majke

50 ms·

1. 511.▲
   by majke 11y ago

   For some context, this was the first successful effort do deobfuscate Skype protocol. Many tried before, and after. The most remarkable thing is their idea of what they call "Twin processes debugging", which is: debug one process,
2. 512.▲
   Reversing Skype Binary – Silver Needle in the Skype [pdf] (2006)(secdev.org)

   62 points by majke 11y ago|4 comments
3. 513.▲
   Guerrilla Fighters of Kurdistan(vimeo.com)

   1 points by majke 11y ago|0 comments
4. 514.▲
   by majke 11y ago

   Looking at netstat makes sense as long as the numbers are low. It's hard to correlate one of 167 counters to the unpredictable latency event you are just debugging :) $ netstat -s | grep -E '(prune|collap)' 4445504 pack
5. 515.▲
   by majke 11y ago

   The working theory is that "tcp_collapse" causes spikes of ~20 ms, which in turn make Linux not receive packets in time, which makes the network buffers to fill, which means new packets will be lost, which may be visible as 1s...
6. 516.▲
   by majke 11y ago

   That doesn't sound right. Consider DNS.
7. 517.▲
   by majke 11y ago

   Not later than yesterday I was explaining why syncookies on Linux aren't fast - you can't send more than say 300k pps of syn cookies for a single socket. This patch seem to fix that. I wonder if this patch is merged yet.
8. 518.▲
   Enigma Conf – A new security conference on emerging threats and novel attacks(usenix.org)

   1 points by majke 11y ago|0 comments
9. 519.▲
   by majke 11y ago

   We regularly have many-million pps per server. You might find this interesting: https://youtu.be/UcAygzNSxlI?t=7980 https://indico.dns-oarc.net/event/21/contribution/5/material...
10. 520.▲
    by majke 11y ago

    This blog post nicely fits as a fourth part of the series we've been releasing since June: https://blog.cloudflare.com/how-to-receive-a-million-packets... https://blog.cloudflare.com/how-to-achieve-low-
11. 521.▲
    Redis latency problems troubleshooting(redis.io)

    1 points by majke 11y ago|0 comments
12. 522.▲
    by majke 11y ago

    Correction. There is nothing special in "if". IE9 is just different, as you explained.
13. 523.▲
    by majke 11y ago

    Interesting explanation. When I last checked that the "!+[1,]" expression alone was coherent across all the browser but "if(!+[1,])" statement was not. I think there is something weird about the parsing of the comma in &
14. 524.▲
    Mobile Ad Brokers as DDoS Distribution Vectors: A Case Study(blog.cloudflare.com)

    37 points by majke 11y ago|9 comments
15. 525.▲
    by majke 11y ago

    Previous: https://news.ycombinator.com/item?id=6971935 I was looking for a good link, this is a bit nicer to read but in pdf: http://people.cs.clemson.edu/~westall/853/notes/vanjtcp.pdf Stumb
16. 526.▲
    TCP in 30 instructions (1993)(pdl.cmu.edu)

    108 points by majke 11y ago|7 comments
17. 527.▲
    by majke 11y ago

    A checksum can only tell you if the file is identical to another. Even if it did - you downloaded the file from untrusted location for a reason - you don't have access to original source. Checksums are useless if you don't have ac
18. 528.▲
    Practice of Remote Code Execution Using CPU BUGs [pdf](index-of.es)

    1 points by majke 11y ago|0 comments
19. 529.▲
    SoftICE: a kernel mode debugger for Windows(en.wikipedia.org)

    106 points by majke 11y ago|44 comments
20. 530.▲
    by majke 11y ago

    From: https://patchwork.ozlabs.org/patch/396713/ From: Daniel Borkmann ... With 1 core netmap does 10G line-rate on 64b; I don't know their numbers on 40G when run on decent hardware though. So l
21. 531.▲
    by majke 11y ago

    This is very exciting. Can you give some examples?
22. 532.▲
    by majke 11y ago

    There are many ways to inject packets back to kernel. Tuntap, raw socket on loopback, "dummy" device, etc. So by this count you can always make packets reach the kernel. There are two problems with doing the "take over the ni
23. 533.▲
    by majke 11y ago

    Please factor in development and support cost. There is a reason why people prefer general purpose computers to dedicated hardware. I think only big players like Google can afford dedicated hardware teams.
24. 534.▲
    by majke 11y ago

    Can you explain how to use PFQ only for selected network flows? (and not do a take-over-the-whole-nic?)
25. 535.▲
    by majke 11y ago

    Well, sure. You can use netmap and use a "host ring" to inject the packets back to the kernel. While good for toy app, this won't work in real workloads. For example host ring doesn't support multiple RX queues. The arti
26. 536.▲
    X86 instruction encoding and the hacks we do in the kernel [pdf](events.linuxfoundation.org)

    79 points by majke 11y ago|15 comments
27. 537.▲
    Jeff Dean: Advice from Building Large-Scale Distributed Systems [pdf](static.googleusercontent.com)

    4 points by majke 11y ago|0 comments
28. 538.▲
    Safety Critical Products: Integrity-178B real-time OS(ghs.com)

    32 points by majke 11y ago|2 comments
29. 539.▲
    IBM PC/AT had a fixed 5-ohm 50-watt resistor getting fairly hot(en.wikipedia.org)

    3 points by majke 11y ago|1 comments
30. 540.▲
    FreeBSD x86 Assembly Language Programming: Using the FPU(freebsd.org)

    64 points by majke 11y ago|9 comments