Speaker unverified: commitment

Transcript context

…Can you tell the story of that? I’d be glad to. So there’s this Falcor business, and I did discover the bug before anybody else and I did report it to security and it was so bad. It actually got its own name, Repulsive Grizzly Attack, and they even give examples of how to do it. Effectively what it means is that there is a request that targets both memory and CPU and will destroy. There you go. Look, how Netflix… The next one down was the article that was actually written. I don’t get mentioned, which is a little bit upsetting considering I was the one that discovered it and told everybody how bad it was. Anyways, and had the right to fix for it or the first fix. So this is how it works, is that you can do something pretty similar, I believe with GraphQL as well. It has the same kind of danger. Any of these kinds of RPC request as much or as little of the data as you would like frameworks, are vulnerable to this kind of attack. So with Falcor, what you do is you give it an array. That’s an array is called a path, and that’s the path to the data. But sometimes you don’t want to have to write out, I want movie, I want row zero or list zero or row zero column zero title. I want row zero column zero description. You don’t want to have to write out all that. So instead you could just be like, I want rows zero through 10, columns zero through 10, titles and descriptions. So you can write in a very compact, nice little format and it’ll give you all that data. It’ll go to the server. The server will fill that all in and give it to you. Oh, dang it, list three, it only had three videos in it. So what happens when I try- Three, it only had three videos in it. So what happens when I try to re-request the data? Well, I need a way to be able to tell my system that you’d have requested the data and there’s nothing there. So call this like a boxed value. So it’s going to be like type, something, value, there’s nothing there. We’ve already requested it and there’s nothing there. It’s like a sentinel value, if you will, a boxed value. And we have this little special flag weed pass called materialize. Meaning that when you ask for a path, we will make sure we fill it out so we don’t accidentally erase anything. And at the very end we’ll say okay, the thing does, the request you’ve made has already been made and there’s nothing there. Well, what happens if I request rows zero through 10,000 columns through 10,000, one more item through 10,000 and then a whole bunch of properties and then ask it to materialize? here’s nothing there. Well, what happens if I request rows zero through 10,000 columns through 10,000, one more item through 10,000 and then a whole bunch of properties and then ask it to materialize? Well, I’m about to go create billions of objects in the JVM, and what happens to the machine? It stops running. And then if we try to JSON… Even if it could create a mall, we then ask it that JSON serialize, it’s not going to do it. It’s impossible. And so that was the attack vector, is a simple wild loop would’ve taken down and held down Netflix for a very long time. Because one request would kill one machine on AWS. And so that means it would just turn it all off. And this was on the website? This was on TV, this was on mobile. This was profound. And here’s the worst part, it was in production for years so we couldn’t even roll it back. There was no like, “Oh crap, let’s just roll back to two weeks ago and we’ll fix forward and figure out.” No, it’s like we could roll back to 2011. That’s our option is 2011 and that’s it. So we had to figure out a way forward and all that. And so it was like… The amount of problems that would’ve happened if someone would’ve discovered this is unstatable.…

Stored transcript either side of the excerpt. The highlighted words are the published quote; the surrounding text is unedited source, never generated.