Skip to content
EN

Back to the catalog

darksi.de
jsonEnglish

Fedor Indutny's Blog

darksi.de · English

Darkside of Software Engineering.

json

Open the feed

https://darksi.de/feed/feed.json

Last post
Sep 17, 2024
Posts in 24 h · 7 days · 30 days
0 · 0 · 0
Our last check
Answering
Served from
United States
Site title
Fedor Indutny's Blog
Text score at discovery
21,504
Format
json

Posts

What our queue read from this feed. Open one to read it here, or go to the site that published it.

  1. Third Time Is the Charm
    Sep 17, 2024 · original
    With the release of macOS Sequoia many developers must have started discovering new exciting changes in otherwise settled and stable APIs. One good example is Electron's desktopCapturer that lets apps list windows and screens available for screensharing and then stream their contents during a video call. With the Sequoia release, however, using desktopCapturer directly presents an extra window to popup . Enter Pac-Man # Thankfully, Electron team was anticipating this API transition and has prepared a change that lets macOS developers leverage the new APIs and avoid the popup. After migrating the source code over, an unexpected oddity has appeared in the testing. When sharing the screen for the first and the second time screensharing the user would see the expected video: However, when attempting to share the third time, a happy green Pac-Man would appear instead: Having no such test scre
  2. Resource Decryption On-the-Fly in Electron
    Aug 7, 2024 · original
    My team at Signal constantly faces challenges that go beyond what one would expect while working on practically any other messaging application. Consider the following facts about Signal: Does not collect telemetry. Uses strong and proven cryptography to enable end-to-end encryption by default while emphasizing security within the UX too. Doesn't permanently store queued end-to-end encrypted messages on the server, and thus is effectively a distributed application loosely coordinated by a centralized server. It'd take a long time to discuss all of the implications of everything mentioned above, and the innumerable innovations that my colleagues have created. In this post, however, we will concentrate on how attachments and other user data are stored on the Signal Desktop client. Existing Code # Based on feedback from the community, we recently introduced an important change to how dynami
  3. Structure of FTS5 Index in SQLite
    Feb 26, 2023 · original
    Recently Signal has open-sourced a SQLite extension that provides better support for non-latin languages (Chinese, Japanese, etc) in the Full-Text Search (FTS) virtual table. I was one of the engineers who worked on this extension and in the course of this endeavor I got to learn about the structure of the SQLite's FTS implementation. The existing documentation focuses mostly on API and its use patterns, and even though it covers some of the internal storage format, I found it a bit confusing. Thus this article was born. Not as alternative documentation for FTS5, but as a complement for developers who want to dive in past the officially documented bits. How is FTS5 used # Before anything else, though, let's see what the FTS5 looks like to the API consumer. As with many other features of SQLite we start by creating a table: CREATE VIRTUAL TABLE search USING fts5 ( content ) ; This virtual
  4. HashWick V8 Vulnerability
    Aug 22, 2018 · original
    About one year ago, I've discovered a way to do a Denial-of-Service (DoS) attack on a local Node.js instance. The process involved sending huge amounts of data to the HTTP server running on the same machine as the attacker, and measuring the timing differences between various payloads. Given that the scope of attack was limited to the same machine, it was decided by V8 team and myself that the issue wasn't worth looking in yet. Nevertheless, a blog post was published. This year, I had a chance to revisit the Hash Seed guessing game with restored enthusiasm and new ideas. The results of this experiment are murky, and no fix is available yet in V8. Thus all V8 release lines are vulnerable to the HashWick attack . (Disclaimer: the issue was disclosed responsibly. This blog post is published after more than 90 days since the initial report) What is a Hash Seed? # The Hash Seed is a random nu
  5. HyperBloom
    Apr 26, 2017 · original
    Over this weekend I got not so original (but definitely a fun one) idea to build fully distributed and decentralized Twitter. At the time it was inspired by the DAT Project and Hypercore , neither of which could support public replies to user feeds. Hence, the most natural thing was to write a new protocol ! Say hello to HyperBloom ! Protocol # It is crucial to understand the needs for the protocol before discussing the protocol itself. Let me list few requirements for it: Decentralized and distributed Viral. Everyone can reply to anyone's tweet without exchanging any public keys or information ahead of time Secure How could it combine all these three qualities into one protocol? By combining existing solutions, of course: State-based grow-only set with Bloom Filters for diffs Distributed Public Key Infrastructure (PKI) for append permissions Trust Network # Having grow-only set that is
  6. V8 hash seed timing attack
    Jan 19, 2017 · original
    Moment of History # There is a mostly forgotten security issue that was fixed in Node.js back in 2012. It was originally announced on the 28c3 conference December, 2011 and the final fix landed in January, 2012 . In few words, the most of dynamic languages use either bucket lists or open addressing variants of hash tables. V8 uses the latter one, and in such case when VM is asked to insert a property into an object it does the following sequence of actions: Compute the hash of the key (quite often with a Jenkins hash ) Clear the high bits of the hash value Use it as an index in the internal array Find unused slot in that array Insert the key/value pair at that slot. This sounds pretty much OK, except for the step 4. One may ask: What if the target slot is way too far from the index in the step 3? The answer is: it will take more time to do such insertion. Do you see where it is going? Co
  7. uv_link_t - libuv pipeline
    Aug 15, 2016 · original
    Preface # Writing servers/clients in C could be non-trivial. Even with the help of such powerful (and awesome dinosaur) libraries as libuv , it still takes lots of effort and boilerplate code to create real world applications. Some of this boilerplate code comes from the use of the widespread protocols like TLS (SSL) and HTTP. While there are popular implementations available as an Open Source libraries ( OpenSSL , http-parser ), they still either provide very abstract interface (like http-parser ), or an API to transfer the responsibility of the networking to the library itself (like SSL_set_fd() in OpenSSL and Amazon's s2n ). Such abstract nature makes them easier to embed, but the adaptor code inevitably tend to appear in the particular applications. Precursor - StreamBase # libuv is hardly an exception, and node.js and bud 's TLS implementation is a vivid evidence of this. However, i
  8. Sea of Nodes
    Oct 8, 2015 · original
    Brief intro # This post is going to be about the sea-of-nodes compiler concept that I have recently learned. While it is not completely necessary, it may be useful to take a peek at the some of my previous posts on JIT-compilers before reading this: How to start JIT-ting Allocating numbers SMIs and Doubles Deoptimize me not, v8 Compilers = translators # Compilers are something that every Software Engineer uses several times a day. Surprisingly even people who consider themselves to be far from writing the code, still use a compiler quite heavily throughout their day. This is because most of the web depends on client-side code execution, and many of such client-side programs are passed to the browser in a form of the source code. Here we come to an important thing: while source code is (usually) human-readable, it looks like complete garbage to your laptop/computer/phone/...'s CPU. On oth
  9. Diving into C++ internals of node
    May 16, 2015 · original
    Intro # There is nothing to be scared about in the C++ internals of the project, especially in internals of io.js and node.js . If you ever tried to optimize JavaScript code to squeeze out every possible performance or memory usage improvement out of it - you already wrote some C++ code. Many blogs, workshops mention JavaScript optimizations, and some of the popular suggestions are: Hidden Classes # Declare all properties in the constructor to avoid creating extra "hidden classes". This makes them pretty much the same as a C structures, or C++ classes, where properties are declared ahead of time to help the compiler optimize access to them. Example: function Point ( x , y , z ) { this . x = x this . y = y this . z = z } Similar code in C++: class Point { public : double x ; double y ; double z ; } ; Avoid Polymorphism # Avoid storing different types of values in a variables, and avoid pa
  10. Side Projects
    Feb 26, 2015 · original
    After reading antirez 's blog post I decided that it might be a good exercise to write down the notable side projects that I spent my time upon since Jan 2014. Here is the list and some comments from me: bn.js # JavaScript library for working with Big Numbers. bn.js is an ultra-fast bignum alternative with support for running in io.js/node.js and browsers. This one took lots of time and effort through whole year with some periodic sparks in a contributions graph , and many PRs from OpenSource community. Seriously, big kudos to you people for helping me with it! elliptic # JS library for doing Elliptic Curve crypto. It was the reason for creating the bn.js in the first place, and excuse for me to learn more about EC cryptography and crazy math behind it. bud # A friendly and clever TLS-terminating proxy in C. Although I worked on it since Nov 2013, lots of development happened during the
  11. Deoptimize me not, v8
    Dec 15, 2014 · original
    Compilers are awesome, right? If any programming concept may exist, it will probably be used in compiler implementation at some point. I am always amazed by my findings during v8 bug triaging or just random code exploration. The interesting thing about v8 that I was always passionate about, but never truly understood, was the Deoptimizer. The idea here is that v8 optimizes code to make it run faster, but this optimization relies on assumptions about types, ranges, actual values, const-ness, etc. These assumptions imply that the optimized code won't run when these conditions are not met, since the compiler needs to "deoptimize" it by returning to the previous "no-assumptions" version of generated code when the assumptions are failing. Technically it means that the compiler is in fact two compilers: a base compiler and an "optimizer". (Or even more, if we are talking about JSC and SpiderMo
  12. Cracking Cloudflare's heartbleed challenge
    Apr 16, 2014 · original
    Challenge # At April 11th 2014 Cloudflare has published a blog post suggesting to try out extracting a private key of their specially prepared challenge site using the Heartbleed OpenSSL vulnerability. Being busy at the time, I decided to give it a try a couple of hours later, if noone would crack it yet. This was a legal way to do some hackery, after all! Method # The method of attack was following: Send a lot of random-sized fake heartbeats (without body) Try to find a 128-byte prime factor of the certificate's modulus Generate the rest of the private key's parameters out of it I wasn't searching for a PEM-encoded private key and/or: -----BEGIN RSA PRIVATE KEY----- for a couple of reasons: It is loaded only at the process startup The key may be encrypted, and there is no point in brute forcing it According to my tests, DER-encoded key wasn't appearing in the memory either, so trying to
  13. Bud - a TLS "swiss knife"
    Apr 3, 2014 · original
    Bud # To terminate TLS or not? Good question, but instead of answering it - I'll try to make you believe that if you need a TLS terminator - the Bud is just the right choice. Other choices # Certainly, there are some other choices for TLS termination like: stud stunnel nginx (though, not only a TLS terminator, but a web server too) haproxy (much more than just a TLS terminator, but quite good!) ...probably some others? However, in many cases bud could do their job as well as they do and also provide some unique features. Features # Speed # Bud is as fast as all of it rivals, here are comparison of it to stud : Normal response: Big response: Asynchronous SNI and balancing # This is a killer feature for any serious PaaS offering an HTTPS access to the hosted applications. When enabled in configuration, on every incoming request bud will do an http query to receive a TLS certificate/key pai
  14. Running node.js + DTrace on FreeBSD
    Apr 1, 2014 · original
    Preface # Tracing node.js activity and detecting performance problems and bottlenecks has always been an important topic for many people in the community. Though, various ways to do this were available, including: systemtap, ETW and perfctr on Windows. The most complete tracing support was done by Joyent guys for the DTrace tool which works best on their Illumos fork, called SmartOS . Fortunately, since 9.0 version, FreeBSD maintainers have started fixing and tweaking their DTrace implementation too (which is actually a backport from Solaris). Considering that FreeBSD is much easier to install and is much more usable as a primary OS for developers, being able to do flamegraphs for node.js on it is something that I highly desired at the time. What was broken # Sadly, it wasn't working out-of-the-box. After the installation of FreeBSD in a VirtualBox has finished, I immediately tried to bu
  15. SMIs and Doubles
    Nov 14, 2013 · original
    This is a third post in the series of the JIT compiling crash-course. For a context please consider reading the first one and the second . Goal # Last time we created very basic bump memory allocator and made our existing code work with floating point double numbers, stored in the allocated heap objects. However floating point numbers are not suitable for some of precision-dependent operations and also, since they are stored in memory, requiring additional memory loads and stores, slowing down the code performance. Both of this problems could be solved by working with the integers stored in the registers (as we did it in first blog post ), which means that we will need to support both types of numbers in our compiler's runtime (doubles and integers). Tagging # Let's recall that we are storing both pointers and numbers in the 64bit general purpose registers ( rax , rbx , ...). The main is
  16. Allocating numbers
    Nov 6, 2013 · original
    JIT # This is the second blog post in the series about JIT compiling. The previous post was an introduction into the Just-In-Time code generation and, in particular, jit.js usage. If you haven't read it yet - I recommend you to familiarize yourself with it first. Objectives # Previously, we created a JIT compiler, supporting a very limited subset of JavaScript: integer numbers, math binary operators ( + , - , * , / ), and - unary operator. This time, we will extend it by adding floating point number support, and, to make the process funnier and to spice things up, we will allocate and store these numbers in the heap. Though, because we are doing things one step at a time, our heap won't have Garbage Collection, and will live inside fixed sized memory chunk (say "yay" to simplicity!). Stubs # Knowing what we aim to do, we can now set up internal structures for these features. Essentially,
  17. How to start JIT-ting
    Nov 1, 2013 · original
    Premise # Most developers heard about JIT compilers and how they can make slow interpreted languages run at a speed, comparable to native code. However, not many people understand how exactly this JIT thing works, and even less people could write their own compilers. I think having at least, basic knowledge of compiler internals may greatly improve understanding of the code that is running on that software. In this article, we'll visit some peaks of JIT-island, and probably even implement a compiler ourselves! What we'll start with # Knowing some compiler basics, we can assume that every compiler is transforming input in some format (usually, a source code) into the output in another or same format (usually, a machine code). JIT compilers are not an exception. What really makes them exceptional, is the fact that they're running not ahead of time (like gcc, clang and others), but Just-In-
  18. DTrace and the little ustack helper that could
    Jan 11, 2013 · original
    Flamegraphs are awesome if you need to profile your node.js application. They provide a nice looking visual view of where your application is spending its time. Although they're well documented , no one has ever said a word on how they work internally, but everyone mentions "ustack helper" which, right now, works only on SmartOS. Call stack # To understand profiling, one must understand what a callstack is. During its lifetime every application is using stack , which is a chunk of memory which can be changed by using push , pop , call and other CPU instructions, or by accessing it directly. The push and pop instructions simply expand/shrink stack storing/loading data on top of it. The call instruction is a little bit more interesting: (Quote from Intel® 64 and IA-32 Architectures Software Developer’s Manual ) ...the processor pushes the value of the EIP register (which contains the offse
  19. Candor returns
    Nov 21, 2012 · original
    Before I start diving into the deep sea of compiler internals, I would like to familiarize you with the Candor programming language and its Virtual Machine. This is the thing I was working on last 10 months, and one of the most wonderful and complex things I've been working on since the start of my software development career. Candor is an Ecmascript-inspired language, but while the newer versions of the Ecmascript standard are adding new functionality and syntax features, my language aims to make the syntax as simple as possible. No exceptions # Caller can always be sure that function will return after the call. You should either invoke a callback with an error argument, return negative number on error, or do anything else to let caller know about errors that has happened. No undefined and null # There is the only one value and type that represents undefined value - nil . Thus, less che
  20. To lock, or not to lock
    Oct 11, 2012 · original
    TL;DR # As I've promised you in my previous post , I made TLSnappy balance and handle requests a little bit better. Data flow # For leveraging all available CPUs TLSnappy runs multiple threads that are each picking and processing tasks from their dispatch queues, one by one. Tasks are created from node's event-loop in following cases: Data comes from client and should be decrypted Data from server should be encrypted So, as you can see, each thread is receiving data from it's inputs (either encrypted or clear ) and/or emitting data to it's outputs. This pattern apparently requires a lot of data transfer to and from worker threads and requires storing (buffering) that data in some temporary storage before processing it. To my mind, best structure to fit this needs is Circular (Ring) buffer . Because it's fast, can be grown if more than it's current capacity needs to be held. The Naive ver

Discovered by the rss-feed-index crawler, which checks each feed at most once a month.

Same record as JSON: https://api.agentalog.com/api/feeds/fd_darksi_de_cba76e4ff0def957. More from this site: darksi.de in the Feeds tab.