Designing a single-file mmap-backed read-only hashed multi-table database
For some time I wanted to design a CDB (Constant DataBase) alternative that fits better my use-case for Kawipiko (high performance read-only static HTTP server).
Volution Notes
Latest posts
Individual URL compression experiment initial thoughts
I've made some experiments with compressing individual URLs, and I describe my initial observations (while comparing to standard compression algorithms).
EU-based cloud alternatives affordability for small projects and companies
My personal experience in finding affordable EU-based cloud providers for a small personal project. And my pessimistic assessment of the competitiveness in this segment with their USA-based competitors.
Bot countermeasures impact on the quality of life on the web
About how another instance of "the scientific progress justifies the means", or perhaps "how a corporation milks profits from other people's work", triggers an arms race that piece by piece dismantles the open web, and turns it into walled gardens.
Misusing Linux policy based routing for firewalling
Experimenting with Linux policy based routing, i.e. `man ip-rule(8)`, as a stateless firewall substitute.
Linux UEFI booting simplified
Demystifying the UEFI boot process with a focus on Linux, simplicity, reliability, and security.
Infineon TPM firmware update on the HP t620 thin client
Updating the Infineon TPM firmware on an HP t620 thin client, which is vulnerable to the ROCA attack (that allows an attacker to recover the RSA private key).
Musing about a secure computer for sensitive data
How about splitting the usage and storage of sensitive documents and data? Plus a few ideas on how to implement a small custom "secure" computer for the storage part.
Context binding password-based authentication
Experimenting with password-based authentication implemented directly in Postgres, all sprinkled with a few twists.
Pre-hashing large password files used with PBKDFs
A subtle, but surprising, realization about password-based key-derivation functions when using long byte sequences as passwords.
Lightweight container building blocks
Documenting various open-source tools and projects that I've found while experimenting with the Linux container technology.
Please don't write application launchers in `sh`!
`sh` is not a programming language! Write application launchers in proper languages!
We need deterministic installs, not just immutable OSs
Immutable OSs are just a minor step towards reliable OS installations. However, for a complete solution we also need reproducible and thus deterministic installations, which implies cleaning-up and modernizing our package managers.
Linux becoming a Windows / OSX clone
A rant about the complexity of modern Linux distributions, which places them on par with the opaqueness of Windows and OSX.
Learning before dabbling in applied cryptography
A live document providing learning resources and pointers for those that want to experiment with applied cryptography.
Misusing random oracles for practical purposes
Experimenting with various real-world instantiations of cryptographic random oracles, with applicability from multi-factor encryption, to database record encryption.
Experimenting with multi-factor encryption
Prototyping an encryption tool that allows combining multiple encryption factors, from PIN's, passwords, to X25519 pairs, and beyond.
My biases when choosing open-source tools
I reflect on my preferences when it comes to choosing open-source tools I need to rely upon.
SSH authorization keys experiments
Experimenting with OpenSSH authorization keys resolution; from skeleton-key providing emergency access, to simple centralized key management.
Privatizing our digital identities
Trying to make the case for permanent irrevocable digital identities, which unfortunately today, by de-facto, are email addresses.
Another take on the binary to text encoding
A few words about one of my latest open-source projects, `z-tokens`, that among other thinks, also tries to tackle this problem but providing more added value compared to existing solutions.
Binary to text encoding -- state of the art and missed opportunities
Although many software engineers know about the topic, especially through their exposure to Base64, there are however many issues and missed opportunities not tackled by the broad community.
Debating deterministic passwords
A few words of caution about storage-free deterministic password managers.
Containerized deployments, the Death Star of complexity
An interesting take on containerized deployments, contrasted with other similar trajectories in the software engineering history.
Passwords in deployment or development scripts?
Questions (without definitive answers) about how to securely manage secrets in scripts and development environments?
Memorable password schemes and patterns?
Questions (without definitive answers) about memorable password schemes and patterns.
Password strength for offline storage?
Questions (without definitive answers) about password strength (i.e. entropy bits) for offline storage.
Securing my static site server with seccomp
Given a simple enough HTTP server, and by employing seccomp, one could easily achieve a quite secure(er) server, with a small enough attack surface that the potential attacker might want to look elsewhere in the stack for vulnerabilities.
Static site hosting hurdles
When it comes to static sites, there are a myriad of solutions for authoring and compiling, but talk about hosting these static sites, and we are still in the early 2000s. I discuss the challenges one faces when hosting, and even make a proposal to solve some of these.
Useful Firefox addons
A few Firefox addons I use on a daily basis.
The many flavors of hashing
About the many types of hash functions, their use-cases, dos and don'ts, with suggestions for currently accepted algorithms.
On modern laptop requirements
The impact of hacktivism / protestware in open-source
Single binary executable packages
In support of software packages that come in the form of a single binary executable (statically linked or portable), that one can just copy anywhere in `${PATH}` and execute, without needing `sudo`, or downloading half the distribution's packages as dependencies.
Good to know -- issue 2021.02
Articles and tools I've found interesting in the last few days.
Security through stupidity, Banca Transilvania style
About how the largest romanian bank tries to give its clients a "warm-fuzzy-feeling" of security, that is actually zero in real security terms.
Good to know -- issue 2021.01
Articles and tools I've found interesting in the last few days.
In Go-land you pay even for what you don't use
About the hidden costs of forced automatic initialization of dependencies. And a plea for library developers (in any language) to think about their global state initialization requirements.
The curious case of shell commands, or how "this bug is required by POSIX"
About the fatal perils and traps of many modern tools that handle "shell commands" as passed through `system(3)` or `sh -c`. Or, how by the end of 2020, we still haven't given up on shell's equivalent "SQL building", or how shell's equivalent "SQL injection" still thrives in our engineering world... Plus a `glibc` bug, then a Linux man pages bug, then a POSIX specification bug...
Benchmarking "textual" file compression methods
Trying to identify which compression tool and level yields the "best" outcome for "textual" archival purposes. (Spoiler: "it depends...")
Cleaning and compacting Git repositories
How to compact and clean Git repositories of "dangling" commits and objects.
Properly sorting FQDNs in Bash
How to properly sort a list of FQDNs in Bash, first by TLD, then by domain, then by sub-domain and so on.
The before time -- microsoft.com
A visual history of `microsoft.com` (thanks to the Internet Archive and its Wayback Machine).
The before time -- google.com
A visual history of `google.com` (thanks to the Internet Archive and its Wayback Machine).
Good to know -- issue 2019.02
Articles and tools I've found interesting in the last few days.
A visual comparison between HTTP/1.1 vs HTTP/2
A visual comparison between HTTP/1.1 and HTTP/2 in the context of many small resources and with real-world latency.
Exfiltrating Go current goroutine ID
About obtaining Go current goroutine ID, and why sometimes we should trust the developer to do the right thing... Else the developer is forced to embark on a journey that looks more like a mission impossible data exfiltration movie, than a day-to-day job...
Good to know -- issue 2019.01
Articles and tools I've found interesting in the last few days; and about the start of a new "column".
Containers Will Not Fix Your Broken Culture (and Other Hard Truths)
About the "DevOps culture" plus related technologies, less about containers, but all about our professional careers as software developers or operators.
Choosing Linux RAID5 chunk size (part 3) -- Ext4 / CDNjs raw data
About choosing the "right" RAID5 chunk size on Linux systems, and related benchmarks. This part provides the raw data from the CDNjs benchmark.