My personal blog
The influencers want you to think that you must learn a gazillion different technologies to become a successful .NET developer. These days, the internet is full of .NET “roadmaps” that include everything but the kitchen sink: Azure, AWS, Redis, Docker, Postgres, GraphQL, gRPC, Dapper, ELK stack, CQRS, you name it.
It’s Friday, and Invincible Shield, the long-awaited Judas Priest album, is finally out. To your surprise, it’s available on Bandcamp! You buy the album immediately, ecstatic that your favorite band has finally started releasing their music on your favorite music platform. You wake up the next day, only to find the album has vanished from your collection—you’ve fallen victim to a scam.
One of the topics I covered in my previous post on memory optimizations was string formatting. As I was writing that post, I uncovered an embarrassing gap in my knowledge!
After my service migrated from .NET Framework to .NET 8 (and later to .NET 9), it felt like a whole new world had opened to me. All the modern .NET features that I had only been reading about on the .NET Blog were finally available to me. Armed with Microsoft’s continuous, fleet-wide performance profiler, I embarked on a journey to find the places where my service was allocating the most memory…
Did you know that the albums you purchase on Bandcamp can disappear from your collection without notice? This can happen for various reasons. For example, a seller might decide on a whim to remove the album from the platform. Bandcamp apparently allows this in their terms of use: Content you purchase in a Transaction cannot be guaranteed to be available to you perpetually. Users bear all risk from…
At least one person has asked me about my thought process when searching for denial-of-service vulnerabilities: how do I choose the target libraries, what specifically I look for in them, etc. “At least one person” meaning “exactly one person”, and that one person happens to be my wife, but I decided to write a whole post on this topic anyway! In this half-memoir, half-tutorial post, I’ll show you…
It’s been almost five years since I created SharpFuzz, the only .NET coverage-guided fuzzer. I already have a blog post on how it works, what it can do for you, and what bugs it found, so check it out if this is the first time you hear about SharpFuzz: SharpFuzz: Bringing the power of afl-fuzz to .NET platform A lot of interesting things have happened since then. SharpFuzz now works with…
In my previous post I talked about the dangers of StackOverflowException. I also promised to show you how denial of service looks like in real world. Today, I’m delivering on that promise! Let’s start by answering the fundamental question: how does a process crash lead to denial of service in the first place? Theoretical explanation Suppose you are running an HTTP web service and an attacker sends…
I have always been fascinated by .NET’s StackOverflowException. It’s interesting because it’s fundamentally different from most other exceptions—you can’t catch it with a try/catch block. When you overflow the stack, it’s game over—the runtime will terminate your process. This behavior is especially devastating for web services that are deserializing user-controlled data. If your data structure…
This story started while I was preparing my blog post about piracy. The idea was to make it clear that I am all for supporting artists with my money, while arguing that in some cases using piracy might be justified. I hadn’t even completed two sentences of the post before my brain decided to sabotage me with a seemingly innocent suggestion: “Hey, you should totally calculate the value of your…