B Chen retweeted
When you `fetch` and don't read the response body (E.g. if you only care about the http status code):
- Browser: It's fine
- Node.js: Memory leak
- Cloudflare worker: You hold on to one request-concurrency slot indefinitely and if you do it 6 times you are deadlocked
How do Deno and Bun behave?
B Chen retweeted
Today was a big day for the United States government and United Kingdom government. The Federal Bureau of Investigation and U.K. National Crime Agency’s (NCA) Cyber Division unveiled a massive, multi-year long investigation which has led to a catastrophic blow to Lockbit ransomware group and affiliates.
The Lockbit ransomware group Tor domain name displays a list of posts announcing activity performed by law enforcement agencies. It is written in Lockbit format, illustrating they have full control over Lockbit ransomware groups infrastructure.
Law enforcement has done the following
1. Law enforcement agencies will be unveiling sensitive information on Lockbit cryptocurrency and money operations February 23th, 2024
2. Law enforcement, with SecureWorks, will be revealing information on Lockbit tradecraft February 22nd, 2024
3. Law enforcement will be unveiling Lockbit affiliate infrastructure February 21st, 2024
4. Law enforcement, with TrendMicro, will be releasing a detailed analysis on Lockbit future-iterations February 22nd, 2024
5. Law enforcement will be unveiling information on Lockbit's StealBit data exfiltration tool February 21st, 2024
6. Law enforcement will be unveiling sanctions on Lockbit ransomware group at 15:30UTC today
7. Law enforcement, in conjunction with Japanese partners, has released a Lockbit decryptor tool
8. An individual in Poland has been arrested
9. An individual in Ukraine has been arrested
10. Law enforcement plans on unveiling the identity of the Lockbit ransomware group administration February 23rd, 2024
11. The United States government unveiled the indictement of two individuals associated with Lockbit ransomware group: Artur Sungatov and Ivan Kondratyev
12. The United Kingdom NCA has unveiled sensitive information on the Lockbit backend: the administration panel, the blog backend, and the blog source functionality. This includes the images of the source code.
B Chen retweeted
So let me get this straight
A teenager hacked Nvidia. Was arrested. Got out on bail
Under supervision and without his laptop, hacked Rockstar to steal unreleased GTA 6 info
How'd he do that without a laptop, you ask? With the hotel TV and a Fire Stick
bbc.com/news/technology-6766…
B Chen retweeted
tl;dr summary of United States government (and associated entities) vs ALPHV ransomware group
December 10th, 2023: ALPHV primary domain goes offline, administration saying it is hardware failure
December 10th, 2023: Rumors circulate that is it LE taking down ALPHV
December 11th, 2023: ALPHV denies allegations
December 19th, 2023, 7:26AM EST: ALPHV domain seized
December 19th, 2023, 7:42AM EST: ALPHV states this is the old domain and it doesn't matter
December 19th, 2023, 9:56AM EST, United States Department of Justice releases official statement on the seizure of ALPHV as well as compromising of their servers
December 19th, 2023: 12:34PM EST, ALPHV unseizes domain and threatens retaliation against United States (and associated entities) by allowing attacks against critical infrastructure
B Chen retweeted
Previously Okta reported a breach in October that resulted in approx. 1% of customer support users having their data stolen
November 29th Okta reports that they were wrong, 100% of customer support users had their data stolen.
cnbc.com/2023/11/29/okta-hac…
B Chen retweeted
SumoLogic had their AWS creds stolen
They're suggesting all customers rotate a bunch of secrets:
B Chen retweeted
Boeing confirms cyberattack amid LockBit ransomware claims - @serghei
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
B Chen retweeted
Introducing Geist, our free and open-source font. Created in collaboration with @basementstudio.
vercel.com/font
B Chen retweeted
How Discord Stores Trillions of Messages
In 2015, Discord started using MongoDB to store messages. By November 2015, there were already 100 million messages that did not fit in RAM, causing unpredictable latency.
In 2017, Discord moved to storing billions of messages in a Cassandra database. By 2022, the number of stored messages had ballooned to trillions across 177 nodes.
But Cassandra was plagued by several serious issues.
- Hot partitions occurred when a small number of high traffic channels overwhelmed nodes, cascading latency across the cluster.
- Garbage collection pauses created latency spikes.
- Compactions fell behind, forcing expensive reads to query multiple SSTables.
- Maintenance like node repairs interrupted service.
Discord migrated to ScyllaDB for the following benefits:
- Written in C++ instead of Java, eliminating disruptive garbage collection pauses
- Shard-per-core model provides stronger workload isolation to prevent hot partitions from cascading latency across nodes.
- Reverse query performance optimized to meet Discord's needs
- They reduced nodes to 72 while increasing disk space per node to 9TB.
To further protect ScyllaDB, Discord:
- Built intermediary data services in Rust that limit concurrent traffic spikes
- Data services sit between the API and database, coalescing requests
- Query the database just once even if multiple users request the same data
- Rust provided fast, safe concurrency ideal for this workload
The results? Tail latencies down from 40-125ms to a steady 15ms. Database uptime improved from weekend-long outages to smooth sailing. The system easily handled World Cup traffic spikes, processing events like goals and penalties without breaking a sweat. Discord continues to scale, now reliably storing trillions of messages with ScyllaDB.
–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7
ALT How Discord Stores Trillions of Messages
B Chen retweeted
A really bad day for Okta
How Cloudflare Mitigated Yet Another Okta Compromise
"On Oct 18, we discovered attacks on our system that we were able to trace back to Okta – threat actors were able to leverage an authentication token compromised at Okta..."
blog.cloudflare.com/how-clou…
B Chen retweeted
AI safety guardrails easily thwarted, security study finds dlvr.it/SxKmnn
B Chen retweeted
VC firms in California… “must report, for example, the race of the people they back, as well as their disability status and sexual orientation.”
High on the list of things I do not want to *annually survey* founders I work with about: orientation. Still gay? Cool, cool.
ಠ_ಠ
B Chen retweeted
𝗙𝗮𝗰𝗲𝗯𝗼𝗼𝗸 𝗰𝗿𝗲𝗮𝘁𝗲𝗱 𝗮 𝘁𝗼𝗼𝗹 𝘄𝗵𝗶𝗰𝗵 𝗱𝗲𝘁𝗲𝗰𝘁 𝗮𝗻𝗱 𝗿𝗲𝗽𝗮𝗶𝗿 𝗯𝘂𝗴𝘀 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆
The recent document by engineers from Facebook explains how they wrote a tool that can automatically fix bugs. In the paper, they introduced 𝗦𝗔𝗣𝗙𝗜𝗫, an automated tool designed to detect and repair bugs in software. The tool has suggested fixes for six essential Android apps in the Facebook App Family: Facebook, Messenger, Instagram, FBLite, Workplace, and Workchat.
How Does It Work?
𝗦𝘁𝗲𝗽 𝟭: Detect a Crash - Another tool, 𝗦𝗮𝗽𝗶𝗲𝗻𝘇, finds app crashes. When Sapienz identifies a crash, it is logged into a database.
𝗦𝘁𝗲𝗽 𝟮: Identify the Problem - SAPFIX pinpoints the exact line of code causing the issue. It first checks if the crash is reproducible. If it's not reproducible, the crash is discarded. It uses a technique called "spectrum-based fault localization" to identify the most likely lines of code responsible for the crash.
𝗦𝘁𝗲𝗽 𝟯: Suggest a Fix - Using predefined templates or code mutations, SAPFIX proposes a solution. After identifying the fault location, SAPFIX attempts to generate a patch. It employs two strategies:
🔹 𝗧𝗲𝗺𝗽𝗹𝗮𝘁𝗲-𝗯𝗮𝘀𝗲𝗱 𝗙𝗶𝘅𝗶𝗻𝗴: SAPFIX uses predefined templates to suggest fixes for common bugs. These templates are designed based on standard developer practices.
🔹 𝗠𝘂𝘁𝗮𝘁𝗶𝗼𝗻-𝗯𝗮𝘀𝗲𝗱 𝗙𝗶𝘅𝗶𝗻𝗴: SAPFIX resorts to a mutation-based system if the template-based approach fails. It systematically applies a series of code mutations to the fault location to generate potential fixes.
𝗦𝘁𝗲𝗽 𝟰: Test the Fix - The proposed solution is tested to ensure it's valid. It uses the test cases from 𝗦𝗮𝗽𝗶𝗲𝗻𝘇 to check the validity of the patch. If the patch passes all tests, it's considered a good fix. After patch validation, SAPFIX uses 𝗜𝗻𝗳𝗲𝗿 (a static analysis tool) to analyze the proposed fix further. Infer checks if the patch introduces any new potential issues.
𝗦𝘁𝗲𝗽 𝟱: Review - Developers get the final say, reviewing and approving the fix.
Check the entire document in the comments.
Image credits: Facebook.
What do you think about this?
_______
If you like my posts, please follow me, @milan_milanovic, and hit the 🔔 on my profile to get a notification for all my new posts.
Grow with me 🚀!
#technology #softwareengineering #programming #techworldwithmilan #coding
