The Backend Engineering Show with Hussein Nasser

By Hussein NasserTechnology

The Backend Engineering Show with Hussein Nasser episodes

March 28, 2021 What happens when your Web Server Private Key is Leaked?
We have been told to take care of our private key that we use on backend servers without clear instructions as to what could happen when that key is leaked. In today’s backend engineering show I discuss exactly what could go wrong when your backend server private key is leaked. Let us discuss
Intro 0:00
What is a Certificate? 1:10
Where is the Private Key used? 4:10
TLS 1.2 with RSA 4:20
Why RSA no longer used 9:00
TLS 1.3 & TLS 1.2 Digital Signature 12:00
How often should you recycle Private Keys 19:00
Resources
https://blog.cloudflare.com/advanced-certificate-manager/
https://heartbleed.com/
https://cabforum.org/
https://en.wikipedia.org/wiki/DigiNotar
https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.sec.doc/q009960_.html
25 min
March 26, 2021 Researcher bypasses Azure, and Cloudflare Reverse Proxy Security - HTTP/2 Smuggling (h2c)
6 months ago, Jake Miller released a blog article and python tool describing H2C smuggling, or http2 over cleartext smuggling. By using an obscure feature of http2, an attacker could bypass authorization controls on reverse proxies.
Sean managed to leverage Jack’s original research to bypass reverse proxy rules, lets discuss My original Video on Jack’s h2c smuggling https://youtu.be/B2VEQ3jFq6Q This article https://blog.assetnote.io/2021/03/18/h2c-smuggling/
15 min
March 26, 2021High severity flaw can crash your WebServer when using OpenSSL - Let us discuss
On Thursday, OpenSSL maintainers released a fix for two high severity vulnerabilities, let us discuss the impact.
OpenSSL two major vulnerabilities 0:00

why OpenSSL 1:00

Bug 1 - Renegotiating TLS 1.2 (CVE-2021-3449) 3:50

Bug 2 - Cert verification bypass (CVE-2021-3450) 8:42

Update to OpenSSL 1.1.1k 12:30
Resources
https://www.openssl.org/news/vulnerabilities.html
https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-that-allows-hackers-to-crash-servers/
18 min
March 24, 2021When is NodeJS Single Threaded and when is it multi-Threaded?
Node JS Is single-threaded asynchronous non-blocking javascript runtime, but it's not always single-threaded there are occasions where nodejs uses multi-threading, so the questions we will try to answer in this video, when is nodejs single-threaded and when does it use multi-threading and how will that affect my app?
Event Loop single thread, that really just loops for callbacks 0:00

Threading in Node jS (libuv) 4:00
used for

IO/intensive
DNS queries

file system reads

CPU intensive
crypto

compression

process.env.UV_THREADPOOL_SIZE=1

Examples 8:00
Cluster Nodejs 16:00
Example 1
HTTP server return 1
HTTP server while 1
HTTP server with file system read async
HTTP server with file system read sync
HTTP server with fetch call to server (dns)

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
10 min
March 21, 2021 Slack's Migrating Millions of Websockets from HAProxy to Envoy, let's discuss
Slack started migrating from HAProxy to Envoy for their backend architecture, in this video, I’ll discuss their recent article when they moved the WebSockets portions, why they moved from HAProxy to Envoy and their production plans.

Resources
Article https://slack.engineering/migrating-millions-of-concurrent-websockets-to-envoy/
RFC8441 https://tools.ietf.org/html/rfc8441

3:15 Websockets Crash Course https://youtu.be/XgFzHXOk8IQ
9:50 HAProxy Runtime API https://youtu.be/JjXUH0VORnE
20:00 Slack Jan 4th outage https://www.youtube.com/watch?v=dhZ5--R42AM
23:00 RFC8441 Bootstrapping Websockets HTTP/2 https://youtu.be/wLdxC9gesBs
36 min
March 21, 2021 Why WebSockets over HTTP/2 (RFC8441) is Critical for Effective Load Balancing and Backend Scaling
In this video, I'll discuss RFC8441 bootstrapping WebSockets with HTTP/2 which I believe a critical protocol to allow WebSockets tunneling to scale on the backend. We will also discuss the current state of the art of Proxy and Backend Supports for this tech. Let us have a discussion.
0:00 Intro
3:00 WebSockets over HTTP/2
7:40 Proxy Supports
13:15 Browsers Supports
14:00 Summary
RFC 8441
Resources
RFC8441
https://tools.ietf.org/html/rfc8441#section-4
nginx support
https://trac.nginx.org/nginx/ticket/1992
haproxy support
https://github.com/haproxy/haproxy/issues/162
Chrome support
https://www.chromestatus.com/feature/6251293127475200
Firefox support
https://bugzilla.mozilla.org/show_bug.cgi?id=1434137
envoy support
https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/upgrades

Support my work on PayPal
https://bit.ly/33ENps4
Become a Member on YouTube
https://www.youtube.com/channel/UC_ML5xP23TOWKUcc-oAE_Eg/join
🧑‍🏫 Courses I Teach
https://husseinnasser.com/courses
17 min
March 19, 2021 How HTTP Compression Leaks Sessions and JWT - CRIME Explained and how HPACK in HTTP/2 fixes this
In this video we will explore one of the most popular side attacks CRIME Compression Ratio Info-leak Made Easy) and the different ways to mitigate this. Intro 0:00 * HTTP/1.1 SPDY header compression 4:00* TLS compression * Response body attackers can’t inject 13:00 * Mitigations 14:10 * HPACK/QPACK * TLS Padding
22 min
March 16, 2021 The Second Microsoft Global Outage in less than 6 months
On March 15, 2021, users couldn’t sign in to Microsoft services the majority of the impact was with teams but other services were affected. A similar outage happened back in Sep 2020 (I covered it here https://www.youtube.com/watch?v=0ozri9APCv0&t=68s)
Microsoft 365 Service health status
https://twitter.com/MSFT365Status/status/1371546946263916545
13 min
March 16, 2021 Is there a Limit to Number of Connections a Backend can handle?
In today's show, I'll answer the question do backend connections max out? There are many aspects to this question and I want to try to tackle all of them. I'll also mention the efforts that the @Cloudflare and team are doing to improve the CONNECT with MASQUE protocol Tune in to the Backend engineering Show with Hussein Nasser on your fav podcast player.

20 min
March 11, 2021 Fire Destroys Datacenter in France, Let us discuss the OVHcloud Fire
OVHcloud is Europe's largest cloud provider, with facilities across the region. They were hit with a big fire that completely destroyed an entire datacenter.
What happened? 0:00
What is the effect? 3:00
What OVH is going to do? 6:00
Resources
https://www.ovh.ie/news/press/cpl1786.fire-our-strasbourg-site
http://travaux.ovh.net/?do=details&id=49484
https://twitter.com/olesovhcom/status/1369504527544705025
14 min

About The Backend Engineering Show with Hussein Nasser

From the publisher's feed

Welcome to the Backend Engineering Show podcast with your host Hussein Nasser. If you like software engineering you’ve come to the right place. I discuss all sorts of software engineering technologies and news with specific focus on the backend. All opinions are my own.