The Backend Engineering Show with Hussein Nasser

AWS US east-1 experienced an outage yesterday, let us discuss what could have been the problem and what amazon did to solve it

—

Latest Update (6:23 PM PST): We’d like to provide an update on the issue affecting the Kinesis Data Streams API, and other dependent services, within the US-EAST-1 Region. We have now fully mitigated the impact to the subsystem within Kinesis that is responsible for the processing of incoming requests and are no longer seeing increased error rates or latencies. However, we are not yet taking the full traffic load and are working to relax request throttles on the service. Over the next few hours we expect to relax these throttles to previous levels. We expect customers to begin seeing recovery as these throttles are relaxed over this timeframe.

Resources

https://www.datacenterdynamics.com/en/news/aws-us-east-1-region-suffers-errors-and-outages-impacting-its-status-page/

https://disqus.com/by/disqus_DZeJlmjjGx/

https://downdetector.com/status/amazon/

https://www.youtube.com/watch?v=I9v-fCz0HZY&feature=youtu.be

In this video I go through the three type of caching and how it is kept in sync.

0:00 Intro

0:30 What is Caching?

1:20 Spatial Cache

3:30 Temporal Cache

5:00 Distributed cache

6:30 Write-Through Cache

8:00 Write-Back Cache

According to Sumo Logic's research, Redis is now officially the most popular database in 2020 on AWS cloud deployment. Let us discuss some of the reasons why the in-memory database became so popular 

 https://www.theregister.com/2020/11/23/redis_the_most_popular_db_on_aws/

Felix Wilhelm of Google Project Zero found an injection Vulnerability affecting GitHub Actions and Workflow Commands specifically related to setting malicious environment variables by parsing STDOUT

Resources

https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

https://bugs.chromium.org/p/project-zero/issues/detail?id=2070&can=2&q=&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary&cells=ids

https://www.zdnet.com/article/google-to-github-times-up-this-unfixed-high-severity-security-bug-affects-developers/

A botnot caught scanning the web for .ENV file and harvesting Credentials, API Keys and Passwords. Let us discuss   https://www.zdnet.com/article/botnets-have-been-silently-mass-scanning-the-internet-for-unsecured-env-files/

The Envoy Proxy fixed two zero day vulnerabilities, from Envoy groups :

We are announcing the fixes for two zero days that were identified today:

Resources

https://groups.google.com/g/envoy-security-announce/c/aqtBt5VUor0

0:00

0:20 UDP Proxy Crash

2:15 Incorrect Downstream Remote Address

In this live stream we have a Q&A about Communication Protocols in the Backend , enjoy.

We Talk about Masque, WebTransport, WebSockets, TCP, UDP and more

A group of researchers from UC Riverside and Tsinghua University announced a new attack against the Domain Name System (DNS) called SAD DNS (Side channel AttackeD DNS). In this video I explain this attack

0:00 Intro

1:00 What is DNS?

3:10 Original DNS Poisoning

6:30 DNS Poisoning with Fragmentation Attack

9:30 ICMP Explained

13:00 DNS Poisoning with ICMP Error Messages

Resources

https://blog.cloudflare.com/sad-dns-explained/

https://www.saddns.net/

https://bit.ly/3lHTn45

https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

There is a new Protocol called WebTransport, it sets to solve some limitations in WebSockets, the question is will this completely replaces WebSockets? I’ll leave this question to you guys. Let us discuss

Resources

https://www.youtube.com/watch?v=jTBM9CDO_Wk&feature=youtu.be

https://datatracker.ietf.org/doc/draft-kinnear-webtransport-http2/

https://datatracker.ietf.org/doc/draft-vvv-webtransport-http3/

https://datatracker.ietf.org/doc/draft-vvv-webtransport-quic/

FireFox Enables HTTPS Only Mode, let us discuss 

https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/

What does it mean?