The Backend Engineering Show with Hussein Nasser

By Hussein NasserTechnology

The Backend Engineering Show with Hussein Nasser episodes

April 15, 2021 Here is what caused the Hack to PHP Source Code git Server
Two weeks ago the PHP source code git server got hacked and two malicious commits were made to the source code. Since then the PHP maintainers identified the source of the hack, let us discuss
14 min
April 12, 2021 If I wasn’t a Backend Engineer, I would pick this as my career - Q&A April 2021
Light episode today let's have some fun with Q&A, I collected some questions on Twitter and YouTube community and I'm going to attempt to answer them here.

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
12 min
April 11, 2021Can NULLs Improve your Database Queries Performance? - The Backend Engineering Show
In this episode, we will discuss NULLs in database systems. I’ll go through the following:
What is Null?
NULLs persistence
Whether you store a 0 or 2 billion value in the field 32bit integer field it costs 32 bit

when you store a NULL in 32 bit integer field we save 32 bit but add overheads
When NULLs are naughty
Semantics and inconsistent result

Select count(*). Includes nulls

count(column) ignores nulls

T is NULL returns the null rows

T is NOT NULL returns not null rows

T In (NULL) returns nothing

T not in NULL returns nothing

Some database don’t index nulls
When NULLs are useful
I don’t have value , I don’t wish to provide a birthday

not applicable field for certain use cases but not others fat tables (denormlization)

Fat tables with many columns makes your rows longer which means fewer rows fit in your page (show pic).. NULLs help here .. that are NULL, it yields shorter rows, instead of storing a default 0 value

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
23 min
April 07, 2021 10 Vulnerabilities to watch for When building secure backend application (OWASP recommendations)
The open web application security project is a recognized entity that helps developers identify critical security vulnerabilities to build secure web applications. In this video I will go through the 10 vulnerabilities and explain each one and give examples and anecdotes from real life examples.
0:00 Building Secure Backends
2:30 Injection
4:50 Broken Authentication
6:43 Sensitive Data Exposure
11:00 XML External Entities (XXE)
13:45 Broken Access Control
17:00 Security Misconfiguration
19:00 XSS
22:45 Insecure Deserialization.
24:48 Using Components with Known Vulnerabilities.
26:00 Insufficient Logging & Monitoring.
Resources
https://owasp.org/www-project-top-ten/
Cards
2:50 SQL Injection https://www.youtube.com/watch?v=Azo9tDUtC9s
4:20 Best practices building REST https://www.youtube.com/watch?v=6zHWU7zBep0&list=PLQnljOFTspQUybacGRk1b_p13dgI-SmcZ&index=4
8:30 TLS playlist youtube.com/playlist?list=PLQnljOFTspQW4yHuqp_Opv853-G_wAiH-
15:00 HTTP Smuggling https://www.youtube.com/watch?v=PFllH0QccCs
19:22 XSS https://www.youtube.com/watch?v=pD6C1-zSxIM
25:10 OpenSSL Crash https://youtu.be/aDPQ0_MyRnc

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
29 min
April 07, 2021 Browser Caching best practices, when to use no-cache vs max-age without breaking your site
Caching is the hardest problem in building software, and having the browser cache is not any different. In this video, I'll discuss Jake Archibald's article
https://jakearchibald.com/2016/caching-best-practices/
0:00 Intro
2:00 Pattern 1: Immutable content + long max-age
5:40 Pattern 2: Mutable content, always server-revalidated
8:00 max-age on mutable content is often the wrong choice
12:20 CDN and Caching
Article
https://jakearchibald.com/2016/caching-best-practices/
https://twitter.com/jaffathecake
19 min
April 05, 2021 Write Amplification Explained in Backend Apps, Database Systems and SSDs
Write Amplification Is a phenomenon where the actual writes that physically happen are multiples of the actual writes desired. In this episode, I'll discuss 3 types of write amplifications and their effects on performance and lifetime of storage mediums.
0:00 intro
2:00 Application write amplification
4:30 Database write amplification
9:30 SSD Disk write amplification
16:00 SSD hates BTrees
20:00 summary
Resources
https://en.wikipedia.org/wiki/Write_amplification
https://www.cybertec-postgresql.com/en/hot-updates-in-postgresql-for-better-performance/
https://youtu.be/5Mh3o886qpg

23 min
April 04, 2021 DNS issue impacting multiple Microsoft services on April’s fool day (with Bonus content)
Microsoft Had an Outage on April 1st that is caused by DNS surge, let us discuss this. Bonus I’ll also discuss the outage that happened on March 18th cpu 100% utilization
RCA - DNS issue impacting multiple Microsoft services (Tracking ID GVY5-TZZ)
Summary of Impact: Between 21:21 UTC and 22:00 UTC on 1 Apr 2021, Azure DNS experienced a service availability issue. This resulted in customers being unable to resolve domain names for services they use, which resulted in intermittent failures accessing or managing Azure and Microsoft services. Due to the nature of DNS, the impact of the issue was observed across multiple regions. Recovery time varied by service, but the majority of services recovered by 22:30 UTC.
0:00 April/1st Outage - DNS Issue
13:30 March/18th Outage - CPU 100%
RCA
https://status.azure.com/en-us/status/history/
27 min
April 03, 2021 My Python CRUD App hits 2 million rows, Should I Shard my Database?
Hey Hussein
I have a 2 million row table used in my CRUD python app, I’m worried that as the table grow my inserts will slow down, should I consider sharding my database or partition the table? thank you
I’m avid of simplicity in design if I can do it in one machine I’ll do it. Sharding/Partitioning are all great
inserts are fast, queries are slow 0:00
inserts can be slow 3:00
indexes/stored procedures
selects, updates, and deletes can be slow 12:00
add proper indexes.
simplicity wins, premature optimization is bad 15:20
crazy things that people say like microservices day 1 scares me
22 min
March 31, 2021 cURL TLS 1.3 session ticket proxy host mixup Vulnerability
Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes.
When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.
4:00 http connect
https://curl.se/docs/CVE-2021-22890.html
10 min
March 31, 2021 PHP’s Source Code hacked - Two Remote Code execution added to the Git server, let us discuss
Two malicious commits were pushed to the php-src Git repository maintained by the PHP team on their git.php.net server. The commits were found and reverted two hours after it was committed. PHP is moving to github as a result.
Article
https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/
9 min

About The Backend Engineering Show with Hussein Nasser

From the publisher's feed

Welcome to the Backend Engineering Show podcast with your host Hussein Nasser. If you like software engineering you’ve come to the right place. I discuss all sorts of software engineering technologies and news with specific focus on the backend. All opinions are my own.