to a Pages project and flipping DNS in the same minute produces a short 522 window. That window is enough for Googlebot to record a failed sitemap read that sticks around after the site is healthy.
- reCAPTCHA v3 rejects your headless Chromium and no fingerprint patch fixes it
A form on your own site works in a normal browser and fails from a headless Chromium with a server-side score rejection. Here is what I measured across UA spoofing, navigator.webdriver, window.chrome.runtime and screen size — and the one change that actually mattered.
- MCP server dies at startup after the mcp package resolves to 2.0.0
A working stdio MCP server suddenly fails to start because its dependency spec says mcp>=0.9.0 and the resolver picks 2.0.0, which removed Server.list_tools(). Pin the SDK, and check the client side too.
- gpsoauth returns BadAuthentication on a 2FA Google account (app passwords do not help)
perform_master_login fails with BadAuthentication even with an app password. The working path is the oauth_token cookie from accounts.google.com/EmbeddedSetup — and you can capture that HttpOnly cookie over CDP instead of digging in DevTools.
- Two Azure CLI traps: -o tsv smuggles a carriage return, and az monitor metrics list returns Bad Request
A value captured with -o tsv looks right, echoes right and still breaks the URL you paste it into, and az monitor metrics list rejects valid metrics with a detail-free Bad Request. How to see both and how to get around them.
- Azure will not back up your NFS file share, and will not make it immutable either
Designing a recovery story for an Azure Files NFS share and hitting four separate capability limits — no Azure Backup, no share soft delete under the new provider, no blob WORM, no versioning. The design that survives them.
- An MCP-backed CLI answers from memory: in non-interactive mode the tools are not allowed
A prompt that calls an MCP tool interactively returns a confident, tool-free answer when the same CLI runs one-shot in a script. Why non-interactive mode silently drops the tools, how to allow them explicitly, and how to assert the tool actually ran.
- A typed API client that crashes on valid responses: pydantic int_type when the field is an object
Two endpoints of a working API wrapper failed every time with a pydantic int_type validation error while everything else passed. The cause was expanded objects where the model declared scalars, and the fix is normalising at the boundary.
- Graylog 7 API: POST /api/streams returns 400 "entity cannot be null"
The stream creation payload changed in Graylog 7: the stream object must be wrapped in an entity envelope. Also, the root admin account cannot hold an API token, which breaks scripted setups in a second, less obvious way.
- MusicBrainz ws/2 returns 503 "currently busy", and the track lengths you need are often missing
Lookups against the MusicBrainz web service fail intermittently with HTTP 503, and the releases that do come back frequently carry no track durations. How to set a compliant User-Agent, retry sanely, and fill the gaps from a second source.
- Synology NAS: scp fails with "subsystem request failed on channel 0"
DSM ships an SSH server without the sftp subsystem, so scp and sftp both fail even though ssh logs in fine. Transfer files with cat over ssh instead — and do not expect the bundled ffmpeg to encode anything.
- The Windows drives WSL2 cannot reach: Google Drive returns ENODEV, mapped network drives are simply absent
A Google Drive letter is listed in /proc/mounts yet every read fails with No such device (os error 19), while a mapped network drive never shows up at all. How to tell the three failure families apart and reach the files anyway.
- docker manifest inspect fails with "permission denied" on /etc/docker/certs.d
A deploy script that pre-checks whether an image tag exists breaks for non-root users on nodes with a private registry CA. The registry API answers anyway — use a plain HTTP HEAD as the fallback.
- Editing a Subversion repository without a working copy: svnmucc
Checking out a release repository just to change one deploy script is slow and error-prone. svnmucc performs put, rm and mv straight against the URL as one atomic commit — including the commit-message prefix a pre-commit hook may demand.
- WSL2: /mnt/c fails with "Input/output error (os error 5)" after the laptop sleeps
After a suspend/resume cycle every Windows drive mount in WSL2 returns os error 5 while native Linux paths keep working. Here is how to tell it apart from a permissions problem, and why the only reliable fix has to be run from Windows.
- Teams incoming webhook returns HTTP 200 but no message appears
Office 365 connector webhooks on *.webhook.office.com are retired: they accept your POST, answer 200 and silently drop it. The response headers prove it. Migrate to a Power Automate Workflows webhook and an Adaptive Card payload.
- Reading and writing MediaWiki pages from a script: action=raw and the two-token login
Fetching a wiki page with an HTTP client can silently return Recent Changes instead of the article, and editing needs two different tokens in the right order. Both fixes, plus the credential-file trap that broke my first attempt.
- Redmine REST: POST /uploads.json returns 404, and the API key only works in the query string
A documented Redmine endpoint answering 404 means attachments cannot be uploaded through the API at all, and the same key that authenticates in the query string is rejected as a header. How to prove both in three curl calls and what to build instead.
- Word tracked changes in a .docx: python-docx cannot do it, raw XML can
python-docx has no API for revisions, so a document that must be reviewed with accept/reject has to be edited as OOXML. The w:ins and w:del structures, the unique-id rule that silently corrupts documents, and how to prove accept and reject both work before you send it.
- Gmail throws away your <style> block: generating HTML mail that survives the client
A generated report mail renders perfectly in a browser and arrives in Gmail as an unstyled slab of text. Why the stylesheet never reaches the renderer, how to inline what matters, and how to build the multipart draft the Gmail API accepts.
- When an MCP wrapper hides API fields: set Redmine parent, due date and estimate over REST
create_issue and update_issue in a Redmine MCP wrapper expose only a handful of fields, so parent_issue_id, due_date and estimated_hours are unreachable. The REST API supports all of them — including the query-string API key the docs bury.