Microservice Networking in Anger
•Download as ODP, PDF•
0 likes•14 views
You’ve smashed your monolith into a thousand pieces. You’ve mastered eliminating tight coupling, large dependency trees, and long build times. Your next challenge? Dealing with your network to make it all work again. This session will cover all the things you never thought you had to know about networking. Whether you’re deploying to docker containers in the cloud or to your own datacenter this session will have something you’ll be able to put to work immediately. FIN
Report
Share
Report
Share
Recommended
Tackling Legacy Code November 2015
Tips on how to deal with legacy code, techniques and patterns. Including stuffs from Adam Tornhill, Michel Feathers, Simon Brown and Dan North.
From presentation at Websteps Kompetensbio November 2015.
Scala e xchange 2013 haoyi li on metascala a tiny diy jvm
Metascala is a tiny metacircular Java Virtual Machine (JVM) written in the Scala programming language. Metascala is barely 3000 lines of Scala, and is complete enough that it is able to interpret itself metacircularly. Being written in Scala and compiled to Java bytecode, the Metascala JVM requires a host JVM in order to run.
The goal of Metascala is to create a platform to experiment with the JVM: a 3000 line JVM written in Scala is probably much more approachable than the 1,000,000 lines of C/C++ which make up HotSpot, the standard implementation, and more amenable to implementing fun features like continuations, isolates or value classes. The 3000 lines of code gives you:
The bytecode interpreter, together with all the run-time data structures
A stack-machine to SSA register-machine bytecode translator
A custom heap, complete with a stop-the-world, copying garbage collector
Implementations of parts of the JVM's native interface
Although it is far from a complete implementation, Metascala already provides the ability to run untrusted bytecode securely (albeit slowly), since every operation which could potentially cause harm (including memory allocations and CPU usage) is virtualized and can be controlled. Ongoing work includes tightening of the security guarantees, improving compatibility and increasing performance.
ENJOYIN
Nagios Conference 2014 - Gerald Combs - A Trillion Truths
Gerald Combs's presentation on A Trillion Truths.
The presentation was given during the Nagios World Conference North America held Oct 13th - Oct 16th, 2014 in Saint Paul, MN. For more information on the conference (including photos and videos), visit: http://go.nagios.com/conference
Tales From the Web Logic Front Line
This document discusses common mistakes made when configuring Oracle WebLogic Server that can negatively impact performance and reliability. It outlines several anti-patterns to avoid such as using too many JDBC datasources without XA configuration, which can cause data corruption, and inadvertently coupling transactions between services without proper transaction requirements. The document also warns against practices like excessive logging, not properly configuring JMS for delivery errors, giving the operating system too much RAM, and not configuring node managers and datasources correctly for automatic restart and recovery. The overall message is that WebLogic configuration requires expertise to perform correctly in a production environment.
Tales from the WebLogic Frontline
Slides from my talk to the Oracle User Group conference in Birmingham in the UK.
10 things not to do with WebLogic.
DEFCON 22: Bypass firewalls, application white lists, secure remote desktops ...
In theory, post-exploitation after having remote access is easy. Also in theory, there is no difference between theory and practice. In practice, there is. Imagine a scenario, where you have deployed a malware on a user’s workstation, but the target information is on a secure server accessed via two-factor authentication, with screen access only (e.g. RDP, Citrix, etc.). On top of that, the server runs application white-listing, and only the inbound port to the screen server (e.g. 3389) is allowed through the hardware firewall. But you also need persistent interactive C&C communication (e.g. Netcat, Meterpreter, RAT) to this server through the user’s workstation.
I developed (and will publish) two tools that help you in these situations. The first tool can drop malware to the server through the screen while the user is logged in. The second tool can help you to circumvent the hardware firewall after we can execute code on the server with admin privileges (using a signed kernel driver). My tools are generic meaning that they work against Windows server 2012 and Windows 8, and they work with RDP or other remote desktops. The number of problems you can solve with them are endless, e.g., communicating with bind-shell on webserver behind restricted DMZ. Beware, live demo and fun included!
Fundamentals of network hacking
This session covered cyber security and ethical hacking topics such as network hacking, Kali Linux, IPV4 vs IPV6, MAC addresses, wireless hacking techniques like deauthentication attacks, cracking WEP and WPA encryption, and post-connection attacks including ARP spoofing and MITM attacks. The presenter emphasized the importance of securing networks by using strong passwords, disabling WPS, and enabling HTTPS to prevent hacking attempts.
Network programming blown up syllabus
This document outlines the topics that will be covered in a networking and protocols course, including introductions to networking concepts like the Internet, protocols, sockets, security, and remote access. Specific topics that will be discussed include TCP/IP, packet switching, physical media, protocol layers, the history of networking, socket programming, authentication, encryption, and network analysis tools. The course appears to provide an in-depth overview of computer networking from the ground level up.
Recommended
Tackling Legacy Code November 2015
Tips on how to deal with legacy code, techniques and patterns. Including stuffs from Adam Tornhill, Michel Feathers, Simon Brown and Dan North.
From presentation at Websteps Kompetensbio November 2015.
Scala e xchange 2013 haoyi li on metascala a tiny diy jvm
Metascala is a tiny metacircular Java Virtual Machine (JVM) written in the Scala programming language. Metascala is barely 3000 lines of Scala, and is complete enough that it is able to interpret itself metacircularly. Being written in Scala and compiled to Java bytecode, the Metascala JVM requires a host JVM in order to run.
The goal of Metascala is to create a platform to experiment with the JVM: a 3000 line JVM written in Scala is probably much more approachable than the 1,000,000 lines of C/C++ which make up HotSpot, the standard implementation, and more amenable to implementing fun features like continuations, isolates or value classes. The 3000 lines of code gives you:
The bytecode interpreter, together with all the run-time data structures
A stack-machine to SSA register-machine bytecode translator
A custom heap, complete with a stop-the-world, copying garbage collector
Implementations of parts of the JVM's native interface
Although it is far from a complete implementation, Metascala already provides the ability to run untrusted bytecode securely (albeit slowly), since every operation which could potentially cause harm (including memory allocations and CPU usage) is virtualized and can be controlled. Ongoing work includes tightening of the security guarantees, improving compatibility and increasing performance.
ENJOYIN
Nagios Conference 2014 - Gerald Combs - A Trillion Truths
Gerald Combs's presentation on A Trillion Truths.
The presentation was given during the Nagios World Conference North America held Oct 13th - Oct 16th, 2014 in Saint Paul, MN. For more information on the conference (including photos and videos), visit: http://go.nagios.com/conference
Tales From the Web Logic Front Line
This document discusses common mistakes made when configuring Oracle WebLogic Server that can negatively impact performance and reliability. It outlines several anti-patterns to avoid such as using too many JDBC datasources without XA configuration, which can cause data corruption, and inadvertently coupling transactions between services without proper transaction requirements. The document also warns against practices like excessive logging, not properly configuring JMS for delivery errors, giving the operating system too much RAM, and not configuring node managers and datasources correctly for automatic restart and recovery. The overall message is that WebLogic configuration requires expertise to perform correctly in a production environment.
Tales from the WebLogic Frontline
Slides from my talk to the Oracle User Group conference in Birmingham in the UK.
10 things not to do with WebLogic.
DEFCON 22: Bypass firewalls, application white lists, secure remote desktops ...
In theory, post-exploitation after having remote access is easy. Also in theory, there is no difference between theory and practice. In practice, there is. Imagine a scenario, where you have deployed a malware on a user’s workstation, but the target information is on a secure server accessed via two-factor authentication, with screen access only (e.g. RDP, Citrix, etc.). On top of that, the server runs application white-listing, and only the inbound port to the screen server (e.g. 3389) is allowed through the hardware firewall. But you also need persistent interactive C&C communication (e.g. Netcat, Meterpreter, RAT) to this server through the user’s workstation.
I developed (and will publish) two tools that help you in these situations. The first tool can drop malware to the server through the screen while the user is logged in. The second tool can help you to circumvent the hardware firewall after we can execute code on the server with admin privileges (using a signed kernel driver). My tools are generic meaning that they work against Windows server 2012 and Windows 8, and they work with RDP or other remote desktops. The number of problems you can solve with them are endless, e.g., communicating with bind-shell on webserver behind restricted DMZ. Beware, live demo and fun included!
Fundamentals of network hacking
This session covered cyber security and ethical hacking topics such as network hacking, Kali Linux, IPV4 vs IPV6, MAC addresses, wireless hacking techniques like deauthentication attacks, cracking WEP and WPA encryption, and post-connection attacks including ARP spoofing and MITM attacks. The presenter emphasized the importance of securing networks by using strong passwords, disabling WPS, and enabling HTTPS to prevent hacking attempts.
Network programming blown up syllabus
This document outlines the topics that will be covered in a networking and protocols course, including introductions to networking concepts like the Internet, protocols, sockets, security, and remote access. Specific topics that will be discussed include TCP/IP, packet switching, physical media, protocol layers, the history of networking, socket programming, authentication, encryption, and network analysis tools. The course appears to provide an in-depth overview of computer networking from the ground level up.
Simple network troubleshooting
This document provides guidance on troubleshooting common network issues like slow connectivity or lack of connectivity. It describes potential causes such as incompatible NIC settings, network congestion, bad cabling, or server overload. The document then gives instructions for using basic networking tools like ifconfig, mii-tool, ethtool, netstat to test cable connections, view NIC status and errors, and determine link status. These tests help identify issues like duplex mismatches, excessive errors, or loss of link that could be degrading network performance.
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
In theory, post-exploitation after having remote access is easy. Also in theory, there is no difference between theory and practice. In practice, there is. Imagine a scenario, where the hacker/penetration-tester has deployed a malware on a user's workstation, but the target information is on a secure server accessed via two-factor authentication, with screen access only (e.g. RDP, Citrix, etc.) On top of that, the server runs application white-listing, and only the inbound port to the screen server (e.g. 3389) is allowed through the hardware firewall. But you also need persistent interactive C&C communication (e.g. Netcat, Meterpreter, RAT) to this server through the user's workstation.
I developed (and will publish) two tools that help the community in these situations. The first tool can drop malware to the server through the screen while the user is logged in. The second tool can help to circumvent the hardware firewall after one can execute code on the server with admin privileges (using a signed kernel driver). My tools have been tested against Windows server 2012 and Windows 8, and they work with RDP or other remote desktops (e.g. Citrix). The number of problems one can solve with them are endless, e.g., communicating with bind-shell on webserver behind restricted DMZ. Beware, live demo and fun included!
Twisted: a quick introduction
A quick introduction to Python's Twisted networking library, given at a NZPUG meeting in April 2009.
Covers some of the stuff you can do with Twisted really easily, like an XMPP bot and an SSH/Telnet shell into your running applications.
Www ccnav5 net_ccna_3_v5_final_exam_answers_2014
This document provides the final exam answers for CCNA 3 v5 Scaling Networks from 2014. It includes 40 multiple choice questions related to networking topics like VLANs, trunking, routing, DHCP, wireless networking, and security. The questions are taken from the CCNA 3 v5 final exam and provide the correct answer choices for each question.
GOTO Night with Todd Montgomery: Aeron: What, why and what next?
"Aeron: What, Why, and What Next"
Aeron is a new protocol and implementation that is specifically designed to be a blazingly fast and predictable transport protocol for unicast and multicast. In this session, we will explore the design evolution of the Aeron protocol and implementation. What have we learned and been learning as Aeron has been evolving and changing? What current and future problems does Aeron address? And what does the approaches taken by Aeron open up in the future?
Comet: Making The Web a 2-Way Medium
This document discusses Comet, a technique that uses long-lived HTTP connections to allow asynchronous server-client communication and enable real-time updates of web pages. It outlines various Comet techniques like long polling, forever frames, and callback polling. It also discusses technologies that support Comet like Jetty, Twisted Python, and frameworks like DWR, Juggernaut, and Bayeux. The document concludes with a demo of Comet in action and pointers to additional resources.
WebRTC: A front-end perspective
WebRTC gives us a way to do real-time, peer-to-peer communication on the web. In this talk, we'll go over the current state of WebRTC (both the awesome parts and the parts which need to be improved) as well as what could come in the future. Mostly though, we'll take a look at how to combine WebRTC with other web technologies to create great experiences on the front-end for real-time, p2p web apps.
Akka for big data developers
https://github.com/tfedorov/presentationAkka
Motivation.
Akka actor.
Akka stream.
On hands examples.
Conclusion.
Group Apres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to check employee internet usage. It provides an overview of IP and TCP packet structures.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet headers.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet structures.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet structures.
Defcon 22-zoltan-balazs-bypass-firewalls-application-whiteli
The document discusses techniques for bypassing security controls and gaining persistent access to a secured remote desktop server. It proposes infecting a client's workstation, stealing RDP credentials, and using various tools to bypass firewalls, application whitelisting, and other defenses in order to install malware and establish command and control of the target server. Specific bypass methods involve abusing Microsoft Word macros, exploiting Windows services, installing kernel drivers, and manipulating TCP source ports. The presentation demonstrates new attack tools and methods for pentesters and warns blue teams of challenges in detecting such advanced intrusions.
Building the Internet of Things with Eclipse IoT - IoTBE meetup
This document discusses building Internet of Things (IoT) solutions using Eclipse IoT projects. It begins by introducing MQTT and CoAP, two common IoT protocols. It then describes how Eclipse IoT projects can be used to build sensor networks, home automation, and device management solutions. Specific projects mentioned include Mosquitto, Paho, Kura, Wakaama, and Leshan. The presentation emphasizes that MQTT is very versatile for building complete IoT solutions and that Eclipse IoT provides both basic building blocks and more complete offerings.
Web Server/App Server Connectivity
This document discusses connectivity between web servers and application servers. It describes how the Apache HTTP Server is commonly used in front of application servers like Tomcat for security, performance and flexibility. It then discusses the Apache JServ Protocol (AJP) that is typically used for communication between Apache and Tomcat and some of its limitations. Alternatives like using Tomcat's HTTP connectors directly or Apache's native proxying and load balancing capabilities are presented as often better options. The recommendation is to use standard HTTP protocols over AJP when possible for better debuggability and stability.
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
The document discusses server-side request forgery (SSRF) vulnerabilities and techniques for exploiting and bypassing URL parsing issues to achieve protocol smuggling. It provides examples of exploiting URL parsers in various programming languages to conduct CR-LF injection and host/path injection. It also demonstrates abusing features of Glibc NSS and protocols like HTTPS to smuggle protocols over TLS SNI or bypass patches. The talk appears to be about advanced SSRF attacks and protocol smuggling techniques.
Micro Services Conquer Monoliths
This document discusses moving from monolithic architectures to microservices by breaking up monoliths into reasonably small, autonomous services with well-defined interfaces. It notes that microservices help with scaling, deployment, and allow different teams to develop and deploy independently using their own technologies and languages.
Wifi Security, or Descending into Depression and Drink
This document discusses various techniques for exploiting weaknesses in WiFi security to intercept and manipulate web traffic. It describes how unencrypted management frames and shared wireless media allow spoofing access points and intercepting sessions. With tools like LORCON, attackers can inject packets to hijack TCP streams and manipulate browsers by rewriting HTML, JavaScript and redirecting HTTPS to HTTP. Persistent attacks are also possible by caching manipulated content for long periods.
Ccna 1 chapter 3 exam answer v5
The document contains a list of URLs and exam answers for CCNA certification courses. It provides the answers to multiple choice questions from exams for CCNA 1 through CCNA 4, as well as the answers to final exams, practice exams, and pre-tests for each course. The answers cover topics such as network protocols, the OSI model, IP addressing, switching, routing, WANs, and network security.
"Leveraging the Event Loop for Blazing-Fast Applications!", Michael Di Prisco
Can the Microtask Queue help you improve your performances by 100x? It turns out it can, but how? JavaScript is single-threaded, yet it provides a really powerful Event Loop to allow non-blocking operations, so let's try to tame this beast together and get the most out of it! As I like to say: The Event Loop is the only infinite loop you'll love.
Fundraising At Apache
The ASF runs on more than just code donations. To operate the way it does today requires significant amounts of cash and services donated by our generous sponsors and individual supporters. In this session, we'll examine the different sponsorship programs available at the ASF and how they work, including options that target specific projects. We'll discuss how the ASF operates compared to similar foundations like Eclipse Foundation or the Linux Foundation and some of the advantages and limitations we have based on our 501c(3) Not-for-profit structure. Finally, we'll have a discussion on the future of open source fundraising. Bring your thoughts and ideas.
Open Development When You're Not in Charge
The Apache Software Foundation has a 20 year history of building resilient and sustainable communities of software developers through the Apache Way. While some companies are adopting Inner sourcing, other companies still have a taboo surrounding open source culture. Many of us work at these open source agnostic companies and don’t have manager in our title. Are those of us in those companies doomed to a life of Dilbert? You don’t have to be! This talk is all about how to bring a little Apache culture to your Apache oblivious team. This talk will cover how a little Apache Way goes a long way solving common team problems with knowledge sharing, technical/personal disputes, mentorship, and shipping software. So even though you’re the only one on your team that “gets” Apache, everyone can share in the rewards of being a part of an effective team.
More Related Content
Similar to Microservice Networking in Anger
Simple network troubleshooting
This document provides guidance on troubleshooting common network issues like slow connectivity or lack of connectivity. It describes potential causes such as incompatible NIC settings, network congestion, bad cabling, or server overload. The document then gives instructions for using basic networking tools like ifconfig, mii-tool, ethtool, netstat to test cable connections, view NIC status and errors, and determine link status. These tests help identify issues like duplex mismatches, excessive errors, or loss of link that could be degrading network performance.
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
In theory, post-exploitation after having remote access is easy. Also in theory, there is no difference between theory and practice. In practice, there is. Imagine a scenario, where the hacker/penetration-tester has deployed a malware on a user's workstation, but the target information is on a secure server accessed via two-factor authentication, with screen access only (e.g. RDP, Citrix, etc.) On top of that, the server runs application white-listing, and only the inbound port to the screen server (e.g. 3389) is allowed through the hardware firewall. But you also need persistent interactive C&C communication (e.g. Netcat, Meterpreter, RAT) to this server through the user's workstation.
I developed (and will publish) two tools that help the community in these situations. The first tool can drop malware to the server through the screen while the user is logged in. The second tool can help to circumvent the hardware firewall after one can execute code on the server with admin privileges (using a signed kernel driver). My tools have been tested against Windows server 2012 and Windows 8, and they work with RDP or other remote desktops (e.g. Citrix). The number of problems one can solve with them are endless, e.g., communicating with bind-shell on webserver behind restricted DMZ. Beware, live demo and fun included!
Twisted: a quick introduction
A quick introduction to Python's Twisted networking library, given at a NZPUG meeting in April 2009.
Covers some of the stuff you can do with Twisted really easily, like an XMPP bot and an SSH/Telnet shell into your running applications.
Www ccnav5 net_ccna_3_v5_final_exam_answers_2014
This document provides the final exam answers for CCNA 3 v5 Scaling Networks from 2014. It includes 40 multiple choice questions related to networking topics like VLANs, trunking, routing, DHCP, wireless networking, and security. The questions are taken from the CCNA 3 v5 final exam and provide the correct answer choices for each question.
GOTO Night with Todd Montgomery: Aeron: What, why and what next?
"Aeron: What, Why, and What Next"
Aeron is a new protocol and implementation that is specifically designed to be a blazingly fast and predictable transport protocol for unicast and multicast. In this session, we will explore the design evolution of the Aeron protocol and implementation. What have we learned and been learning as Aeron has been evolving and changing? What current and future problems does Aeron address? And what does the approaches taken by Aeron open up in the future?
Comet: Making The Web a 2-Way Medium
This document discusses Comet, a technique that uses long-lived HTTP connections to allow asynchronous server-client communication and enable real-time updates of web pages. It outlines various Comet techniques like long polling, forever frames, and callback polling. It also discusses technologies that support Comet like Jetty, Twisted Python, and frameworks like DWR, Juggernaut, and Bayeux. The document concludes with a demo of Comet in action and pointers to additional resources.
WebRTC: A front-end perspective
WebRTC gives us a way to do real-time, peer-to-peer communication on the web. In this talk, we'll go over the current state of WebRTC (both the awesome parts and the parts which need to be improved) as well as what could come in the future. Mostly though, we'll take a look at how to combine WebRTC with other web technologies to create great experiences on the front-end for real-time, p2p web apps.
Akka for big data developers
https://github.com/tfedorov/presentationAkka
Motivation.
Akka actor.
Akka stream.
On hands examples.
Conclusion.
Group Apres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to check employee internet usage. It provides an overview of IP and TCP packet structures.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet headers.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet structures.
C Cpres
The document discusses network protocol analysis, including defining a protocol as rules determining data format and transmission. It describes network protocol analysis as decoding protocol headers and trailers to analyze network problems, detect intrusions, monitor usage, and gather statistics. The document lists potential users as programmers, network administrators, company managers, parents, and website owners wanting to monitor employee internet usage. It provides an overview of IP and TCP packet structures.
Defcon 22-zoltan-balazs-bypass-firewalls-application-whiteli
The document discusses techniques for bypassing security controls and gaining persistent access to a secured remote desktop server. It proposes infecting a client's workstation, stealing RDP credentials, and using various tools to bypass firewalls, application whitelisting, and other defenses in order to install malware and establish command and control of the target server. Specific bypass methods involve abusing Microsoft Word macros, exploiting Windows services, installing kernel drivers, and manipulating TCP source ports. The presentation demonstrates new attack tools and methods for pentesters and warns blue teams of challenges in detecting such advanced intrusions.
Building the Internet of Things with Eclipse IoT - IoTBE meetup
This document discusses building Internet of Things (IoT) solutions using Eclipse IoT projects. It begins by introducing MQTT and CoAP, two common IoT protocols. It then describes how Eclipse IoT projects can be used to build sensor networks, home automation, and device management solutions. Specific projects mentioned include Mosquitto, Paho, Kura, Wakaama, and Leshan. The presentation emphasizes that MQTT is very versatile for building complete IoT solutions and that Eclipse IoT provides both basic building blocks and more complete offerings.
Web Server/App Server Connectivity
This document discusses connectivity between web servers and application servers. It describes how the Apache HTTP Server is commonly used in front of application servers like Tomcat for security, performance and flexibility. It then discusses the Apache JServ Protocol (AJP) that is typically used for communication between Apache and Tomcat and some of its limitations. Alternatives like using Tomcat's HTTP connectors directly or Apache's native proxying and load balancing capabilities are presented as often better options. The recommendation is to use standard HTTP protocols over AJP when possible for better debuggability and stability.
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
The document discusses server-side request forgery (SSRF) vulnerabilities and techniques for exploiting and bypassing URL parsing issues to achieve protocol smuggling. It provides examples of exploiting URL parsers in various programming languages to conduct CR-LF injection and host/path injection. It also demonstrates abusing features of Glibc NSS and protocols like HTTPS to smuggle protocols over TLS SNI or bypass patches. The talk appears to be about advanced SSRF attacks and protocol smuggling techniques.
Micro Services Conquer Monoliths
This document discusses moving from monolithic architectures to microservices by breaking up monoliths into reasonably small, autonomous services with well-defined interfaces. It notes that microservices help with scaling, deployment, and allow different teams to develop and deploy independently using their own technologies and languages.
Wifi Security, or Descending into Depression and Drink
This document discusses various techniques for exploiting weaknesses in WiFi security to intercept and manipulate web traffic. It describes how unencrypted management frames and shared wireless media allow spoofing access points and intercepting sessions. With tools like LORCON, attackers can inject packets to hijack TCP streams and manipulate browsers by rewriting HTML, JavaScript and redirecting HTTPS to HTTP. Persistent attacks are also possible by caching manipulated content for long periods.
Ccna 1 chapter 3 exam answer v5
The document contains a list of URLs and exam answers for CCNA certification courses. It provides the answers to multiple choice questions from exams for CCNA 1 through CCNA 4, as well as the answers to final exams, practice exams, and pre-tests for each course. The answers cover topics such as network protocols, the OSI model, IP addressing, switching, routing, WANs, and network security.
"Leveraging the Event Loop for Blazing-Fast Applications!", Michael Di Prisco
Can the Microtask Queue help you improve your performances by 100x? It turns out it can, but how? JavaScript is single-threaded, yet it provides a really powerful Event Loop to allow non-blocking operations, so let's try to tame this beast together and get the most out of it! As I like to say: The Event Loop is the only infinite loop you'll love.
Similar to Microservice Networking in Anger (20)
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
GOTO Night with Todd Montgomery: Aeron: What, why and what next?
GOTO Night with Todd Montgomery: Aeron: What, why and what next?
Defcon 22-zoltan-balazs-bypass-firewalls-application-whiteli
Defcon 22-zoltan-balazs-bypass-firewalls-application-whiteli
Building the Internet of Things with Eclipse IoT - IoTBE meetup
Building the Internet of Things with Eclipse IoT - IoTBE meetup
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
Wifi Security, or Descending into Depression and Drink
Wifi Security, or Descending into Depression and Drink
"Leveraging the Event Loop for Blazing-Fast Applications!", Michael Di Prisco
"Leveraging the Event Loop for Blazing-Fast Applications!", Michael Di Prisco
More from Bob Paulin
Fundraising At Apache
The ASF runs on more than just code donations. To operate the way it does today requires significant amounts of cash and services donated by our generous sponsors and individual supporters. In this session, we'll examine the different sponsorship programs available at the ASF and how they work, including options that target specific projects. We'll discuss how the ASF operates compared to similar foundations like Eclipse Foundation or the Linux Foundation and some of the advantages and limitations we have based on our 501c(3) Not-for-profit structure. Finally, we'll have a discussion on the future of open source fundraising. Bring your thoughts and ideas.
Open Development When You're Not in Charge
The Apache Software Foundation has a 20 year history of building resilient and sustainable communities of software developers through the Apache Way. While some companies are adopting Inner sourcing, other companies still have a taboo surrounding open source culture. Many of us work at these open source agnostic companies and don’t have manager in our title. Are those of us in those companies doomed to a life of Dilbert? You don’t have to be! This talk is all about how to bring a little Apache culture to your Apache oblivious team. This talk will cover how a little Apache Way goes a long way solving common team problems with knowledge sharing, technical/personal disputes, mentorship, and shipping software. So even though you’re the only one on your team that “gets” Apache, everyone can share in the rewards of being a part of an effective team.
Apache When You're Not in Charge
Apache has a 20 year history of building resilient and sustainable communities of software developers through the Apache Way. While some companies are adopting Inner sourcing, other companies still have a taboo surrounding open source culture. Many of us work at these open source agnostic companies and don’t have manager in our title. Are those of us in those companies doomed to a life of Dilbert? You don’t have to be! This talk is all about how to bring a little Apache culture to your Apache oblivious team. This talk will cover how a little Apache Way goes a long way solving common team problems with knowledge sharing, technical/personal disputes, mentorship, and shipping software. So even though you’re the only one on your team that “gets” Apache, everyone can share in the rewards of being a part of an effective team.
Modular Open Source in Java for Now and Later
The Apache community creates the building blocks of software companies world wide. Developers designing those building blocks require a different mindset than developers focused on building applications. Good building blocks can be repurposed, reused, and recomposed. Good building blocks are modular. This talk focus on building good blocks in Java using current language features, frameworks (Apache Felix), and prepare for new modularity features available in Java 9. This talk will cover when it makes sense to break a project down further as well as some of the strategies and tools involved in doing so. We'll cover lessons learned I've learned doing this for clients as well as within the ASF with Apache Tika.
User Groups: The Gateway to Apache
When we think of user groups most of us think of code, conversations, and cold beverages. However, they can be so much more. User groups can be a powerful tool to help promote open source ecosystems like the ASF. Bob brings several years of experience serving in many roles within the Chicago Java User Group, one of the largest Java user groups in the world. During his tenure, Bob has promoted open source through activities, topic selection, and community development. Bob will discuss ways to engage communities within the ASF to get speakers, set up activities to promote open source, match sponsors to help fund these activities, and grow members to be more active in software communities. Come discuss things that work, things that don't, and bring some great ideas home to make your local software community one people won't want to leave.
What's My Modularity
Since the inception of the JAR modularity has been a big reason why developers have chosen Java as a development platform. In Java's 20 year history never have there been so many different types of modularity options to choose from. From OSGi, to Docker, to JavaEE Microservices/SOA and finally the upcoming Java 9 release with the promise of Project Jigsaw. This session will discuss the different types of modular architectures available for Java applications as well as the benefits and the tradeoffs for each one. Are you looking for pure speed? Automatic scaling? Programer productivity? Selecting the correct architecture is fundamental in creating technical ecosystems where application development can move quickly and independently.
Do more with LESS, Handlebars, Coffeescript and other Web Resources in AEM
This document outlines a presentation about using front-end technologies like Handlebars, LESS, and Coffeescript to build single page applications in Adobe Experience Manager (AEM). It discusses design considerations for where to do templating, what to make authorable, and how to store and manage data. It also provides examples of using these front-end tools and approaches for packaging them in AEM, including via the Node.js build packager or a web resource framework. The presentation aims to demonstrate how these technologies can help AEM sites achieve better performance, responsiveness and support for real-time data while leveraging AEM's capabilities.
Adding Modularity Afterward with Embedded OSGi
Many useful software products are started with tightly coupled “spaghetti” code that just works. As lines of code and complexity increase, teams often struggle to make modifications and add new features without impacting the entire application. As a result, previously successful applications start missing dates and suffering from degrading quality. OSGi can help by introducing a modular design that decouples the architecture, separates concerns, and manages dependencies. Unfortunately it often takes a few missed dates before a team realizes how important modularity is. Don’t let your existing product become a victim of its own success. Learn how to introduce modularity to existing software projects using Apache Felix. Discover how your application can evolve into a pluggable standards driven framework. It’s never too late to reap the benefits of modularity!
Continuous delivery with Gradle
This document discusses using Gradle, Artifactory, and Git to enable continuous delivery of software. It describes how these tools can automate builds, testing, and deployments to allow for frequent, low-risk releases. Gradle is highlighted as a build tool that can combine features of Ant and Maven. Artifactory is presented as a binary repository for storing dependencies. Git is referenced for source control management. Continuous delivery aims to shorten the time from development to customer impact through experimenting and delivering more frequently.
Frontend 'vs' Backend Getting the Right Mix
Modern website architectures are typically composed of 2 parts: frontend and backend. Building out frontend and backend components requires diverse skill sets and often have competing interests when it comes to developer productivity and site performance. This talk will discuss some ways Java frameworks deal with these issues as well as benefits and tradeoffs. The talk will include combine demos with cutting edge frontend frameworks (Handlebarsjs, CoffeeScript, Less) and popular Java backends (Spring, Apache CXF).
Bio:
Bob Paulin is an independent consultant that has been developing on Java for the past 10 years. Bob is focuses on Business Enablement and Web Centric Applications. He’s presented in the past at CJUG on Apache Sling and is currently helping his clients perform modular development/design, automation for continuous delivery, and build forward leaning web applications. When not coding, Bob enjoys coaching football and spending time with his with his wife and 3 kids.
Build Your Own CMS with Apache Sling
This document provides an overview of building a content management system (CMS) using Apache Sling. It discusses how Sling uses OSGi and the Java Content Repository to provide a RESTful framework. Example uses of Sling include content CRUD operations via the Sling Post Servlet and resource resolution. The document then demonstrates how to set up a Sling development environment and build sample pages that include a WYSIWYG editor and image uploads using Sling and technologies like JavaScript, jQuery, Bootstrap and Groovy.
Code Quality Practice and Tools
The document discusses code quality and its importance. It defines code quality as code that works functionally, is testable, and is easy to maintain. It identifies good practices such as writing testable code, avoiding complexity, and following principles like DRY. Tools like test frameworks, code coverage tools, static analysis tools, and integrated tools like Sonar can help ensure code quality and catch issues early.
More from Bob Paulin (12)
Do more with LESS, Handlebars, Coffeescript and other Web Resources in AEM
Do more with LESS, Handlebars, Coffeescript and other Web Resources in AEM
Recently uploaded
Essentials of Automations: The Art of Triggers and Actions in FME
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
Presentation from Ghazal Aakel and Eric Jochum at the GSD Community Stage Meetup on June 6th, 2024
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
Understanding variable roles in code has been found to be helpful by students
in learning programming -- could variable roles help deep neural models in
performing coding tasks? We do an exploratory study.
- These are slides of the talk given at InteNSE'23: The 1st International Workshop on Interpretability and Robustness in Neural Software Engineering, co-located with the 45th International Conference on Software Engineering, ICSE 2023, Melbourne Australia
E-Invoicing Implementation: A Step-by-Step Guide for Saudi Arabian Companies
Explore the seamless transition to e-invoicing with this comprehensive guide tailored for Saudi Arabian businesses. Navigate the process effortlessly with step-by-step instructions designed to streamline implementation and enhance efficiency.
Webinar On-Demand: Using Flutter for Embedded
Flutter is a popular open source, cross-platform framework developed by Google. In this webinar we'll explore Flutter and its architecture, delve into the Flutter Embedder and Flutter’s Dart language, discover how to leverage Flutter for embedded device development, learn about Automotive Grade Linux (AGL) and its consortium and understand the rationale behind AGL's choice of Flutter for next-gen IVI systems. Don’t miss this opportunity to discover whether Flutter is right for your project.
Using Query Store in Azure PostgreSQL to Understand Query Performance
Microsoft has added an excellent new extension in PostgreSQL on their Azure Platform. This session, presented at Posette 2024, covers what Query Store is and the types of information you can get out of it.
How to write a program in any programming language
How to write a program in any programming language
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
Regarding mobile operating systems, two major players dominate our thoughts: Android and iPhone. With Android leading the market, software development companies are focused on delivering apps compatible with this OS. Ensuring an app's functionality across various Android devices, OS versions, and hardware specifications is critical, making Android app testing essential.
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
https://2024.springio.net/sessions/automated-software-refactoring-with-openrewrite-and-generative-ai/
Unveiling the Advantages of Agile Software Development.pdf
Learn about Agile Software Development's advantages. Simplify your workflow to spur quicker innovation. Jump right in! We have also discussed the advantages.
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers. This video you can watch from my youtube channel at https://youtu.be/m-F-mZA3MkU
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Dr. Jesús Barrasa, Head of Solutions Architecture for EMEA, Neo4j
Découvrez les dernières innovations de Neo4j, et notamment les dernières intégrations cloud et les améliorations produits qui font de Neo4j un choix essentiel pour les développeurs qui créent des applications avec des données interconnectées et de l’IA générative.
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Allez au-delà du battage médiatique autour de l’IA et découvrez des techniques pratiques pour utiliser l’IA de manière responsable à travers les données de votre organisation. Explorez comment utiliser les graphes de connaissances pour augmenter la précision, la transparence et la capacité d’explication dans les systèmes d’IA générative. Vous partirez avec une expérience pratique combinant les relations entre les données et les LLM pour apporter du contexte spécifique à votre domaine et améliorer votre raisonnement.
Amenez votre ordinateur portable et nous vous guiderons sur la mise en place de votre propre pile d’IA générative, en vous fournissant des exemples pratiques et codés pour démarrer en quelques minutes.
openEuler Case Study - The Journey to Supply Chain Security
openEuler Case Study - The Journey to Supply Chain Security
Microservice Teams - How the cloud changes the way we work
A lot of technical challenges and complexity come with building a cloud-native and distributed architecture. The way we develop backend software has fundamentally changed in the last ten years. Managing a microservices architecture demands a lot of us to ensure observability and operational resiliency. But did you also change the way you run your development teams?
Sven will talk about Atlassian’s journey from a monolith to a multi-tenanted architecture and how it affected the way the engineering teams work. You will learn how we shifted to service ownership, moved to more autonomous teams (and its challenges), and established platform and enablement teams.
What is Master Data Management by PiLog Group
PiLog Group's Master Data Record Manager (MDRM) is a sophisticated enterprise solution designed to ensure data accuracy, consistency, and governance across various business functions. MDRM integrates advanced data management technologies to cleanse, classify, and standardize master data, thereby enhancing data quality and operational efficiency.
socradar-q1-2024-aviation-industry-report.pdf
SOCRadar's Aviation Industry Q1 Incident Report is out now!
The aviation industry has always been a prime target for cybercriminals due to its critical infrastructure and high stakes. In the first quarter of 2024, the sector faced an alarming surge in cybersecurity threats, revealing its vulnerabilities and the relentless sophistication of cyber attackers.
SOCRadar’s Aviation Industry, Quarterly Incident Report, provides an in-depth analysis of these threats, detected and examined through our extensive monitoring of hacker forums, Telegram channels, and dark web platforms.
E-commerce Development Services- Hornet Dynamics
For any business hoping to succeed in the digital age, having a strong online presence is crucial. We offer Ecommerce Development Services that are customized according to your business requirements and client preferences, enabling you to create a dynamic, safe, and user-friendly online store.
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
No one wants their application to drag like a car stuck in the slow lane! Yet it’s all too common to encounter bumpy, pothole-filled solutions that slow the speed of any application. Symfony apps are not an exception.
In this talk, I will take you for a spin around the performance racetrack. We’ll explore common pitfalls - those hidden potholes on your application that can cause unexpected slowdowns. Learn how to spot these performance bumps early, and more importantly, how to navigate around them to keep your application running at top speed.
We will focus in particular on tuning your engine at the application level, making the right adjustments to ensure that your system responds like a well-oiled, high-performance race car.
Energy consumption of Database Management - Florina Jonuzi
Presentation from Florina Jonuzi at the GSD Community Stage Meetup on June 06, 2024
Recently uploaded (20)
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
E-Invoicing Implementation: A Step-by-Step Guide for Saudi Arabian Companies
E-Invoicing Implementation: A Step-by-Step Guide for Saudi Arabian Companies
Using Query Store in Azure PostgreSQL to Understand Query Performance
Using Query Store in Azure PostgreSQL to Understand Query Performance
How to write a program in any programming language
How to write a program in any programming language
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Unveiling the Advantages of Agile Software Development.pdf
Unveiling the Advantages of Agile Software Development.pdf
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
openEuler Case Study - The Journey to Supply Chain Security
openEuler Case Study - The Journey to Supply Chain Security
Microservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we work
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Energy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina Jonuzi
Microservice Networking in Anger
- 2. Bob Paulin Independent Consultant ASF Member Java Champion Chicago JUG CFO Offheap & Java Pubhouse Podcast
- 5. Things are about to get Strange
- 10. Chapter 1 The Tools of the Trade
- 11. TCP Dump and Wireshark Seeing in the Upside Down
- 12. Apache Bench Torture by HTTP
- 13. Chapter 2 The TCP and the UDP
- 16. Chapter 3 The Network Flayer
- 17. Wreck Havoc on your network sudo tc qdisc add dev lo root netem loss 10.0% http://strangerthings.wikia.com/wiki/The_Mind_Flayer
- 19. OMG Errors Make them go away!
- 20. OMG I’m out of threads How did this happen!
- 23. Chapter 5 The Websocket and the Proxy
- 28. Yet another timeout setting timeout tunnel 3600s
- 30. Chapter 6 It’s all about Presentation
- 32. Java Serialization No Libs needed Metadata included
- 33. ProtoBuf Compact Binary Format Code Gen Required
- 35. Chapter 7 TLS, Node, and the JVM
- 38. Chapter 8 Discovery with Docker Multicast