50 Years of the KIM-1

Supposedly the KIM-1 is 50 years old. Nobody seems to know the exact date it first shipped, but “January 1976” is the consensus so today seems as good a day as any.What’s a KIM-1 I hear some of you ask? Well history is strange stuff, written by the...

Everything’s a bug (or an issue)

What if I were to tell you that I had discovered a way to run software projects that’s efficient, effective, reliable, even pleasant? “Please continue…”, I hope you say. Up front I’ll let you know this isn’t a new discovery. In fact...

CodeCrafters: Learn (real) Programming Online

Online education coding platforms such as CodeAcademy have existed for years but I’ve always found them to provide a rather artificial sandboxed environment that doesn’t easily translate to real world coding. Meanwhile a new category of sites that allow...

nsync: Synchronization Primitives in the Modern Era

Through a post on Hacker News, and via its cited article, I found myself transported back to the days when we wrote locking primitive implementations, tussling with the challenges of porting across many CPU architectures and operating systems. I worked on code like...

Congestion Collapse in Distributed Systems

I noticed this talk by my former colleague (at Netscape and AOL) Jim Roskind, who now works at Amazon.com. He gives a great introduction to the phenomenon of congestion collapse in complex queueing systems. His examples include familiar scenarios such as busy...

Yarnball: npm versions demystified

Most of the time, adding a library or package as a dependency to a JavaScript project using yarn (or its ancestor npm) is as simple as typing yarn add the-pkg-i-want to get the latest version. But this article is not about that. This article...

Digital Ocean adds Custom Image Support

Big news for those of us who like to go off-piste with our cloud hosted machines: until now “value” cloud provider Digital Ocean only allowed machines to be created from their curated set of OS images (although with some trickery and effort you could...

IoT Remote Radio Side Channel Attack Published

I noticed some amazing work published earlier this week by researches from EUROCOM, and to be presented at ACM CCS 2018. They were able to recover encryption keys from an IoT type SoC from noise leaked onto the chip’s Bluetooth radio’s RF output. This...

Analyzing Performance in a JVM Server at Scale by Self-Measurement

In the early days of an application, deploying new features and functionality are at the top of the list.  As the number of users grows and the traffic increases, other issues make their way to the forefront.  Whether because of complaints from users, monitoring...

Best practices for user account, authorization and password management

In our Cyber Security Consulting Practice we get deep into the authentication weeds helping clients ensure their authentication systems are up to date with the latest best practices. So it was with interest that we saw this recent post by Ian Maddox on that very...

389DS LDAP Server Support and Consulting

Bozeman Pass engineers were heavily involved with the development of what was once known as Netscape Directory Server, aka iPlanet Directory, aka SunDS, aka Fedora DS, and officially known today as 389 Directory Server. To save some typing and confusion we’ll...

Intel: Firmware Updates and Initial Performance Data…

Navin Shenoy from Intel has published results for the performance affects seen after deploying their recent microcode mitigation measures for Spectre and Meltdown vulnerabilities. Unfortunately it seems from another Intel article that those microcode updates may not...

Cloudflare: The Story of a Processor Bug

One of those “war stories to tell your grandkids”. David Wragg details his investigation into seemingly random segmentation faults on the Cloudflare Blog. These amazingly enough turned out to be due to a microcode bug in a specific Intel CPU design....

Endgame: Detecting Spectre And Meltdown Using Hardware Performance Counters

When the Meltdown and Spectre vulnerabilities were first rumored last year I wondered about something: we’re familiar here with the CPU’s hardware performance counters through our work on software performance analysis and optimization. Briefly, these...

utroz: Programmers Guide to Meltdown

Raphael S. Carvalho, a.k.a. utroz has written a nice article showing step by step with ‘C’ source code how an exploit for the Meltdown speculative execution vulnerability would work. has also written a Meltdown vulnerability checker works by attempting to...

Linux Heap, Contention in free()

Note: this is a very old article about an issue in the Linux/glibc heap implementation that almost certainly doesn’t exist any more. However we noticed that people out on the Internet are still trying to access this article after we moved to a new web site...