Darkside of Software Engineering.
With the release of macOS Sequoia many developers must have started discovering new exciting changes in otherwise settled and stable APIs. One good example is Electron's desktopCapturer that lets apps list windows and screens available for screensharing and then stream their contents during a video call. With the Sequoia release, however, using desktopCapturer directly presents an extra window to…
My team at Signal constantly faces challenges that go beyond what one would expect while working on practically any other messaging application. Consider the following facts about Signal: Does not collect telemetry. Uses strong and proven cryptography to enable end-to-end encryption by default while emphasizing security within the UX too. Doesn't permanently store queued end-to-end encrypted…
Recently Signal has open-sourced a SQLite extension that provides better support for non-latin languages (Chinese, Japanese, etc) in the Full-Text Search (FTS) virtual table. I was one of the engineers who worked on this extension and in the course of this endeavor I got to learn about the structure of the SQLite's FTS implementation. The existing documentation focuses mostly on API and its use…
About one year ago, I've discovered a way to do a Denial-of-Service (DoS) attack on a local Node.js instance. The process involved sending huge amounts of data to the HTTP server running on the same machine as the attacker, and measuring the timing differences between various payloads. Given that the scope of attack was limited to the same machine, it was decided by V8 team and myself that the…
Over this weekend I got not so original (but definitely a fun one) idea to build fully distributed and decentralized Twitter. At the time it was inspired by the DAT Project and Hypercore , neither of which could support public replies to user feeds. Hence, the most natural thing was to write a new protocol ! Say hello to HyperBloom ! Protocol # It is crucial to understand the needs for the…
Moment of History # There is a mostly forgotten security issue that was fixed in Node.js back in 2012. It was originally announced on the 28c3 conference December, 2011 and the final fix landed in January, 2012 . In few words, the most of dynamic languages use either bucket lists or open addressing variants of hash tables. V8 uses the latter one, and in such case when VM is asked to insert a…
Preface # Writing servers/clients in C could be non-trivial. Even with the help of such powerful (and awesome dinosaur) libraries as libuv , it still takes lots of effort and boilerplate code to create real world applications. Some of this boilerplate code comes from the use of the widespread protocols like TLS (SSL) and HTTP. While there are popular implementations available as an Open Source…
Brief intro # This post is going to be about the sea-of-nodes compiler concept that I have recently learned. While it is not completely necessary, it may be useful to take a peek at the some of my previous posts on JIT-compilers before reading this: How to start JIT-ting Allocating numbers SMIs and Doubles Deoptimize me not, v8 Compilers = translators # Compilers are something that every Software…
Intro # There is nothing to be scared about in the C++ internals of the project, especially in internals of io.js and node.js . If you ever tried to optimize JavaScript code to squeeze out every possible performance or memory usage improvement out of it - you already wrote some C++ code. Many blogs, workshops mention JavaScript optimizations, and some of the popular suggestions are: Hidden Classes…
After reading antirez 's blog post I decided that it might be a good exercise to write down the notable side projects that I spent my time upon since Jan 2014. Here is the list and some comments from me: bn.js # JavaScript library for working with Big Numbers. bn.js is an ultra-fast bignum alternative with support for running in io.js/node.js and browsers. This one took lots of time and effort…
Compilers are awesome, right? If any programming concept may exist, it will probably be used in compiler implementation at some point. I am always amazed by my findings during v8 bug triaging or just random code exploration. The interesting thing about v8 that I was always passionate about, but never truly understood, was the Deoptimizer. The idea here is that v8 optimizes code to make it run…
Challenge # At April 11th 2014 Cloudflare has published a blog post suggesting to try out extracting a private key of their specially prepared challenge site using the Heartbleed OpenSSL vulnerability. Being busy at the time, I decided to give it a try a couple of hours later, if noone would crack it yet. This was a legal way to do some hackery, after all! Method # The method of attack was…
Bud # To terminate TLS or not? Good question, but instead of answering it - I'll try to make you believe that if you need a TLS terminator - the Bud is just the right choice. Other choices # Certainly, there are some other choices for TLS termination like: stud stunnel nginx (though, not only a TLS terminator, but a web server too) haproxy (much more than just a TLS terminator, but quite good!)…
Preface # Tracing node.js activity and detecting performance problems and bottlenecks has always been an important topic for many people in the community. Though, various ways to do this were available, including: systemtap, ETW and perfctr on Windows. The most complete tracing support was done by Joyent guys for the DTrace tool which works best on their Illumos fork, called SmartOS . Fortunately,…
This is a third post in the series of the JIT compiling crash-course. For a context please consider reading the first one and the second . Goal # Last time we created very basic bump memory allocator and made our existing code work with floating point double numbers, stored in the allocated heap objects. However floating point numbers are not suitable for some of precision-dependent operations and…
JIT # This is the second blog post in the series about JIT compiling. The previous post was an introduction into the Just-In-Time code generation and, in particular, jit.js usage. If you haven't read it yet - I recommend you to familiarize yourself with it first. Objectives # Previously, we created a JIT compiler, supporting a very limited subset of JavaScript: integer numbers, math binary…
Premise # Most developers heard about JIT compilers and how they can make slow interpreted languages run at a speed, comparable to native code. However, not many people understand how exactly this JIT thing works, and even less people could write their own compilers. I think having at least, basic knowledge of compiler internals may greatly improve understanding of the code that is running on that…
Flamegraphs are awesome if you need to profile your node.js application. They provide a nice looking visual view of where your application is spending its time. Although they're well documented , no one has ever said a word on how they work internally, but everyone mentions "ustack helper" which, right now, works only on SmartOS. Call stack # To understand profiling, one must understand what a…
Before I start diving into the deep sea of compiler internals, I would like to familiarize you with the Candor programming language and its Virtual Machine. This is the thing I was working on last 10 months, and one of the most wonderful and complex things I've been working on since the start of my software development career. Candor is an Ecmascript-inspired language, but while the newer versions…
TL;DR # As I've promised you in my previous post , I made TLSnappy balance and handle requests a little bit better. Data flow # For leveraging all available CPUs TLSnappy runs multiple threads that are each picking and processing tasks from their dispatch queues, one by one. Tasks are created from node's event-loop in following cases: Data comes from client and should be decrypted Data from server…
TL;DR # I've created TLSnappy module which is going to be faster than internal TLS module in node.js. So far it's slower on some benchmarks, but it'll definitely be much snappier soon. Preface # Many people were complaining about tls performance in node.js, which (as they said) was significantly worse than in many other popular web servers, balancers and terminators (i.e. nginx, haproxy..).…