There is oft-quoted advice that Kafka does poorly as a job queue. I’ve experienced this myself, and I wanted to formalize it a bit. I’ll use the common architecture of a Web application submitting background jobs to workers via Kafka (for example, to generate a PDF of some report). Except for the use of Kafka in this role, this is common in Web applications, and (speaking from experience!) when…
I recently gave a presentation on testing Python with Pytest at SkullSpace’s HAX festival. I covered general testing techniques, mocking, fixtures, and using Responses and Moto. You can find the video here or watch below, and the slides are here .
This is part 1 of possibly a 1-part series. We’ll see. Has this ever happened to you? You have some code like this: #include <string.h> #include <stdio.h> int main () { char buf [ 32 ] = { 0 }; strcpy ( buf , "Hello world, this is a long string" ); puts ( buf ); } You compile it, run it under a debugger like GDB (or ltrace ?) and set a breakpoint for the call to strcpy() : $ gcc test.c -o test $…
Erlang is pretty cool. It makes it easy to write programs that run on multiple computers cooperating over a network. The core of Erlang is familiar to Unix programmers: to multitask, you use multiple processes. Processes can do work themselves or they can have children do the work for them. Parents know when their children die. Children crashing do not harm their parent or the rest of the system.…
This is a story about code review. Specifically, getting too excited about lame-but-novel bugs and missing the important stuff. There’s a fair bit of navel-gazing. You’ve been warned. Our hackerspace has a monthly “hackathon” where we all get together and participate in a public activity like competing in a CTF or mailing cupcakes to England . Once in a while, we host our own events . This was…
Summary: Keystream reuse Key: WhyDoFartsSmell?SoTheDeafCanEnjoyThemAlso. I usually treat disassembling/debugging as a bit of a last resort, so I figured I’d challenge myself and lean on IDA Pro more heavily than usual. I ended up making a lot of mistakes and incorrect predictions, but learned some things and generally had a great time solving this challenge. What we have A stripped 64-bit Linux…
Summary: Repeating-key XOR/polyalphabetic/Vigenère cipher Key: And yes the nsa can read this to This was only worth 100 points, but only 137 teams (of 1384 scoring teams) did it, so I figured a writeup was in order. What We Have We have source code for a Python program called ‘csawpad.py’ that defines encryption and decryption functions, and 8 hex-encoded ciphertexts, presumably encrypted by the…
Summary: Makes calls to ioctl() in an attempt to blink Morse code on the keyboard LEDs Key: and0u0didnt0even0need0an0arduino I’m not sure how many people solved this challenge, but I thought it was neat, so I wrote it up. Comments and corrections are welcome. What We Have A 64-bit Linux binary. You can download it here . Goal Presumably, find a key from the binary somehow! Getting the key Running…
Summary: Partially-controlled-plaintext compression attack, similar to CRIME Key: crime_sometimes_pays This was a really neat problem that required a bit of creative thinking to pull off. Hopefully my enthusiasm for this problem comes through! Note: If I have made any mistakes here regarding the techniques used in the CRIME attack or the details of Zlib (both of which I only have cursory knowledge…