Odessa  Rice

Odessa Rice

1626179100

Rust Dublin September 2020 remote meetup - SWIR

Dawid Nowak talks about his experience developing Sidecar Written In Rust.

00:00:00 Intro

00:01:09 Outline
00:01:29 What is a sidecar?
00:02:50 Sidecar taxonomy
00:03:18 Sidecar - Observer
00:04:41 Sidecar - Proxy
00:06:25 Sidecar - Platform
00:08:30 What is SWIR?
00:09:10 SWIR’s architecture
00:11:05 Q: How good is hyper?
00:12:01 Crates used by SWIR
00:15:09 How SWIR started
00:18:41 Why Rust?
00:20:07 Pain points: ecosystem stability
00:22:39 Pain points: finding libraries
00:23:13 Pain points: many async libs
00:24:22 Tooling
00:24:51 IDEs
00:25:41 Conclusions
00:26:57 Q: how are you testing?
00:27:29 Q: how to write an app inside SWIR?
00:32:52 Q: How to configure the sidecar?
00:33:57 Q: what does config look like?
00:36:54 Q: are you using a plugin system?
00:39:28 Q: how do you deal with different schemas?
00:41:06 Q: do you still need to write some systems logic?

#rust #swir

What is GEEK

Buddha Community

Rust Dublin September 2020 remote meetup - SWIR
Brain  Crist

Brain Crist

1594753020

Citrix Bugs Allow Unauthenticated Code Injection, Data Theft

Multiple vulnerabilities in the Citrix Application Delivery Controller (ADC) and Gateway would allow code injection, information disclosure and denial of service, the networking vendor announced Tuesday. Four of the bugs are exploitable by an unauthenticated, remote attacker.

The Citrix products (formerly known as NetScaler ADC and Gateway) are used for application-aware traffic management and secure remote access, respectively, and are installed in at least 80,000 companies in 158 countries, according to a December assessment from Positive Technologies.

Other flaws announced Tuesday also affect Citrix SD-WAN WANOP appliances, models 4000-WO, 4100-WO, 5000-WO and 5100-WO.

Attacks on the management interface of the products could result in system compromise by an unauthenticated user on the management network; or system compromise through cross-site scripting (XSS). Attackers could also create a download link for the device which, if downloaded and then executed by an unauthenticated user on the management network, could result in the compromise of a local computer.

“Customers who have configured their systems in accordance with Citrix recommendations [i.e., to have this interface separated from the network and protected by a firewall] have significantly reduced their risk from attacks to the management interface,” according to the vendor.

Threat actors could also mount attacks on Virtual IPs (VIPs). VIPs, among other things, are used to provide users with a unique IP address for communicating with network resources for applications that do not allow multiple connections or users from the same IP address.

The VIP attacks include denial of service against either the Gateway or Authentication virtual servers by an unauthenticated user; or remote port scanning of the internal network by an authenticated Citrix Gateway user.

“Attackers can only discern whether a TLS connection is possible with the port and cannot communicate further with the end devices,” according to the critical Citrix advisory. “Customers who have not enabled either the Gateway or Authentication virtual servers are not at risk from attacks that are applicable to those servers. Other virtual servers e.g. load balancing and content switching virtual servers are not affected by these issues.”

A final vulnerability has been found in Citrix Gateway Plug-in for Linux that would allow a local logged-on user of a Linux system with that plug-in installed to elevate their privileges to an administrator account on that computer, the company said.

#vulnerabilities #adc #citrix #code injection #critical advisory #cve-2020-8187 #cve-2020-8190 #cve-2020-8191 #cve-2020-8193 #cve-2020-8194 #cve-2020-8195 #cve-2020-8196 #cve-2020-8197 #cve-2020-8198 #cve-2020-8199 #denial of service #gateway #information disclosure #patches #security advisory #security bugs

Odessa  Rice

Odessa Rice

1626179100

Rust Dublin September 2020 remote meetup - SWIR

Dawid Nowak talks about his experience developing Sidecar Written In Rust.

00:00:00 Intro

00:01:09 Outline
00:01:29 What is a sidecar?
00:02:50 Sidecar taxonomy
00:03:18 Sidecar - Observer
00:04:41 Sidecar - Proxy
00:06:25 Sidecar - Platform
00:08:30 What is SWIR?
00:09:10 SWIR’s architecture
00:11:05 Q: How good is hyper?
00:12:01 Crates used by SWIR
00:15:09 How SWIR started
00:18:41 Why Rust?
00:20:07 Pain points: ecosystem stability
00:22:39 Pain points: finding libraries
00:23:13 Pain points: many async libs
00:24:22 Tooling
00:24:51 IDEs
00:25:41 Conclusions
00:26:57 Q: how are you testing?
00:27:29 Q: how to write an app inside SWIR?
00:32:52 Q: How to configure the sidecar?
00:33:57 Q: what does config look like?
00:36:54 Q: are you using a plugin system?
00:39:28 Q: how do you deal with different schemas?
00:41:06 Q: do you still need to write some systems logic?

#rust #swir

Odessa  Rice

Odessa Rice

1626149841

Rust Dublin May 2020 remote meetup - creating a Rust project

Jakub Pastuszek presents a show-and-tell about creating a Rust project drawn from his experiences writing the asn-db* and asn-tools** crates, delivering a comprehensive overview of Rust in the process.

Join Rust Dublin community at one of our meetups!
https://www.meetup.com/Rust-Dublin/
https://github.com/rust-dublin

0:00:00 Autonomous System Number database tool
0:05:03 Rust Crates
0:08:04 Cargo: check, build, run, test
0:10:06 Documentation
0:13:31 Imports
0:18:20 Constants
0:21:13 Types in Rust
0:31:48 Functions, Methods and Traits
0:39:25 Generics
0:50:04 derive
0:55:32 Serde
0:59:00 Custom Error Types
1:11:15 Iterators and Option
1:23:30 CSV Parsing
1:29:54 Serialization
1:33:32 panic!
1:38:31 testing
1:41:47 CLI apps
1:45:20 Structopt
1:48:40 Input and Output
1:50:30 Dynamic Types

#rust #rust project

Odessa  Rice

Odessa Rice

1626251280

Rust Dublin May 2021 remote meetup - Connecting Rust to databases with ODBC

Jakub Pastuszek talks about using ODBC in Rust to connect to databases, and his own experience using this to ingest and analyse website logs.

00:00:00 Intro
00:00:51 Background
00:02:36 MonetDB
00:05:52 Connecting to MonetDB
00:07:26 What is ODBC?
00:10:08 ODBC crates
00:11:44 My contributions
00:13:18 Why odbc-iter
00:17:02 Example ODBC usage
00:17:56 Example odbc-iter usage
00:18:56 Initialization
00:21:04 Connecting to a database
00:23:35 String encoding
00:24:49 Working with ResultSet
00:27:52 Type conversion
00:33:24 Dynamic Typing
00:35:11 Prepared statements
00:39:17 Multithreading
00:43:27 Stats
00:43:50 Current state and future work
00:45:57 RDBC?
00:53:27 Q&A
00:53:42 Q: How about Diesel?
00:59:07 Q: Were there bottlenecks piping logs into ElasticSearch?
01:01:37 Q: Did you find any smart ways of querying?
01:03:28 Q: Does dropping the ResultSet automatically close()?

#rust #databases #odbc #connecting rust

Odessa  Rice

Odessa Rice

1626164580

Rust Dublin August 2020 remote meetup - HTTP services in Rust

Anton Whalley shows how to develop a small HTTP service in Rust and deployed using containers.

00:00:00 Start
00:00:38 intro
00:02:03 Agenda
00:02:40 What are Containers?
00:05:13 Rust Backend Web Applications
00:06:49 Container adoption growing
00:07:52 Runtimes in containers
00:11:40 Tradeoffs for new runtimes
00:12:54 Garbage collection
00:15:11 Selecting a Rust HTTP framework
00:23:06 Kubernetes
00:26:02 Knative
00:29:14 Appsody
00:31:09 A Rust/Tide project using Appsody
00:32:37 Appsody project types
00:35:43 Q: Does Appsody take care of Docker?
00:40:23 Stacks
00:42:00 Running the app in Appsody
00:43:39 Deployment
00:47:23 Q&A
00:49:11 Q: How big are the generated Docker files?
00:50:34 Q: Using Alpine for the container images?

#rust #http services