Uncategorized – Page 253 – Türker Yıldırım

Disabling password auth is the step people skip

NoteJanuary 29, 20151 min read

Adding a key to authorized_keys makes key login work. It does not stop password login from also working, so the server is still one weak password away from…

A database table is a queue until SELECT FOR UPDATE says otherwise

NoteJanuary 29, 20152 min read

A jobs table is a perfectly good queue for one worker. Add a second and both claim the same row, because SELECT then UPDATE is two statements with…

Money is a value object, not a float

NoteJanuary 28, 20153 min read

Floating point cannot represent 0.1 exactly, so money arithmetic accumulates error that shows up as a total that is one cent off. The usual response is to round…

DateTimeImmutable prevents the modify() bug you will otherwise write

NoteJanuary 22, 20151 min read

DateTime::modify() mutates the object and returns it. Because it returns something, it reads like a pure function, so it gets assigned to a new variable — and then…

hash_equals stops a timing attack you cannot see

NoteJanuary 21, 20151 min read

Comparing two secrets with === leaks how much of the secret you got right. String comparison returns as soon as it finds a differing byte, so a token…

list() inside foreach unpacks as you iterate

NoteJanuary 13, 20151 min read

Iterating a list of pairs normally costs two lines at the top of the loop body to name the parts. list() in the foreach itself does the naming…

systemd unit files replaced the init script you were copying

NoteJanuary 13, 20152 min read

RHEL 7 shipped with systemd last summer, Fedora has had it for years, and Debian jessie is frozen with it as the default — so the init script…

Redis SCAN instead of KEYS, on any database you care about

NoteJanuary 13, 20151 min read

Redis is single-threaded, so a command that takes a long time blocks every other client for that whole time. KEYS * walks the entire keyspace in one command,…

password_hash means you stop inventing salts

NoteJanuary 6, 20152 min read

Every hand-rolled password scheme gets the same three things wrong: the algorithm is too fast, the salt is reused or stored badly, and the comparison is not constant…

overflow hidden works because it makes a new formatting context

NoteDecember 31, 20142 min read

overflow: hidden on a parent full of floats makes it wrap around them, which reads like a side effect of clipping and has nothing to do with clipping.…