A Byte of Coding Issue 387

Hey-yo,

The websites I run require a number of automated tasks to run on a regular basis (currently around 10). These range from daily, to every two weeks, to monthly. I’ve got a pretty basic set up using cron with healthchecks to notify me of any major issues. My cron jobs are generally structured:

30 1 1 * * (cd /path/to/directory/; /usr/bin/node script.js; curl -fsS -m 10 --retry 5 -o /dev/null healthcheck.url/$?) 2>&1 | logger -t script-name

Above saves all output to the system log (which I can check in case of an issue) and notifies me if the scrips exit with any status code other than 0. I like this setup because it’s quick to implement and adding monitoring is pretty trivial. However, one thing I don’t like about it is that it does make checking logs of previous runs a bit annoying. I’ll probably have to modify the template to create a temporary log file that is also sent with the healthcheck ping. Maybe a bash script template that does this automatically that I can just pass the instructions to? I’d be curious to hear about any simple and nice solutions you guys and gals might have.

Anyway, here’s the issue.

Made possible through generous sponsorship by:

Database Subsetting and Data Extraction

Published: 17 April 2024

Tags: database, data

Phil Factor dives into data subsetting, what it is, what it’s used for, and some caveats.

Some highlights:

• data subsetting is using a subset of production data for development / testing purposes

• can use obfuscated production data or generated data

• not a very long technical deep-dive, but I had to do something related to this yesterday and wish I’d read this before to motivate me to look at existing tools

Name lookup in multiple base classes

Published: 17 April 2024

Tags: c++

Arthur O’Dwyer explains why “overload resolution not work if the overload set spans two base classes”.

Some highlights:

• “because [class.member.lookup] says, essentially, that if we don’t find a declaration of the name f in [the parent class’] scope then we should look into its base classes; and if we find declarations of f in more than one base class, we should consider this an unresolvable ambiguity and fail”

• “The only sensible way to refactor an API is to refactor a whole overload set at a time”

• “In short, mashing together unrelated overload sets is usually a bad thing; and therefore the rules of C++ are generally designed not to do it”

The Developer's Guide to Domain Verification

Published: 15 November 2023

Tags: sponsored, networking, auth, dns

WorkOS’ blog “examines best practices to consider when building in-house as well as a simple alternative” that they provide when it comes to domain verification.

Some highlights:

• “Domain verification is a crucial security measure for SaaS providers, ensuring that services are securely delivered to the legitimate owners of a domain”

• “Don’t place TXT records on the root domain”

• WorkOS offers a simple API you can integrate with to do domain verification

From BYOVD to a 0-day: Unveiling Advanced Exploits in Cyber Recruiting Scams

Published: 18 April 2024

Tags: infosec

Luigino Camastra published new findings on “a campaign targeting specific individuals in the Asian region through fabricated job offers”, specifically with technical backgrounds.

Some highlights:

• “discovered a new campaign targeting specific individuals through fabricated job offers”

• “uncovered a full attack chain from infection vector to deploying “FudModule 2.0” rootkit with 0-day Admin -> Kernel exploit”

• “found a previously undocumented Kaolin RAT, where it could aside from standard RAT functionality, change the last write timestamp of a selected file and load any received DLL binary from C&C server“