/proc/self/exe overwrite from within a user namespace I work on Drop , a Linux sandboxing tool that uses user namespaces. As part of the work I have reviewed past vulnerabilities in similar programs. One such vulnerability was CVE-2019-5736 ; it allowed rogue processes that ran within a Docker container to escape the container by overwriting the container initialization binary (runc) exposed to…
Improving Unit Test Coverage with Gemini Recently, I’ve experimented with using Google’s Gemini AI for automatically improving unit test coverage of a Python project. I’ve used Gemini 1.5 Pro model, which has a 2 million tokens context window and is recommended for coding-related tasks. For the purpose of testing, I selected a Python third-party library with basic algorithms:…
Shapespark Shapespark is a company that my friend Wojtek and I have started, and it has been the center of our attention during the last couple of months. Our goal is to build a tool for professional architects and interior designers to create WebGL-based real-time interactive visualizations. We focus on the quality of visualizations, utilizing physically-based rendering techniques to calculate…
wwwhisper add-on for Node.js The wwwhisper Heroku add-on is now available for Node.js. As with the Ruby Rails/Rack version the setup is just a matter of three lines of config that enable the wwwhisper auth middleware. One of the goals of wwwhisper is to decouple authentication and authorization logic from the application business logic. Such approach allows to easily enable auth without changing…
Object Oriented Programming with closures I’ve been recently watching Structure and Interpretation of Computer Programs . These are great lectures that I highly recommend to everyone interested in programming. Some people can be discouraged by the use of Scheme, don’t be. Scheme is a tiny language, very easy to pickup and follow, and many techniques from the lectures are applicable to today’s…
wwwhisper add-on released The authorization add-on for Heroku is finally out of beta. A huge thank you to everyone who has tried the add-on during the testing phases! Plans and pricing Three plans are currently available: Starter is a free plan that allows to grant access to a protected application to a single user. The plan gives an easy way to try wwwhisper. It should also cover the needs of…
DoS attack on CDN users Sibling domains cookie isolation got some publicity recently when GitHub moved user generated pages to github.io . The problem is not new , but many sites still ignore it. One issue that somehow escaped popular perception is that cookie isolation policy can be exploited to break sites that depend on content hosted on Content Delivery Networks. The issue affects most CDN…
wwwhisper add-on update The wwwhiser add-on is now in open beta. It can finally be enabled for any Rails or Rack based application that runs on Heroku! Give it a try . Because integration with the add-on is provided via Rack middleware, the cost is minimal; there is no need to write any code, few lines of config do the job.
Underhanded C Contest The Underhanded C Contest is in a way an opposite of the Obfuscated C Code Contest. The task is to write a readable and elegant piece of code that looks legitimate but hides a malicious feature. The feature should ideally look like an unfortunate mistake, not something intentionally added. The contest is now back after four years of inactivity and the 2009 results are finally…
wwwhisper add-on update The wwwhiser Heroku add-on is now in a private beta phase. The official documentation is on Heroku. In this phase only Heroku beta users can officially sign up, but if you are interested in trying, drop me an email.
Random walk illustrated with D3 I’m playing with D3 and I’m impressed how easy it is to create visualisations with this library. Below is my first attempt: a visualisation of a random walk (see the code ). The mechanism is simple: each step of the walk is made either in the left or the right direction depending on a result of a coin flip. After several steps, a destination point is marked and a…
Django DB Pool on Heroku Recently I switched my Django application that runs on Heroku to use production PostgreSQL database. According to the documentation common queries to such database should take less than 10ms. Unfortunately, Django requests were taking about 45ms (each request executed a single SQL query, with no joins and a single row result. The row lookup was done by an indexed column,…
wwwhisper Heroku add-on I’ve worked recently on making wwwhisper authorization available as a service for Heroku applications. This greatly simplifies wwwhisper setup and management. You can enable wwwhisper add-on for any Ruby based application with just 3 lines of config ! Following Heroku add-on development processes, the wwwhisper add-on is now in alpha testing phase and needs to be…
C++ puzzle You have a C++ class with all methods marked const , no operator= and one private field x initialized by the constructor and not market mutable . Can a value of x change after an object is created? For example, for a class below: class Puzzle { public : Puzzle ( int x_arg ) : x ( x_arg ) {} int get_x () const { return x ; } void someMethod1 (...) const { ... } SomeReturnValue…
Productivity Tip of the Week sudo ifconfig eth0 down ;
wwwhisper on OpenShift I’ve prepared instructions and scripts to easily setup wwwhisper autorized nginx on the OpenShift platform. Please visit github for more details and links to a demo site.
Sibling domains cookies isolation Recently I’ve spent some time studying the topic of cookies isolation for sibling domains. Relevant information is scattered through various resources, as a result, the issue is often misunderstood. Sibling domains are subdomains that share a common suffix which is not a public suffix. For example, foo.example.com and evil.example.com are sibling domains, because…