The Backend Engineering Show with Hussein Nasser

David Schuts, a security researcher earned $5000 dollars in Google VRP by finding a Backend YouTube API that leaks Private Video Thumbnails. let us discuss how did he do that.   Resources https://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time/ Twitter @xdavidhu https://twitter.com/xdavidhu

A vulnerability in Google Feedback component in postMessage allowed this security researcher to find a way to hijack private screenshots   https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/ https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

Brave supports IPFS (InterPlanetary File System) which is a protocol designed to replaced HTTP as a decentralized alternative. This allows users to host and consume   Resources https://brave.com/brave-integrates-ipfs/ https://ipfs.io/#how

The current FTP implementation in Google Chrome has no support for encrypted connections (FTPS), nor proxies. Usage of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition more capable FTP clients are available on all affected platforms.  Google Chrome 72+ removed support for fetching document subresources over FTP and rendering of top level FTP resources. Currently navigating to FTP URLs result in showing a directory listing or a download depending on the type of resource. A bug in Google Chrome 74+ resulted in dropping support for accessing FTP URLs over HTTP proxies. Proxy support for FTP was removed entirely in Google Chrome 76.  Remaining capabilities of Google Chrome’s FTP implementation are restricted to either displaying a directory listing or downloading a resource over unencrypted connections. We would like to deprecate and remove this remaining functionality rather than maintain an insecure FTP implementation.

Resources

https://bugs.chromium.org/p/chromium/issues/detail?id=333943

https://docs.google.com/document/d/1JUra5HnsbR_xmtQctkb2iVxRPuhPWhMB5M_zpbuGxTY/edit#

https://www.chromestatus.com/feature/6246151319715840

On Jan 4th 2021, Slack experienced a global outage that prevented customers from using the service for nearly 5 hours.

Slack has released the Root cause analysis incident report which I’m going to summarize in the first part of this video. After that Ill provide a lengthy deep dive of the incident so make sure to stick around for that.

If you are new here, I make backend engineering videos and also cover software news, so make sure to Like comment and subscribe if you would like to see more plus it really helps the channel, lets jump into it.

So This is an approximation of Slack’s architecture based on what was the described in the reports. Clients connects to load balancers, load balancers distribute requests to backend servers and backend servers finally make requests to database servers which is powered by mysql through vitess sharding. All of those are connected by routers in cross boundary network.

Around 6AM jan 4 , the cross network boundary routers setting between LB and backend and backend to DB started to drop packets.

This lead to the load balancers slowly marking backends as unhealthy and removing them from the fleet Which compounded the amount of requests

The number of failed requests eventually triggered the provisioning service to start spinning an absurdly large number of backend servers

However the provisioning service couldn’t keep up with the huge demand and shortly started to time out for the same networking reasons and eventually ran out of maximum open file handles.

Eventually Slack’s cloud provider increased the networking capacity and backend servers went back to normal around 11 AM PST

This was a summary of the slack outage, Now set back, grab your favorite beverage and lets go through the detailed incident report!

0:00 Outage Summary

2:00 Detailed Analysis Starts

5:20 The Root Cause

30:00 Corrective Actions

In this video I go through the new most exciting features in HAProxy, one of my favorite proxies.

HAProxy 2.3 adds exciting features such as forwarding, prioritizing, and translating of messages sent over the Syslog Protocol on both UDP and TCP, and OpenTracing SPOA, Stats Contexts, SSL/TLS enhancements, an improved cache, and changes in the connection layer that lay the foundation for support for HTTP/3 / QUIC.

Resources

https://www.haproxy.com/blog/announcing-haproxy-2-3/

0:00 Intro

2:00 Connection Improvements

5:40 Load Balancing

11:36 Cache

15:00 TLS Enhancements

In this video I go through the new features in Apache Kafka 2.7, it is very interesting to see the amount of work Apache Kafka is doing to get closer to removing ZooKeeper 

 *  [KAFKA-9893] - Configurable TCP connection timeout and improve the initial metadata fetch * [KAFKA-9915] - Throttle Create Topic, Create Partition and Delete Topic Operations * [KAFKA-10054] - Add TRACE-level end-to-end latency metrics to Streams * [KAFKA-10259] - KIP-554: Add Broker-side SCRAM Config API * [KAFKA-10338] - Support PEM format for SSL certificates and private key   https://dist.apache.org/repos/dist/release/kafka/2.7.0/RELEASE_NOTES.html https://blogs.apache.org/kafka/entry/what-s-new-in-apache4 Confluence Mobile - Apache Software Foundation

I discussed this in many of my videos, the need for a database that natively supports a multiplexing protocol such as QUIC, gRPC or HTTP/2 in order to allow multiple isolated clients to make requests to the database without taking the overhead of establishing multiple connections.   

Resources https://www.infoq.com/news/2021/01/eventstoredb/ https://developers.eventstore.com/clients/dotnet/5.0/streams/#writing-to-a-stream

WhatApp has updated their terms of usage and privacy policy which caused many users to move to other platforms. This video will be a detailed report of their privacy policy, what they collect and what they can collect and see.

https://www.whatsapp.com/legal/privacy-policy

https://cdn.arstechnica.net/wp-content/uploads/2021/01/Image-from-iOS.png

cards

1:30 end to end

16:30 Samesite cookie

0:00 WhatsApp New Privacy

4:00 Your Account Information

5:30 Your Messages

12:15 Your Connections

13:00 Automatically Collected Information

17:45 Summary