Week 07/23/2017 - 07/30/2017 Counter malicious traffic & Golang

We rolled out some fixes on hardening our auth funnel, rejecting a lot of bots from our game.

 As retaliation, these bots starting scanning our endpoints and hitting all of them with a lot of request trying to bring the server down.

 Most of our endpoints were robust enough to handle that, but they managed to find one which is not robust enough, and caused me a lot of pain.

 Thanks to our investment in instrumentation & monitoring, we caught the issue quickly and identified the root cause being bot attaching that end point.

 Rolled out 2 steps fix:
1. a bandaid to stop bleeding. basically a simply "if" check to match the particular id bots are using and kill the request right away.
2. adding a new rate limitor based on the client id that's provided in the request.

 The rest of the week was spend on doing some simple coding test with golang. 

 Golang has always been on my radar and I haven't got a chance to use it after finish reading the book. So I decided to start doing coding tests with golang to get familiarized with the language.

 A few hours per day for a week is good enough for me to get started golang. I love this language for all kinds of nice features it has and I strongly believe it's the right option for building web servers if no legacy code is in the picture.

 I'll keep on using golang and hopefully find a big project soon.

Comments

Post a Comment

Popular posts from this blog

Week 07/02/2017 - 07 /09/2017 Rewrite Memcached Cluster Accessor

Spent the week re-writing memcached accessor & configuration for our java server to support clustering. Initiative of this project: Multiple memcached clusters are used in my project and some of them need to be accessed by multiple services written in different languages, one of which being PHP. The old accessor does not support clustering at all, not even to mention ketama consistent hashing (on the roadmap). While other services do utilize clustering for memcached, the java server accessor create one memcached client per host in the cluster and run a multi-write &/ multi-read. On top of that manual hashing was done to decide which cluster a particular key goes to (based on an additional parameter, for instance, user id) Old format: memcached.name=<cluster_name> memcached.hosts.0=<mc00, mc01> memcached.hosts.1=<mc02, mc03> To fully utilize clustering support from memcahed library, a new format was proposed: New format: accessor.<accessor_name...
Read more

Week 10/22/2017 - 10/29/2017 Repository migration & Deployment process improvement

  In the past week I've been working on mainly one thing: migrating our existing repositories from bitbucket to github.   Git is the first source control tool I used and has become dominant over the past few years. To be honest I'm surprised to see my project uses mercurial.    The task of migration is fairly simple: fast-export will do the heavy lifting for you. Here 's an article on how to do it. The reason why it took me a lot of time is: my new project has baked a lot of secrets / keys inside source code and now it's going to be more public than only accessible by my group.   After I started digging into these secrets, I've discovered more issues:  - configuration management and secret management are done with the same configuration file  - configuration and source code is not a perfect 1:1 map. With a lot of copy-paste, many sections of configuration are not even being used in code  - deployment is a mess. some repos have dedicated (...
Read more

Week 07/09/2017 - 07/16/2017 Profiling & Performance Improvement

Image
My primary focus during the past week is improve the performance of event handling system on the java server. Context: We use one thread for processing room transaction related user actions. For instance, user move from one room to another. I added instrumentation for profiling data a few weeks ago and noticed that user disconnect is taking a long time to process while other transactions on the thread is usually done with 5ms. I added timer for sections of code that processes such even and ran profiling on production this week, and the result is astonishing. The majority of the time was spent on a synchronized block. In short, we kick off a call to update database on a different thread and move on with the current thread, and the next thing current thread does is to synchronize on user object. Unfortunately the database updater job locks the user object as well so essentially we're doing the database update on the same thread. And the worst thing is, the lock in database upd...
Read more