reza_n

10 ms·

1.
by reza_n 5y ago
You can use `explicit_bzero()` to bypass DCE (dead code elimination). Otherwise, simply initializing your memory before using is enough to trigger magic failures when you use-after-free. C programs barely function if they do not initialize
2.
by reza_n 5y ago
Varnish Software | Dev Ops | NYC onsite or US based remote | Full-time Varnish Software is the company behind Varnish Cache, a hugely popular open source caching solution installed in front of millions of websites globally. We build high pe
3.
by reza_n 6y ago
Bummer, he pretty much proved he was on the right path with his translation theories. Maybe this was done to protect his work? As in, hes now working to complete the translation and did not want others to beat him to it. One can hope...
4.
by reza_n 7y ago
Time and experience. Learning the syntax and wrapping your head around pointers and memory is the first step. After that, just try and write as much C as possible. Help out with projects, start projects, write tools and APIs. Most important
5.
by reza_n 7y ago
I write C full time and I love it (Varnish Cache). In our team of about 10 full time C engineers, we spend less than an hour a month dealing with things like “memory safety”. When you are writing C at a professional level, your time is spen
6.
by reza_n 7y ago
I wrote something very similar many years ago. I described it as a reverse search index. The queries/regex gets indexed into a search tree and then text is run thru it. It supported hundreds of thousands of parallel regex searches. I c
7.
by reza_n 7y ago
This is a bit on the unsafe side since it blindly trusts user input. At minimum, there needs to be some kind of magic number in the struct header to validate its looking at the right memory. Best case, some kind of pointer accounting. Unfor
8.
by reza_n 7y ago
We have no problem sharing our codebase with customers, especially if there are concerns like this. Shoot me a msg if you are genuinely interested in anything you have read.
9.
by reza_n 7y ago
Possibly, but memory is accessed using plain CPU instructions, so it would be hard to transparently encrypt all memory for an application at the kernel level. You do have virtual memory, but I dont think that could be leveraged for this. Bu
10.
by reza_n 7y ago
Yup. When something goes wrong in these kinds of applications, you sometimes tend to just randomly dump memory, which is a huge data leak. Or even worse, if someone figures out a way to force a data leak, then your are completely compromise
11.
by reza_n 7y ago
Closed source, write up would be here: https://info.varnish-software.com/blog/introducing-varnish-t...
12.
by reza_n 7y ago
Yup, we added this feature to Varnish Cache a few years ago, random key encryption. It generates a random key at startup and encrypts all memory with it. Since this kind of memory is only resident for the lifetime of the process, it works.
13.
by reza_n 7y ago
Edge facilities are warehouses in regional locations with excellent backbone connectivity, basically your modern datacenter. Cellphone towers can probably host a few racks, that's not a profitable business and its not "internet sc
14.
by reza_n 8y ago
https://hitch-tls.org/
15.
by reza_n 8y ago
Exactly. I used to live in a low rise apartment building which used modern wood construction. Not only did I hear everything above me, but the shock waves (from foot strikes) would also travel thru the structure, so you could feel everythin
16.
by reza_n 8y ago
We are always hiring full time C developers doing exactly what you said. Msg me if you (anyone) is interested.
17.
by reza_n 8y ago
If history is any guide, regime change doesn't need to come from within. Many parallels have been drawn to Saddam.
18.
by reza_n 8y ago
Believe it or not, US support has made KSA extremely weak, especially militarily. So its more like keep your enemies close, or in this case, oil targets. US could topple KSA in a matter of months.
19.
by reza_n 8y ago
> ...Diplomatic murder, women's rights arrests, Yemen war, Canada row, royal imprisonmemt... There is also the failed blockade of Qatar. Seems like this has been a pretty disastrous few years for MBS and he isn't even king. Im
20.
by reza_n 8y ago
True, and I meant this in the context where you could embed assembly into your functions if needed.
21.
by reza_n 8y ago
Varnish Software | Frontend Developer | New York City or Oslo, Norway Varnish Software is the company behind Varnish Cache. Varnish Software works with top global enterprises helping them use Varnish to increase web performance, build CDNs,
22.
by reza_n 8y ago
> C aficionados often claim they love C because it's "simple"(it isn't) That's what they mean, they love C because you can't really do OO with it I do not think C programmers are anti OO. Infact, a lot of C
23.
Caching the uncacheable with Varnish 6.0 and XBody(info.varnish-software.com)
1 points by reza_n 8y ago|0 comments
24.
by reza_n 8y ago
It works and can even allow you to regrow hair. However, your sex drive will take a nose dive. When you stop, things go back to normal, including the hair loss.
25.
by reza_n 8y ago
I pay $5 a month for a custom domain gmail account and last year I had an issue connecting to their POP3 service. Opened a support ticket and got extremely high quality support immediately. Basically, my experience was the opposite of all t
26.
by reza_n 8y ago
Are the files all empty? Looks like echo is part of the search string and the expansion might be interpreted as the file list. ls is ignored. Just a guess...
27.
by reza_n 8y ago
> This would still happen even if there was a token or session associated. This is exactly the scenario a CSRF token is support to prevent. But I understand your point.
28.
by reza_n 8y ago
To me this sounds like a CSRF problem. There's no token or session associated with these calls, so a browser was able to inadvertently CSRF the calls. Changing this call to POST or PUT would still leave this API vulnerable.
29.
by reza_n 8y ago
Is there some pattern or rule you can put into Varnish/CDN/nginx to prevent this??
30.
by reza_n 8y ago
Maybe have a parent function which passes in the array as 4k chunks/offsets and checks the return? 4k is a random size, there is probably a value which hits the sweet spot here.

More ›