Седмицата (14–19 април)

Post Syndicated from Йовко Ламбрев original https://www.toest.bg/sedmitsata-14-19-april/

Седмицата (14–19 април)

Ту-туу… Празнувате ли вече? Празнувайте, празнувайте. Тя, сметката, скоро ще застигне всички ни.

Няма как иначе, когато оставяме властта в мръсните ръчички на алчни, зли и неграмотни хора с все по-ескалиращи дементни прояви. Или когато насила им я набутваме в ръцете, както направиха отвъд океана. Анализаторите продължават да се колебаят има ли някакъв умисъл зад това, което се случва, или всичко е проявление на една безумна стратегия на арогантността.

В този контекст Искрен Иванов припомня за един от нашумелите скандали – #Signalgate, който според него, извън очевидното неадекватно боравене с чувствителна и поверителна информация, ще има сериозен отзвук върху функционирането на службите за разузнаване по света и партньорствата между тях. Прочетете повече в анализа му „Разузнаване и политика. Скандалът Signal и бъдещето на Петте очи“.

Да не пропуснем обаче една добра новина, която дойде покрай паниката на борсите, предизвикана от митата на Тръмп. И тя е, че беше развенчан митът как криптовалутите могат да бъдат алтернативен спасителен пояс за инвестициите. Криптотърговията в абсолютен синхрон отбеляза сходен драматичен спад.

Една илюзия по-малко за бъдещето не може да не е добра новина.

Иначе, засега ключовите световни финансови организации се опитват да бъдат хладнокръвни и да не наливат масло в огъня, подпален от американския президент. Европейската централна банка намали за пореден път лихвите. И макар те да стигнаха най-ниските нива от две години насам, очакванията са тенденцията да се запази, ако несигурността, провокирана от Белия дом, продължи. Международният валутен фонд оцени тази несигурност като „извън границите на допустимото“. Организацията предупреди за сериозно свиване на растежа, макар засега да отхвърля опасността от рецесия и прогнозите, че доларът може да загуби статуса си на световна резервна валута.

У нас НСИ отчете 10% ръст на банкрутиралите бизнеси за първото тримесечие на 2025-та в сравнение със същия период на предходната година. Но пък добрата новина от тази седмица е, че България вече изпълнява всички критерии за членство в еврозоната, а на 4 юни Европейската комисия ще публикува извънреден доклад за готовността за приемането ни от 1 януари 2026 г.

Правителство, оглавявано от Сергей Станишев, ни вкара в Европейския съюз, ако помните. Не че имаше някакви заслуги, просто инерцията от реформите на Иван Костов премина необезпокоявана през мандата на Царя и триумфира в ръцете на триглавата ламя… прощавайте, тройната коалиция исках да кажа.

Колко му е правителство на Пеевски да ни вкара в еврозоната? Такава ни била орисията.

Понеже кабинетът „Желязков“ официално вече ще се води правителство на малцинството (ГЕРБ–СДС, ИТН, БСП–ОЛ). Подкрепяно от Пеевски.

А циркът отвъд океана дава криле и на политическите циркаджии у нас. То и без друго провинциалните им умения никога не са ставали за световната сцена. Покрай това и политическият коментар на Емилия Милчева в „Тоест“ тази седмица слаломира между реалността и спектакъла, понеже… как иначе да го опишеш. Не пропускайте текста ѝ „Ту-тууу! И Тръмп им се показа“.

На този фон направо се възхищавам на Елена Телбис за мотивацията и силите да прави своята политическа сатира, когато действителността е сякаш лошо копие на най-безумния трип на яко надрусан посредствен режисьор.

В поредния текст от съвместната ни рубрика с „Екипът на София“ Ивелина Гаджева и Константин Кирилов споделят идеите си как може да се подобри достъпността на средата в столицата ни. Предложенията са напълно приложими и за другите населени места, които обитаваме. Прочетете повече в статията им „Концепцията за достъпна среда на фона на ремонтите на тротоарите в София“.

Тазгодишното издание на софийските литературни срещи ще се проведе от 24 до 26 април, а темата е „Археология на паметта“. По този повод Стефан Иванов разговаря с един от международните гости – носителя на наградата „Букър“ за 2022 г. Шехан Карунатилака. Едно сърдечно и много човешко интервю, което силно ви препоръчвам да прочетете точно сега, по празниците.

И понеже, сигурен съм, всички имаме нужда от повече добри новини, тук е мястото да вметна да прочетете репортажа на Associated Press за „книжната бригада“ от едно малко градче в Мичиган с около 5000 жители. Местна малка книжарница трябвало да се премести на друг адрес заедно със своите 9100 книги. И вместо книгите да се опаковат в кашони и да се транспортират с хамали, триста души от градчето сформирали човешка верига от едното място до другото и само за два часа, от ръка на ръка, всяко томче намерило своето място – на новия адрес, на правилния рафт, подредено по азбучен ред. Един хубав пример за силата на общността.

Заедно имаме повече власт и сила, отколкото изглежда на пръв поглед.

С влиянието на сексуалната революция продължава рубриката на Надежда Цекулова за женското здравеопазване. Именно след тази обществена промяна в нагласите тялото на жената все повече започва да принадлежи на нея самата. Както и социалната ѝ роля да не бъде ограничавана до майка и съпруга.

„Да пишеш за хашиша в Близкия изток и Северна Африка е, като да си арабист и да преоткриеш Корана.“ Така Атанас Шиников ни въвежда в новия си материал от рубриката „Ориент кафе“. В поредната тема (с продължение) обаче ще можем да прочетем не само за историята на хашиша, но и за влиянието му върху културата, икономиката и политиката. Не пропускайте първата част на статията „За философите е „хапка мисъл“. Хашиш и ислям“.

Ако пък очаквате продължението на дискусията на Миглена Николчина и Северина Станкева за играта притча „Индика“ и за интелектуално-философските послания, преплетени в повествованието ѝ – ето го и него тази седмица.

Тази седмица загубихме Kaladan, както беше познат Владимир Петков. Един от хората, на които българският интернет и няколко субкултурни общности дължат много. Познавам го от над 20 години и без да сме били особено близки, се сещам за 5–6 проекта, които без него нямаше да се получат. Вероятно пропускам поне още толкова. Той беше от хората, които си вършат работата и са на мястото си, без да очакват благодарности или овации. Готов да подаде ръка или да удари рамо. Ще липсва много. Сбогом, Kaladan!

И накрая – още две препоръки. Едната е текстът „Минчев, Мъск и Микеланджело“ на Иван Ланджев в „Дойче Веле“. Вярвам, че всеки може да намери с какво да е несъгласен в него – това е лесно. Но също така съм сигурен, че всеки има и върху какво да се замисли.

Другата ми препоръка е тази блестяща TED реч на Каръл Кадуаладър отпреди няколко дни, наречена „Ето как изглежда дигиталният преврат“. Разследваща журналистка в The Observer и The Guardian от 19 години, тя наскоро беше уволнена, защото се противопостави на сделката за придобиването на Observer. Кадуаладър стана изключително популярна в международен план с разкритията си за Facebook и Cambridge Analytica и за злоупотребата с данни, за да се влияе върху избирателите. Беше жертва на изключително тежко съдебно дело за сплашване.

Чуйте внимателно всяко изречение…

И запомнете, че заедно не сме безсилни!

„Тоест“ зависи от вашата подкрепа, за да продължи да нарича нещата с точните думи. А и сякаш всички имаме нужда да се почувстваме заедно. Както и от малко нормалност около себе си.

Приятно четене и гледане!

Version 1.2.4

Post Syndicated from NTPsec Project Blog original https://blog.ntpsec.org/2025/04/18/version-1.2.4.html

The NTPsec Project is pleased to announce the tagging of version 1.2.4

  • waf has been upgraded to version 2.1.4
    NB: on Debian, waf now installs Python programs (ntpq, ntpmon, …​)
    in /usr/local/lib/python3.xx/site-packages rather than …​/dist-packages
    A quick fix is to link site-packages to dist-packages before installing.
    You will have to do that again each time your distro updates to a new
    version of Python.

  • Python 2.7 is now the minimum supported version.
    This is likely to be the last release supporting Python 2.

  • waf install now tests the installed binaries
    This will complain if your python search path isn’t working.
    See README-PYTHON for more info.

  • waf configure --enable-Werror will turn warnings into errors
    This lets developers and our CI find warnings in a sea of printout.

  • Fix ntpviz’s skewness and kurtosis formulas. Fix suggested by Frank Davis.

  • ntpd now runs on FIPS mode systems.

  • Clock fuzzing is gone. --disable-fuzz is now standard.

  • Fix distinct rpeers mode in PeerSummary.summary.

  • Fix addr2refid to work with FIPS-140-2 mode.

  • Update the leap-seconds.list source in ntpleapfetch.

  • Remove obsolete nopeer and notrap mentions from the Access Control List
    documentation.

  • ntpd can now listen on a second port. Add either “nts port xxxx”
    or “extra port xxxx” in your config file. If either is specified,
    the NTS-KE server will tell the client to use that port. This might
    help get around some of the blocking or filtering that ISPs are
    doing to port 123. (Don’t forget to let UDP traffic for that port
    through your firewall.) I’ve been testing with port 8123.

  • Client requests will also be sent from that port. Again, that will
    bypass some port 123 filtering.

  • NTPsec now builds on Linux armhf. #832

  • Remove some remnant broadcast/multicast cruft.

  • Add a ntpdig option to bind to a specific address.

  • Add an ntpd config file option for the NTS-KE server’s preferred TLS
    ciphers.

  • Use ntp_gettime not than ntp_adjtime for local refclcock. Set the
    lockclock member of loop_data while the config parses, making
    ntp_adjtiime unusable. Don’t write a drift file while in lockclock
    mode and claim to slew time so that clients will listen to us,

  • Work around musl library in Alpine Linux not supporting ntp_gettime.

  • Remove unused holdover, LOOP_KERN_CLEAR and timetoa from ntpd.

  • Move toward AES-128 rather than MD5 for mac tests.

  • Add and revise exponential timing decay and MS-SNTP testing tools.

For other changes since the previous release, please consult
the project NEWS.adoc file
at https://gitlab.com/NTPsec/ntpsec/-/blob/master/NEWS.adoc

Getting this release

You can clone the git repo
from https://gitlab.com/NTPsec/ntpsec.git
and you can download the release tarballs with sums and signatures
from https://ftp.ntpsec.org/pub/releases/

This release is signed with the GPG key id
E57235D22764129FA4F2F4D17F52608ED0E49D76

How Smartsheet reduced latency and optimized costs in their serverless architecture

Post Syndicated from Anton Aleksandrov original https://aws.amazon.com/blogs/architecture/how-smartsheet-reduced-latency-and-optimized-costs-in-their-serverless-architecture/

Cloud software as a service (SaaS) companies are often looking for ways to enhance their architectures for performance and cost-efficiency. Serverless technologies offload infrastructure management, allowing development teams to focus on innovation and delivering business value. As application architectures grow and face more demanding requirements, continued optimization helps maximize both the technical and financial advantages of the serverless approach.

In this post, we discuss Smartsheet’s journey optimizing its serverless architecture. We explore the solution, the stringent requirements Smartsheet faced, and how they’ve achieved an over 80% latency reduction. This technical journey offers valuable insights for organizations looking to enhance their serverless architectures with proven enterprise-grade optimization techniques.

Solution overview

Smartsheet is a leading cloud-based enterprise work management platform, enabling millions of users worldwide to plan, manage, track, automate, and report on work at scale. At the core of the platform lies an event-driven architecture that processes real-time user activity across various document types. Given the collaborative nature of the platform, multiple users can work on these documents concurrently. Every document interaction triggers a series of events that must be processed with minimal latency to maintain data consistency and provide immediate feedback. Processing delays can impact user experience and productivity, making consistently low latency a fundamental business requirement.

Smartsheet’s traffic pattern is spiky during business hours and mostly dormant during nights and weekends. Within peak periods, traffic can fluctuate as users collaborate in real time. To efficiently manage dynamic workloads, which can surge from hundreds to tens of thousands of events per second within minutes, Smartsheet implements a serverless event processing architecture using services such as Amazon Simple Queue Service (Amazon SQS) and AWS Lambda. This architecture uses the elasticity of serverless services and the ability to automatically scale dynamically based on the traffic volume. It makes sure Smartsheet can efficiently handle sudden traffic surges while automatically scaling down during off-peak hours, optimizing for both performance and cost-efficiency.

The following diagram illustrates the high-level architecture of the Smartsheet event processing pipeline.

high-level architecture of the Smartsheet event processing pipeline

Optimization opportunity

Smartsheet uses Lambda functions to serve both batch jobs and API requests. The primary runtime used for building those functions is Java. Lambda automatically scales the number of execution environments allocated to your function on demand to accommodate traffic volume. When Lambda receives an incoming request, it attempts to serve it with an existing execution environment first. If no execution environments are available, the service initializes a new one. During initialization, the Smartsheet’s function code commonly sends several requests to external dependencies, such as databases and REST APIs, which might take time to reply.

The following diagram illustrates how Lambda functions reach out to external dependencies during initialization.

Lambda functions reach out to external dependencies during initialization

These tasks introduced execution environment initialization latency, commonly referred to as a cold start. Although cold starts typically affect less than 1% of requests, Smartsheet had stringent low latency requirements for their architecture to further prioritize the best possible end-user experience.

“To reduce customer request latency while keeping costs low, our engineering team utilized Lambda provisioned concurrency with auto scaling and Graviton, which resulted in an 83% reduction in P95 latency while providing a high quality of service as we continue to scale our platform and its limits,” says Abhishek Gurunathan, Sr Director of Engineering at Smartsheet.

Addressing the cold start with provisioned concurrency

To reduce cold start latency, the Smartsheet team adopted provisioned concurrency in their architecture, a capability that allows developers to specify the number of execution environments that Lambda should keep warm to instantly handle invocations. The following diagram illustrates the difference. Without provisioned concurrency, execution environments are created on demand, which means some invocations (typically less than 1%) need to wait for the execution environment to be created and initialization code to be run. With provisioned concurrency, Lambda creates execution environments and runs initialization code preemptively, making sure invocations are served by warm execution environments.

invocations are served by warm execution environments

Provisioned concurrency includes a dynamic spillover mechanism, making your serverless architecture highly resilient to traffic spikes. When incoming traffic exceeds the preconfigured provisioned concurrency, additional requests are automatically served by on-demand concurrency rather than being throttled. This provides seamless scalability and maintains service availability even during traffic surges, while still providing the performance benefits of pre-warmed execution environments for the majority of requests.

The Smartsheet team configured provisioned concurrency to match their historical P95 concurrency needs. This resulted in immediate improvements—the number of cold starts dropped dramatically and P95 invocation latency dropped by 83%. As the team monitored system performance, they quickly identified another architecture optimization opportunity—the Lambda functions were heavily used during work hours but had significantly fewer invocations at night and on weekends, as illustrated in the following graph.

Lambda functions were heavily used during work hours but had significantly fewer invocations at night and on weekends

Setting a static provisioned concurrency configuration worked great for busy periods, but was underutilized during off-times. The Smartsheet team wanted to further fine-tune their architecture and increase provisioned concurrency utilization rates to achieve higher cost-efficiency. This led them to look into provisioned concurrency auto scaling to match traffic patterns as well as adopting an AWS Graviton architecture.

Auto scaling provisioned concurrency and Graviton architecture

Two common approaches to enable provisioned concurrency are setting a static value and using auto scaling. With static configuration, you specify a fixed number of pre-initialized execution environments that remain continuously warm to serve invocations. This approach is highly effective for architectures that handle predictable traffic patterns. Unpredictable traffic patterns, however, can lead to under-provisioning during peak periods (with spillover to on-demand concurrency resulting in more cold starts) or underutilization during low-usage periods. To address that, provisioned concurrency with auto scaling dynamically adjusts the configuration based on utilization metrics, automatically scaling the number of execution environments up or down to match the actual demand. This dynamic approach optimizes for cost-efficiency and is particularly recommended for architectures with fluctuating traffic patterns.

The following figure compares static and dynamic provisioned concurrency.

static and dynamic provisioned concurrency

To further optimize the architecture for cost-efficiency, the Smartsheet team has implemented provisioned concurrency auto scaling based on utilization metrics. Smartsheet used an infrastructure as code (IaC) approach with Terraform to define auto scaling policies for maximum reusability across hundreds of functions. The policies track the LambdaProvisionedConcurrencyUtilization metric and define the scaling threshold according to the function purpose. For functions implementing interactive APIs, the auto scale threshold is 60% utilization to pre-provision execution environments early, keeping latency extra-low, and making functions more resilient towards traffic surges. For functions that implement asynchronous data processing, Smartsheet’s goal was to achieve the highest utilization rate and cost-efficiency, so they’ve defined the auto scale threshold at 90%.

The following diagram illustrates the architecture of auto scaling policies based on provisioned concurrency utilization rate and workload type.auto scaling policies based on provisioned concurrency utilization rate and workload type

Another optimization technique Smartsheet employed was switching the CPU architecture used by their Lambda functions from x86_64 to arm64 Graviton. To achieve this, Smartsheet adopted the ARM versions of Lambda layers they’ve used, such as Datadog and Lambda Insights extensions. This was required because binaries built using one architecture might be incompatible with a different one. Because Smartsheet functions were implemented with Java and packaged as JAR files, they didn’t have any compatibility issues when moving to Graviton. With Terraform used for codifying the infrastructure, this architecture switch was a simple property change in aws_lambda_function resources, as illustrated in the following code:

property change in aws_lambda_function resources

By switching to a Graviton architecture, Smartsheet saved 20% on function GB-second costs. See AWS Lambda pricing for details.

Best practices

Use the following techniques and best practices to optimize your serverless architectures, reduce cold starts, and increase cost-efficiency:

  • Fine-tune your Lambda functions to find the optimal balance between cost and performance. Increasing memory allocation also adds CPU capacity, which often means faster execution and can lead to reduced overall costs.
  • Use a Graviton2 architecture for compatible workloads to benefit from a better price-performance ratio. Depending on the workload type, switching to Graviton can yield up to 34% improvement.
  • Use provisioned concurrency and Lambda SnapStart to reduce cold starts in your serverless architectures. Start with static provisioned concurrency based on your historical concurrency requirements, monitor utilization, and introduce auto scaling into your architecture to achieve the optimal cost-performance profile.

Conclusion

Serverless architectures using services like Lambda and Amazon SQS offload the infrastructure management and scaling concerns to AWS, allowing teams to focus on innovation and delivering business value. As Smartsheet’s journey demonstrates, using provisioned concurrency and Graviton in your architectures can help significantly improve user experience by reducing latencies while also achieving better cost-efficiency, providing a practical blueprint for optimization across the organization. Whether you’re running large-scale enterprise applications or building new cloud solutions, these proven techniques can help you unlock similar performance gains and cost-efficiencies in your serverless architectures.

To learn more about serverless architectures, see Serverless Land.


About the authors

 

EU OS: A European Proposal for a Public Sector Linux Desktop (The New Stack)

Post Syndicated from corbet original https://lwn.net/Articles/1018058/

The New Stack looks
at EU OS
, an attempt to create a desktop system for the European public
sector.

EU OS is not a brand-new Linux distribution in the traditional
sense. Instead, it is a proof-of-concept built atop Fedora’s
immutable KDE Plasma spin (Kinoite). EU OS takes a layered approach
to customization. The project’s vision is to provide a standard,
adaptable Linux base that can be extended with national, regional
or sector-specific customizations, making it suitable for a wide
range of European public sector needs.

Metasploit Wrap-Up 04/18/2025

Post Syndicated from Christophe De La Fuente original https://blog.rapid7.com/2025/04/18/metasploit-wrap-up-04-18-2025/

Smaller Fetch Payloads

Metasploit Wrap-Up 04/18/2025

This week, a significant enhancement was made to the already awesome fetch payload feature by our very own bwatters-r7. The improvement introduces a new option, PIPE_FETCH, which optimizes the process by serving both the payload and the command to be executed simultaneously.

This enhancement directly addresses the challenge of limited space by significantly reducing the size of the command that needs to be run. The PIPE_FETCH option works by initially generating a small command. When this compact command is executed, it fetches the actual, larger command that needs to be run. The fetched command is then directly piped into the shell, streamlining the execution process and making it feasible to use fetch payloads in scenarios where space constraints were previously a limitation.

New module content (2)

BentoML RCE

Authors: Takahiro Yokoyama and c2an1
Type: Exploit
Pull request: #20041 contributed by Takahiro-Yoko
Path: linux/http/bentoml_rce_cve_2025_27520
AttackerKB reference: CVE-2025-27520

Description: This adds a module for an unauthenticated remote code execution in BentoML (CVE-2025-27520).

Langflow AI RCE

Authors: Naveen Sunkavally (Horizon3.ai) and Takahiro Yokoyama
Type: Exploit
Pull request: #20022 contributed by Takahiro-Yoko
Path: multi/http/langflow_unauth_rce_cve_2025_3248
AttackerKB reference: CVE-2025-3248

Description: This adds a module for CVE-2025-3248, an unauthenticated RCE vulnerability that affects Langflow versions prior to 1.3.0.

Enhancements and features (4)

  • #19982 from jvoisin – Updates the Linux enum_protections module to use proper names instead of executable names and add a file-based detection method.
  • #20031 from bcoles – Adds metadata and improves the code quality of multiple FreeBSD exploit modules.
  • #20032 from bcoles – Improves the code quality of multiple nops modules.
  • #20035 from bcoles – Enhances the code quality of multiple encoder modules.

Bugs fixed (3)

  • #20005 from fabpiaf – Fixes a LoadError when loading sqlite3 modules in Metasploit’s Docker support.
  • #20036 from bcoles – Fixes an issue with the exploit/windows/local/unquoted_service_path module that previously claimed a file upload was successful regardless of whether the file upload was successful or not.
  • #20043 from adfoster-r7 – Update Open WAN-to-LAN proxy on AT&T routers error handling when an older Python version is detected.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro.

[$] The problem of unnecessary readahead

Post Syndicated from corbet original https://lwn.net/Articles/1016860/

The final session in the memory-management track of the 2025 Linux Storage,
Filesystem, Memory-Management, and BPF Summit was a brief, last-minute
addition run by Kalesh Singh. The kernel’s readahead mechanism is
generally good for performance; it ensures that data is present by the time
an application gets around to asking for it. Sometimes, though, readahead
can go a little too far.

[$] Tracepoints for the VFS?

Post Syndicated from jake original https://lwn.net/Articles/1017573/

Adding tracepoints to some kernel subsystems has been controversial—or
disallowed—due to concerns about the user-space
ABI
that they might create. The virtual filesystem (VFS) layer has
long been one of the subsystems that has not allowed any tracepoints, but
that may be changing. At the 2025 Linux Storage, Filesystem, Memory
Management, and BPF Summit (LSFMM+BPF), Ted Ts’o led a discussion about
whether the ABI concerns are outweighed by the utility of tracepoints for
the VFS.

Security updates for Friday

Post Syndicated from daroc original https://lwn.net/Articles/1018020/

Security updates have been issued by Debian (graphicsmagick and libapache2-mod-auth-openidc), Fedora (giflib, mod_auth_openidc, mysql8.0, perl, perl-Devel-Cover, perl-PAR-Packer, perl-String-Compare-ConstantTime, rust-openssl, rust-openssl-sys, trunk, and workrave), Mageia (chromium-browser-stable and rust), Oracle (java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, kernel, libreoffice, and webkit2gtk3), Red Hat (gvisor-tap-vsock), SUSE (containerd, docker, docker-stable, forgejo, GraphicsMagick, libmozjs-115-0, perl-32bit, poppler, subfinder, and thunderbird), and Ubuntu (erlang and ruby2.3, ruby2.5).

The collective thoughts of the interwebz