Archive for the ‘en-US’ Category
[DevoxxBE2024] The Next Phase of Project Loom and Virtual Threads by Alan Bateman
At Devoxx Belgium 2024, Alan Bateman delivered a comprehensive session on the advancements in Project Loom, focusing on virtual threads and their impact on Java concurrency. As a key contributor to OpenJDK, Alan explored how virtual threads enable high-scale server applications with a thread-per-task model, addressing challenges like pinning, enhancing serviceability, and introducing structured concurrency. His talk provided practical insights into leveraging virtual threads for simpler, more scalable code, while detailing ongoing improvements in JDK 24 and beyond.
Understanding Virtual Threads and Project Loom
Project Loom, a transformative initiative in OpenJDK, aims to enhance concurrency in Java by introducing virtual threads—lightweight, user-mode threads that support a thread-per-task model. Unlike traditional platform threads, which are resource-intensive and often pooled, virtual threads are cheap, allowing millions to run within a single JVM. Alan emphasized that virtual threads enable developers to write simple, synchronous, blocking code that is easy to read and debug, avoiding the complexity of reactive or asynchronous models. Finalized in JDK 21 after two preview releases, virtual threads have been widely adopted by frameworks like Spring and Quarkus, with performance and reliability proving robust, though challenges like pinning remain.
The Pinning Problem and Its Resolution
A significant pain point with virtual threads is “pinning,” where a virtual thread cannot unmount from its carrier thread during blocking operations within synchronized methods or blocks, hindering scalability. Alan detailed three scenarios causing pinning: blocking inside synchronized methods, contention on synchronized methods, and object wait/notify operations. These can lead to scalability issues or even deadlocks if all carrier threads are pinned. JEP 444 acknowledged this as a quality-of-implementation issue, not a flaw in the synchronized keyword itself. JEP 491, currently in Early Access for JDK 24, addresses this by allowing carrier threads to be released during such operations, eliminating the need to rewrite code to use java.util.concurrent.locks.ReentrantLock. Alan urged developers to test these Early Access builds to validate reliability and performance, noting successful feedback from initial adopters.
Enhancing Serviceability for Virtual Threads
With millions of virtual threads in production, diagnosing issues is critical. Alan highlighted improvements in serviceability tools, such as thread dumps that now distinguish carrier threads and include stack traces for mounted virtual threads in JDK 24. A new JSON-based thread dump format, introduced with virtual threads, supports parsing for visualization and preserves thread groupings, aiding debugging of complex applications. For pinning, JFR (Java Flight Recorder) events now capture stack traces when blocking occurs in synchronized methods, with expanded support for FFM and JNI in JDK 24. Heap dumps in JDK 23 include unmounted virtual thread stacks, and new JMX-based monitoring interfaces allow dynamic inspection of the virtual thread scheduler, enabling fine-tuned control over parallelism.
Structured Concurrency: Simplifying Concurrent Programming
Structured concurrency, a preview feature in JDK 21–23, addresses the complexity of managing concurrent tasks. Alan presented a motivating example of aggregating data from a web service and a database, comparing sequential and concurrent approaches using thread pools. Traditional thread pools with Future.get() can lead to leaks or wasted cycles if tasks fail, requiring complex cancellation logic. The StructuredTaskScope API simplifies this by ensuring all subtasks complete before the main task proceeds, using a single join method to wait for results. If a subtask fails, others are canceled, preventing leaks and preserving task relationships in a tree-like structure. An improved API in Loom Early Access builds, planned for JDK 24 preview, introduces static factory methods and streamlined exception handling, making structured concurrency a powerful complement to virtual threads.
Future Directions and Community Engagement
Alan outlined Project Loom’s roadmap, focusing on JEP 491 for pinning resolution, enhanced diagnostics, and structured concurrency’s evolution. He emphasized that virtual threads are not a performance boost for individual methods but excel in scalability through sheer numbers. Misconceptions, like replacing all platform threads with virtual threads or pooling them, were debunked, urging developers to focus on task migration. Structured concurrency’s simplicity aligns with virtual threads’ lightweight nature, promising easier debugging and maintenance. Alan encouraged feedback on Early Access builds for JEP 491 and structured concurrency (JEP 480), highlighting their importance for production reliability. Links to JEP 444, JEP 491, and JEP 480 provide further details for developers eager to explore.
Links:
[DefCon32] The Hack, the Crash, and Two Smoking Barrels
The automotive industry’s rush to pack vehicles with connectivity exposes a glaring cybersecurity gap. Thomas Sermpinis, a security researcher at Upstream Security, navigates this “underworld” of car manufacturing, where tight deadlines and complacent engineering sideline security. His narrative, punctuated by real-world exploitations and a live ECU demo, exposes vulnerabilities in vehicle architectures and advocates for systemic change.
Thomas, leveraging his expertise in embedded systems, recounts discovering zero-day flaws and convincing skeptical engineers of their severity—sometimes by engaging brakes mid-drive. His stories highlight the tension between innovation and safety, contrasting mainstream manufacturers with a smaller OEM’s robust security design.
Automotive Architecture Vulnerabilities
Thomas outlines vehicle architectures, where ECUs (Electronic Control Units) manage critical functions like braking and steering. Legacy designs, reliant on CAN bus protocols, lack encryption, making them susceptible to injection attacks. He demonstrates exploiting a zero-day to manipulate an ECU, showcasing real-time risks like unauthorized control.
Mainstream OEMs, driven by cost, lag in adopting secure protocols like Automotive Ethernet, leaving vehicles exposed to remote attacks.
Engaging Engineers and Industry
A pivotal moment in Thomas’s journey involves a live demo, where an engineer experiences a brake lock triggered by a flaw. This visceral proof shifts perspectives, underscoring the need for security prioritization. He critiques the “good enough” mentality fueled by capitalism, where budgets trump safety.
His modular toolkit, Caribou Next, a fork of Caring Caribou, enables standardized attacks across vehicles, highlighting systemic weaknesses.
Lessons from a Secure OEM
Thomas contrasts mainstream failures with a small manufacturer, likely Tesla, whose IT-centric approach yields a centralized, secure architecture. By treating vehicles as software platforms, this OEM implements robust encryption and authentication, resisting common exploits.
This model, though not universal, offers a blueprint for industry-wide improvements, emphasizing proactive security integration.
Raising Awareness and Future Steps
Thomas urges collaboration between researchers, OEMs, and regulators to enforce security standards. Emerging technologies like secure CAN transceivers show promise, but adoption lags. His demos, shared responsibly, aim to spark interest in automotive hacking, driving awareness to protect lives.
Links:
[DefCon32] Optical Espionage: Using Lasers to Hear Keystrokes Through Glass Windows
In a world where physical barriers seem to shield sensitive data, Samy Kamkar reveals how light and sound betray secrets. A renowned security researcher, Samy introduces a laser-based eavesdropping technique that captures keystrokes through glass windows, targeting air-gapped systems. His accessible approach, requiring minimal technical expertise, leverages physics to extract signals from noise, demonstrating vulnerabilities in seemingly secure environments.
Samy, known for past innovations like the MySpace worm, explores side-channel attacks rooted in historical TEMPEST research by the NSA and KGB. By directing lasers at reflective surfaces, he captures vibrations from typing or audio, decoding them into actionable data. This method, blending optical and radio signal processing, exposes the fragility of physical security in modern systems.
Physics of Signal Leakage
Samy demystifies how energy forms—light, sound, vibration—travel through air, undermining air-gapped systems. Electrical signals emit electromagnetic waves, capturable via radio or optical methods. His laser microphone, pointed at a window, detects minute vibrations from keystrokes or ambient sound, converting them into audible signals.
Historical attacks, like the KGB’s 1940s “The Thing” device, inform his approach. By combining affordable components like lasers and photodiodes, Samy reconstructs clear audio, demonstrating the technique’s accessibility.
Keystroke Recovery and Analysis
Using tools like FFmpeg and GNU Radio, Samy processes laser reflections to isolate keystroke sounds. Each key produces distinct acoustic signatures, which frequency analysis decodes, especially when paired with language models. For instance, 100–200 keystrokes suffice to infer typed content in English, akin to cracking a substitution cipher.
Demonstrations show a laptop’s reflective surface betraying typed text, with software recovering input at 10x speed. This highlights the technique’s real-world feasibility, even in noisy environments.
Mitigations and Challenges
Samy addresses noise reduction, a key challenge, by shifting processing to the radio domain, leveraging GNU Radio’s filtering capabilities. Potential defenses include anti-reflective coatings or white noise generators, though these are costly or impractical. He encourages exploring further signal processing improvements, such as advanced denoising algorithms.
The technique’s low cost—using consumer-grade lasers—makes it a potent threat, urging organizations to reassess physical security for sensitive systems.
Broader Implications for Security
Samy’s work extends beyond keyboards, suggesting vulnerabilities in any vibrating surface. He calls for community research into side-channel mitigations, emphasizing that “unhackable” claims invite scrutiny. His open-source tools, shared for experimentation, empower defenders to test and secure their environments.
Links:
[PHPForumParis2023] Forum PHP 2023 Highlights
Forum PHP 2023, hosted at the enchanting Hotel New York – The Art of Marvel in Disneyland Paris, brought together the PHP community for two days of learning and connection. This short overview captured attendees’ enthusiasm, highlighting the event’s magical venue, diverse program, and warm community spirit. From junior developers to seasoned experts, participants shared their appreciation for the event’s inclusivity, knowledge-sharing, and the organizers’ dedication, making it a memorable gathering.
A Magical Venue and Diverse Program
Attendees marveled at the immersive setting, with spacious conference rooms and a vibrant sponsor hall that fostered engagement. The program catered to all levels, offering talks that ranged from introductory to highly technical, ensuring broad appeal. Participants highlighted the variety of topics, which sparked meaningful discussions and learning opportunities, reinforcing Forum PHP’s reputation as a hub for professional growth and inspiration within the PHP community.
Community Spirit and Benevolence
The keynote emphasized the PHP community’s hallmark benevolence, with attendees feeling welcomed and valued. The collaborative atmosphere, driven by shared experiences and open exchanges, was a standout feature. Organizers were praised for their seamless execution, masking the extensive behind-the-scenes work. This sense of community and mutual support left attendees eager to return, inspired to contribute to future PHP events.
[DotAI2024] DotAI 2024: Gael Varoquaux – Streamlining Tabular Data for ML Readiness
Gael Varoquaux, Inria research director and scikit-learn co-founder, championed data alchemy at DotAI 2024. Advising Probabl while helming Soda team, Varoquaux tackled tabular toil—the unsung drudgery eclipsing AI glamour. His spotlight on Skrub, a nascent library, vows to eclipse wrangling woes, funneling more cycles toward modeling insights.
Alleviating the Burden of Tabular Taming
Varoquaux lamented tables’ ubiquity: organizational goldmines in healthcare, logistics, yet mired in heterogeneity—strings, numerics, outliers demanding normalization. Scikit-learn’s 100M+ downloads dwarf PyTorch’s, underscoring preparation’s primacy; pandas reigns not for prophecy, but plumbing.
Deep learning faltered here: trees outshine nets on sparse, categorical sprawls. Skrub intervenes with ML-infused transformers: automated imputation via neighbors, outlier culling sans thresholds, encoding that fuses categoricals with targets for richer signals.
Varoquaux showcased dirty-to-d gleaming: messy merges resolved via fuzzy matching, strings standardized through embeddings—slashing manual heuristics.
Bridging Data Frames to Predictive Pipelines
Skrub’s API mirrors pandas fluidity, yet weaves ML natively: multi-table joins with learned aggregations, pipelines composable into scikit-learn estimators for holistic optimization. Graphs underpin reproducibility—reapply transformations on fresh inflows, parallelizing recomputes.
Open-source ethos drives: Inria’s taxpayer-fueled labors spin to Probabl for acceleration, inviting contributions to hasten maturity. Varoquaux envisioned production graphs: optimized for sparsity, caching intermediates to slash latencies.
This paradigm—cognitive relief via abstraction—erodes engineer-scientist divides, liberating tabular troves for AI’s discerning gaze. Skrub, he averred, heralds an epoch where preparation propels, not paralyzes, discovery.
Links:
[DevoxxGR2025] Understanding Flow in Software Development
James Lewis, a ThoughtWorks consultant, delivered a 41-minute talk at Devoxx Greece 2025, exploring how work flows through software development, drawing on information theory and complexity science.
The Nature of Work as Information
Lewis framed software development as transforming “stuff” into more valuable outputs, akin to enterprise workflows before computers. Work, invisible as information, flows through value streams—from ideas to production code. However, invisibility causes issues like unnoticed backlogs or undeployed code, acting as costly inventory. Lewis cited Don Reinertsen’s Principles of Product Development Flow, emphasizing that untested or undeployed code represents lost revenue, unlike visible factory inventory, which signals inefficiencies immediately.
Visualizing Value Streams
Using a value stream map, Lewis illustrated a typical development cycle: three days for coding, ten days waiting for testing, and 30 days for deployment, totaling 47 days of lead time, with 42 days as idle inventory. Wait times stem from coordination (teams waiting on others), scheduling (e.g., architecture reviews), and queues (backlogs). Shared test environments exacerbate delays, costing more than provisioning new ones. Lewis advocated mapping workflows to expose economic losses, making a case for faster delivery to stakeholders.
Reducing Batch Sizes for Flow
Lewis emphasized reducing batch sizes to improve flow, a principle rooted in queuing theory. Smaller batches, like deploying twice as often, halve wait times, enabling faster revenue generation. Using agent-based models, he simulated agile (single-piece flow) versus waterfall (100% batch) teams, showing agile teams deliver value faster. Limiting work-in-progress and controlling queue sizes prevent congestion collapse, ensuring smoother, more predictable workflows.
Links
[DevoxxUK2024] Breaking AI: Live Coding and Hacking Applications with Generative AI by Simon Maple and Brian Vermeer
Simon Maple and Brian Vermeer, both seasoned developer advocates with extensive experience at Snyk and other tech firms, delivered an electrifying live coding session at DevoxxUK2024, exploring the double-edged sword of generative AI in software development. Simon, recently transitioned to a stealth-mode startup, and Brian, a current Snyk advocate, demonstrate how tools like GitHub Copilot and ChatGPT can accelerate coding velocity while introducing significant security risks. Through a live-coded Spring Boot coffee shop application, they expose vulnerabilities such as SQL injection, directory traversal, and cross-site scripting, emphasizing the need for rigorous validation and security practices. Their engaging, demo-driven approach underscores the balance between innovation and caution, offering developers actionable insights for leveraging AI safely.
Accelerating Development with Generative AI
Simon and Brian kick off by highlighting the productivity boost offered by generative AI tools, citing studies that suggest a 55% increase in developer efficiency and a 27% higher likelihood of meeting project goals. They build a Spring Boot application with a Thymeleaf front end, using Copilot to generate a homepage with a banner and product table. The process showcases AI’s ability to rapidly produce code snippets, such as HTML fragments, based on minimal prompts. However, they caution that this speed comes with risks, as AI often prioritizes completion over correctness, potentially embedding vulnerabilities. Their live demo illustrates how Copilot’s suggestions evolve with context, but also how developers must critically evaluate outputs to ensure functionality and security.
Exposing SQL Injection Vulnerabilities
The duo dives into a search functionality for their coffee shop application, where Copilot generates a query to filter products by name or description. However, the initial code concatenates user input directly into an SQL query, creating a classic SQL injection vulnerability. Brian demonstrates an exploit by injecting malicious input to set product prices to zero, highlighting how unchecked AI-generated code can compromise a system. They then refactor the code using prepared statements, showing how parameterization separates user input from the query execution plan, effectively neutralizing the vulnerability. This example underscores the importance of understanding AI outputs and applying secure coding practices, as tools like Copilot may not inherently prioritize security.
Mitigating Directory Traversal Risks
Next, Simon and Brian tackle a profile picture upload feature, where Copilot generates code to save files to a directory. The initial implementation concatenates user-provided file names with a base path, opening the door to directory traversal attacks. Using Burp Suite, they demonstrate how an attacker could overwrite critical files by manipulating the file name with “../” sequences. To address this, they refine the code to normalize paths, ensuring files remain within the intended directory. The session highlights the limitations of AI in detecting complex vulnerabilities like path traversal, emphasizing the need for developer vigilance and tools like Snyk to catch issues early in the development cycle.
Addressing Cross-Site Scripting Threats
The final vulnerability explored is cross-site scripting (XSS) in a product page feature. The AI-generated code directly embeds user input (product names) into HTML without sanitization, allowing Brian to inject a malicious script that captures session cookies. They demonstrate both reflective and stored XSS, showing how attackers could exploit these to hijack user sessions. While querying ChatGPT for a code review fails to pinpoint the XSS issue, Simon and Brian advocate for using established libraries like Spring Utils for input sanitization. This segment reinforces the necessity of combining AI tools with robust security practices and automated scanning to mitigate risks that AI might overlook.
Balancing Innovation and Security
Throughout the session, Simon and Brian stress that generative AI, while transformative, demands a cautious approach. They liken AI tools to junior developers, capable of producing functional code but requiring oversight to avoid errors or vulnerabilities. Real-world examples, such as a Samsung employee leaking sensitive code via ChatGPT, underscore the risks of blindly trusting AI outputs. They advocate for education, clear guidelines, and security tooling to complement AI-assisted development. By integrating tools like Snyk for vulnerability scanning and fostering a culture of code review, developers can harness AI’s potential while safeguarding their applications against threats.
Links:
[DefCon32] Reverse Engineering MicroPython Frozen Modules
In the realm of embedded systems, MicroPython empowers developers to deploy Python-based solutions on microcontrollers, fueling applications from industrial automation to DEF CON’s #badgelife projects. Wesley McGrew, a Senior Cyber Fellow at MartinFederal, unveils the intricacies of reverse-engineering MicroPython’s frozen modules—compiled code embedded in firmware. Unlike CPython, MicroPython’s unique bytecode and lack of tailored tools pose challenges for analysts. Wesley’s presentation guides enthusiasts through extracting and decoding these modules using Ghidra, offering a pathway to uncover their functionality without debug symbols.
Wesley’s expertise in reverse engineering and offensive security informs his approach, blending technical precision with practical demonstrations. He emphasizes that frozen modules, designed for efficiency, are not secure storage for secrets, especially as his methods expose their contents. This exploration not only aids badge hackers but also underscores the fragility of firmware-based protections.
Navigating Firmware with Ghidra
Wesley begins by addressing the challenge of locating frozen modules within firmware images. Using Ghidra, a powerful disassembler, he identifies module structures, strings, and object data without relying on debug symbols. MicroPython’s architecture, distinct from CPython, compiles modules into bytecode stored in flash memory, often alongside firmware updates.
He demonstrates parsing these structures, extracting raw code, and reconstructing non-frozen modules. This process, while manual, reveals the module’s purpose, from badge interactions to industrial controls, making it accessible for CTF enthusiasts and security researchers.
Decoding MicroPython Bytecode
Delving deeper, Wesley details MicroPython’s bytecode, a compact format optimized for microcontrollers. Unlike CPython’s well-documented opcodes, MicroPython’s require custom analysis. He walks through reading opcodes, mapping their functionality, and reconstructing logic, using a badge-life example to illustrate real-world applications.
This granular approach empowers analysts to understand module behavior, exposing vulnerabilities or unintended features. Wesley cautions against using frozen modules for obfuscation, as physical access to firmware—via flash dumps or over-the-air updates—renders them transparent.
Practical Implications and Community Tools
Wesley highlights the broader impact for badge-life communities, where MicroPython powers interactive devices. His techniques enable hackers to explore CTF challenges ethically, enhancing learning without disrupting competitions. He references resources like The Ghidra Book by Chris Eagle and Kara Nance, recommending it for mastering Ghidra’s capabilities.
While automation of extraction remains complex due to variable data structures, Wesley’s methods lay groundwork for future tools, fostering community-driven advancements in firmware analysis.
Ethical Considerations and Future Directions
Emphasizing responsible use, Wesley advises against exploiting these techniques to spoil CTFs or proprietary systems. Instead, he encourages playful exploration within ethical boundaries, leveraging open-source tools to advance MicroPython security. His work underscores the need for robust firmware protections, as physical access undermines current safeguards.
Links:
[DevoxxGR2025] Nx for Gradle – Faster Builds, Better DX
Katerina Skroumpelou, a senior engineer at Nx, delivered a 15-minute talk at Devoxx Greece 2025, showcasing how the @nx/gradle plugin enhances Gradle builds for monorepos, improving developer experience (DX).
Streamlining Gradle Monorepos
Skroumpelou introduced Nx as a build system optimized for monorepos, used by over half of Fortune 500 companies. Gradle’s strength lies in managing multi-project setups, where subprojects (e.g., core, API) share dependencies and tasks. However, large repositories grow complex, slowing builds. Nx integrates seamlessly with Gradle, acting as a thin layer atop existing projects without requiring a rewrite. By running nx init in a Gradle project, developers enable Nx’s smart task management, preserving Gradle’s functionality while adding efficiency.
Optimizing CI Pipelines
Slow CI pipelines frustrate developers and inflate costs. Skroumpelou explained how Nx slashes CI times through distributed task execution, caching, and affected task detection. Unlike Gradle’s task-level parallelism and caching, Nx identifies changes in a pull request and runs only impacted tasks, skipping unaffected ones. For instance, a 30-minute pipeline could drop to five minutes by leveraging Nx’s project graph to avoid redundant builds or tests. Nx also splits large tasks, like end-to-end tests, into smaller, distributable units, further accelerating execution.
Handling Flaky Tests
Flaky tests disrupt workflows, forcing developers to rerun entire pipelines. Nx automatically detects and retries failed tests in isolation, preventing delays. Skroumpelou highlighted that this automation ensures pipelines remain efficient, even during meetings or interruptions. Nx, open-source under the MIT license, integrates with tools like VS Code, offering developers a free, scalable solution to enhance Gradle-based CI.
Links
[DefCon32] SQL Injection Isn’t Dead: Smuggling Queries at the Protocol Level
Despite advancements in database security, SQL injection persists through novel vectors. Paul Gerste, a security researcher, introduces protocol-level smuggling attacks, bypassing prepared statements by targeting database wire protocols. His research at [redacted], leveraging vulnerable driver libraries, demonstrates how attackers can inject malicious (No)SQL statements, leading to authentication bypasses, data leaks, and remote code execution.
Paul reimagines HTTP request smuggling for binary protocols, desynchronizing applications and databases. By manipulating message boundaries, attackers insert unauthorized queries, exploiting flaws in protocols like MySQL and PostgreSQL. His findings extend beyond databases, impacting message queues and caching systems, revealing a pervasive attack surface.
The talk explores real-world implications across programming languages and frameworks, offering insights into mitigating these threats and inspiring further protocol research.
Protocol Smuggling Mechanics
Paul illustrates how wire protocols, using length-based message fields, are susceptible to manipulation. By crafting oversized payloads, attackers trigger integer overflows, disrupting message parsing. A Go-based HTTP handler, assumed secure with prepared statements, falls to this attack, allowing query injection.
Demonstrations show desynchronization, where malicious messages execute as legitimate queries, bypassing application-layer defenses.
Real-World Applicability
Testing across languages like Python, Java, and Node.js, Paul finds varying resilience. Frameworks with strict input validation fare better, but many database drivers remain vulnerable. He identifies MySQL’s driver as particularly prone, with four-byte length fields enabling large payload exploits.
Caching systems and message queues, like Redis and RabbitMQ, exhibit similar flaws, broadening the attack’s scope.
Mitigation Strategies
Paul proposes robust input validation and size limits to thwart smuggling. Developers must prioritize protocol-level checks, avoiding assumptions about memory-safe languages. Integer overflows, often overlooked, enable these attacks, necessitating renewed scrutiny.
He advocates auditing driver libraries and enforcing strict message boundaries to restore database integrity.
Future Research Directions
Paul encourages exploring two-byte length fields, which ease exploitation, and delimiter-based protocols for alternative vulnerabilities. Large payload techniques could bypass framework restrictions, warranting further investigation.
His tools, shared for pentesting, empower researchers to probe additional protocols, ensuring comprehensive security.