DEV Community: Or Yaacov

Ted talks that everyone should hear — part 1

Or Yaacov — Wed, 24 Sep 2025 11:43:49 +0000

Well, I don’t want to start with spoilers, and I definitely can’t retell the story better than Tim Box himself. I highly recommend that you start by watching the TED Talk:

https://www.youtube.com/watch?v=ZidGozDhOjg

So, what did I learn from it…

Everyone feels anxiety

There are those that don’t feel anxiety, there are two very distinct groups, the first group, dead people, the second group (to his words) would be those we might refer to as Psychopaths

Everyone is an individual, wired differently, with their own set of abilities or inabilities. But the things that we, as humans — or in other words, Homo sapiens — have in common due to evolution are the same set of feelings, fears, and base instincts.

Is feeling anxious is negative?

I completely agree with what he said. Experiencing high levels of anxiety over a long period of time is clearly not positive.
But in the short term — whether it’s about an interview, technology, or taking a big step — it just means that the situation matters. And congratulations: you’re not ignoring it.

How should we look at anxiety

I personally think he described anxiety in the perfect way:

Think of your mind as a ship, every ship has a captain and a crew, in this analogy the captain is your logical rational conscious part of your thinking, the part that knows where you wish to go, and why, and fair idea to how to get there. The crew, the people the people that has its hands on all the things that stair and sail our ship, is the subconscious.
Your crew sail the ship by triggering the appropriate emotional responses

lets look at the examples he gave, for example, if we feel:
somethings is dangerous — Fear is triggered. You feel uncomfortable, so you move away from the danger, back to safety.
(But remember: docking keeps a ship safe, but that’s not what ships are made for)

the believe that someone wronged you — A crew member triggers anger, shifting your attention toward taking the necessary action to right the wrong.

So what about anxiety?

When anxiety is triggered, it’s your crew telling you that something is too important to lose focus on. For example, you have a job interview. Your crew recognizes how important it is, and they make sure it stays at the top of your mind so it doesn’t get ignored or forgotten.

it’s the crew saying to the captain you need to pay attention for this

Why shouldn’t we ignore it?

when you ignore someone with an important message they might just start to speak louder to get heard, if you continue to ignore them, they might start to shout

I completely agree with this idea. And beyond that — why should we ignore what our subconscious is trying to tell us? Whether it’s a new business idea, a relationship, a big decision, a new technology changing the market, or a career issue — your crew is saying: “Hey, pay attention to this, because now is the right time.”

and the funny thing is, when you start listening to what your minds trying to tell you, it can stop shouting, when your crew stop shouting the captain can be heard

My conclusions

When you feel anxious, it’s not a bad thing. It doesn’t mean something negative. It simply means that the topic or decision you’re anxious about is important.
When you feel anxious, understand that this is your crew telling you, hey don’t ignore it! build actions items, Research. Plan. Build. Talk. Communicate. Consult. Trust your instincts. Make a decision.
Remember: as a Homo sapiens, anxiety is just another tool in your toolbox. It exists to help you reach your goals and desires
You are the captain sailing this ship. The crew is there to help you. You’re all on the same team. You know what your goal is — so communicate with your team, start sailing, and at the end of the day, try even enjoy the journey and not only to enjoy the destination…

Ted talks that everyone should hear - part 1

Or Yaacov — Tue, 23 Sep 2025 22:31:50 +0000

Well, I don’t want to start with spoilers, and I definitely can’t retell the story better than Tim Box himself. I highly recommend that you start by watching the TED Talk:

https://www.youtube.com/watch?v=ZidGozDhOjg

So, what did I learn from it…

Everyone feels anxiety

There are those that don’t feel anxiety, there are two very distinct groups, the first group, dead people, the second group (to his words) would be those we might refer to as Psychopaths

Is feeling anxious is negative?

How should we look at anxiety

I personally think he described anxiety in the perfect way:

Think of your mind as a ship, every ship has a captain and a crew, in this analogy the captain is your logical rational conscious part of your thinking, the part that knows where you wish to go, and why, and fair idea to how to get there. The crew, the people the people that has its hands on all the things that stair and sail our ship, is the subconscious.
Your crew sail the ship by triggering the appropriate emotional responses

lets look at the examples he gave, for example, if we feel:

somethings is dangerous — Fear is triggered. You feel uncomfortable, so you move away from the danger, back to safety.
(But remember: docking keeps a ship safe, but that’s not what ships are made for)

The believe that someone wronged you — A crew member triggers anger, shifting your attention toward taking the necessary action to right the wrong.

So what about anxiety?

it’s the crew saying to the captain you need to pay attention for this

Why shouldn’t we ignore it?

when you ignore someone with an important message they might just start to speak louder to get heard, if you continue to ignore them, they might start to shout

and the funny thing is, when you start listening to what your minds trying to tell you, it can stop shouting, when your crew stop shouting the captain can be heard

My conclusions

When you feel anxious, it’s not a bad thing. It doesn’t mean something negative. It simply means that the topic or decision you’re anxious about is important.
When you feel anxious, understand that this is your crew telling you, hey don’t ignore it! build actions items, Research. Plan. Build. Talk. Communicate. Consult. Trust your instincts. Make a decision.
Remember: as a Homo sapiens, anxiety is just another tool in your toolbox. It exists to help you reach your goals and desires
You are the captain sailing this ship. The crew is there to help you. You’re all on the same team. You know what your goal is — so communicate with your team, start sailing, and at the end of the day, try even enjoy the journey and not only to enjoy the destination…

How to profile your multi-threaded python production code programmatically

Or Yaacov — Sun, 24 Dec 2023 01:20:28 +0000

Profiling multi-threaded Python applications can be challenging, especially in production environments. Unfortunately, 90% of the guides don’t explain how to really do it, especially with remote production multi-threaded code and no cli, and they will lead you to use something like python -m cProfile -s time my_app.py <args>
Don't worry, this is not another one of those.

So why is it “hard” to do? You can’t always run your program in production using the command-line interface (CLI), and cProfile only offers limited support for multi-threaded programming.

So, How to do Multi-Threading profiling?

To perform multi-threading profiling, we can use one of the following approaches:

Sum different threads’ stats together to create one set of statistics using stats.add().
Create a separate profiler for each thread.

Since our program is built from 3 different engine threads, I will cover only the second approach in this guide.

So, I created the following utility that allows me to create my threads:

import cProfile
import threading
import time

class ProfilerManager:
    def __init__(self, is_enabled, dump_interval_seconds, profiler_dir_path):
        self._is_enabled = is_enabled
        self._logger = "YOUR LOGGER"
        self._profiler_dir_path = profiler_dir_path
        self._profiler_dump_interval_seconds = dump_interval_seconds

        if self._profiler_dump_interval_seconds <= 0:
            self._logger.warning('invalid _profiler_dump_interval_seconds value {}, setting default'.format(self._profiler_dump_interval_seconds))
            self._profiler_dump_interval_seconds = 60   

        self._profilers = {}

    def thread_with_profiler(self, target, tag):
       if not self._is_enabled:
              return threading.Thread(target=target)

        self._disable_profiler_if_exists(tag)

        profiler = cProfile.Profile()

        self._profilers[tag] = profiler

        return threading.Thread(target=self._target_with_profiler(target, profiler, tag))

    def run(self, target, tag):
        if not self._is_enabled:
            return target

        profiler = cProfile.Profile()

        self._profilers[tag] = profiler

        return self._target_with_profiler(target, profiler, tag)

    def _disable_profiler_if_exists(self, tag):
        if tag in self._profilers:
            self._logger.warning('tag {} already exists, disabling, and overriding with new target'.format(tag))
            existing_profiler = self._profilers[tag]
            self._disable_profiler(existing_profiler, tag)

    def _target_with_profiler(self, target, profiler, tag):
        def target_with_profiler():
            self._enable_profiler(profiler, tag)
            target()
            self._disable_profiler(profiler, tag)

        return target_with_profiler

    def _enable_profiler(self, profiler, tag):
        self._logger.debug('enabling profiler {}'.format(tag))
        profiler.enable()

    def _disable_profiler(self, profiler, tag):
        self._logger.debug('disabling profiler {}'.format(tag))
        profiler.disable()

    def _dump_periodic_profilers(self):
        while True:
            time.sleep(self._profiler_dump_interval_seconds)

            self._logger.trace("dumping profiles")

            for tag, profiler in self._profilers.items():
                dump_file_path = '{}/{}.dump'.format(self._profiler_dir_path, tag)
                self._logger.trace("dumping profile, {}".format(dump_file_path))

                profiler.dump_stats(dump_file_path)

Let’s take a look at the thread_with_profiler use which is similar to threading.Thread the following:

ip_manager_thread = profiler_manager.thread_with_profiler(target=self._run_ip_monitor, tag='ip_manager')
ip_manager_thread.start()

let’s do a quick dive into thread_with_profiler:

def thread_with_profiler(self, target, tag):
        if not self._is_enabled:
            return threading.Thread(target=target)

        self._disable_profiler_if_exists(tag)

        profiler = cProfile.Profile()

        self._profilers[tag] = profiler

        return threading.Thread(target=self._target_with_profiler(target, profiler, tag))

All that this function does is disable the profiler with the same tag, in case it already exists. It creates a new profiler and a new thread, then runs _target_with_profiler, which is the real magic behind the scenes

def _target_with_profiler(self, target, profiler, tag):
      def target_with_profiler():
          self._enable_profiler(profiler, tag)
          target()
          self._disable_profiler(profiler, tag)

      return target_with_profiler

As we can see, we create and return a new function wrapper that our thread will execute. All that the wrapper does is enable the profiler (start it), call your actual function, and disable it when/if it ends.

Then, we have the following function, which actually dumps the current stats to files by tags every X seconds

    def _dump_periodic_profilers(self):
        while True:
            time.sleep(self._profiler_dump_interval_seconds)

            self._logger.trace("dumping profiles")

            for tag, profiler in self._profilers.items():
                dump_file_path = '{}/{}.dump'.format(self._profiler_dir_path, tag)
                self._logger.trace("dumping profile, {}".format(dump_file_path))

                profiler.dump_stats(dump_file_path)

so, now that we got how this all thing works, let’s see a full use example!

def async_worker1():
  #work

def async_worker2():
  #work

def main_worker():
  #work

def main():
    profiler_manager = ProfilerManager(is_enabled=True, dump_interval_seconds=10, profiler_dir_path="/var/logs")
    profiler_manager.thread_with_profiler(target=self._run_ip_monitor, tag='async_worker1')
    profiler_manager.thread_with_profiler(target=self._run_ip_monitor, tag='async_worker2')

   profiler_manager.run(target=self._run_ip_monitor, tag='main_worker')profiler_manager.thread_with_profiler(target=self._run_ip_monitor, tag='ip_manager')

if __name__ == '__main__':
    main()

happy profiling! :)

Deep .NET - Iteration: for vs foreach

Or Yaacov — Sat, 02 Sep 2023 14:46:53 +0000

I choose to start from one of the most common and basic things, Iteration.

We will explore how .NET iterates over List<T> and over an Array<T> and see what the differences are between iteration with a for and a foreach loop .

But before we will start, let’s go over List<T> and foreach and understand how each of them works

`List<T>`

The List class stores our items in an internal array named _items, when we are creating a new list without any parameter, _items is assigned to an empty array of T.

By adding an item into the array

.NET starts by updating the version of the array (the _version variable keeps changing by an increment of 1 every time the array is modified so it will be possible to keep track when the collection has been modified).

The _size variable acts as a virtual size for our list, while the physical size is actually the length of the _items array, called Capacity.
So every time that we are adding an item into the list it ensures that the capacity is big enough to store another item and if it is , then the new item will be assigned.

Every time the virtual size is bigger than the capacity, AddWithResize method is being called:

This ensures that the next minimum size will be bigger then the current one plus 1 since we wish to add a new item into the list.

Then the function calls to EnsureCapacity, which sets the new capacity into the default one (DefaultCapacity=4) in case _items is an empty array, or doubles _items size in case that _items is not empty.

That’s the most basic explanation to how List was implemented and the goal is to cover 3 basic points

List<T> uses an internal array
The Capacity(_items.Length) of the List is different then the Count(_size) of the list
The list keeps an updated version variable that keeps track of changes.

The foreach loop

Many different collections such as List<T> or Dictionary<T> can be iterated by a foreach loop, because their class implements one of the following interfaces: System.Collections.IEnumerable or System.Collections.Generic.IEnumerable and satisfies the following conditions:

· has the public parameterless GetEnumerator method whose return type is either class, struct, or interface type,

· the return type of the GetEnumerator method has the public Current property and the public parameterless MoveNext method whose return type is Boolean.

Foreach loop works as the following example: (the following example is not the real .NET implantation):

So every initialization starts by calling to the GetEnumurator()

Which creates a new Enumerator struct and passes the current list as an argument:

Important to mention that struct is not a reference type, and it’s important to understand the difference between the two - you can read more about that here.

After initializing the Enumerator and assigning the value, the MoveNext() method is being called repeatedly n times:

The MoveNext method starts by assigning the list instance into a local variable, and then validates that the enumerable struct version matches the version of the list (to verify that the list was not modified)

((uint)_index < (uint)localList._size))

is equivalent to:

if (_index>0 || _index<localList._size)

worth to read about the sign bit and Two’s complement

https://en.wikipedia.org/wiki/Two%27s_complement.

And finally:

_current = localList._items[_index];

_index++;

return true;

it assigns the next value into _current and increments the index and return true.

Warm up — Simple for loop

Just for warm up, let’s start from a basic for loop, and have a look at following C# program:

“some code” will be executed 333 times as long there is no break, return or throw involved. However, since we are talking about iteration , we will focus on the iteration itself which is highlighted in blue and not the first initialization part.

As we can see, in any iteration, the CPU executes 11 instructions to complete each iteration that is distributed in the following way:

Array iteration with for loop

Now, since we are all warmed up, let’s examine how exactly .NET iterates over an array with a for loop. We will examine the next example:

And the disassembly:

In that iteration, the CPU will have to execute 20 instructions- each iteration is distributed in the following way:

List Iteration With a foreach loop

Above, we saw how foreach iteration is implemented in .NET.
Now, let’s examine the next function:

And the disassembly: (as before I highlighted only the part that occur n times, and ignored the initialization)

It’s easy to see that the current iteration was much longer. The CPU executes 34 instructions, with each iteration distributed in the following way:

List Iteration With a for loop

Before we dig in into the assembly, there is another thing that is worth mentioning. Any time we use[] on a list instance, we are invoking the following extension:

Now, let’s take the following C# function:

And the disassembly:

In that iteration, the CPU executes 39 instructions n times just for the iteration which is distributed in the following way:

Array Iteration with a foreach loop

And for our last example let’s have a look at the following C# code:

And let’s look even deeper:

In that iteration, the CPU executes 16 instructions n times just for the iteration which is distributed in the following way:

THE RESULTS

The results are displayed in the following tables: as seen in the first table above, the “total” column represents the number of assembly instructions. The“Estimated CPU cycles score” represents an estimated score that was calculated by the type of the instruction, the latency and the throughput.

To test our conclusions, I created the following TimeMesurment class, And initialized it with the value of 200000000

In conclusion, it is nearly twice as efficient to iterate over an array then a list.

Of course, that List creates a lot of necessary functionality such as adding and removing items from the collection, but sometimes developers use a List when those extra functionalities are unnecessary, as a form of a bad habit.

Thank you for reading.

Or Yaacov

Sources:

How to easily join Linux asset to AD

Or Yaacov — Mon, 28 Aug 2023 12:19:00 +0000

Syncing a Linux machine with Active Directory unlock benefits like seamless AD login, simplified asset management, and integrate your Linux machine into your company's existing environment, Here is a simple guide of how to do it :)

RPM Based Distributions (Centos/RHEL)

Setup dependencies
centos7:

yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python

centos8:

yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python-utils

Add to AD:

realm join --user=[domain user account] [domain name]
# realm join --user=myAdUser dev.com

in case of error, run journalctl as described in the error, to fix KDC has no support for encryption type enable Kerberos encryption support:
update-crypto-policies --set DEFAULT:AD-SUPPORT

Debian based systems (ubuntu)

Setup dependencies

sudo apt-get update
sudo apt-get install sssd-ad sssd-tools realmd adcli

Add to AD:

sudo realm -v discover [domain name]
# sudo realm -v discover dev.com
sudo realm join --user=[domain user account] [domain name]
# realm join --user=myAdUser dev.com

in case of error, run journalctlas described in the error, to fix realm: Couldn't join realm: Necessary packages are not installed: sssd-tools sssd libnss-sss libpam-sss adcli even that they are installed run the following:

realm join --user=[domain user account] [domain name] --install=/
realm join --user=myAdUser dev.com

Sources

Dev.to post to markdown utility

Or Yaacov — Fri, 19 May 2023 19:33:35 +0000

Because of I love dev.to, and that I also have my own blog,
I created a new cli that converts dev.to link to markdown :)

How it works
The utility extract the post id from the page, and then using the post-id to query the raw markdown from dev.to API.

or you can just read the code here:
https://github.com/oryaacov/devto-to-markdown

Installation

Ensure you have Node.js and npm (Node Package Manager) installed on your system.
Open your terminal or command prompt.
Execute the following command to install the utility globally: npm i -g devto-to-markdown`

Usage

Once the utility is installed, you can convert Dev.to blogs to Markdown using the following command:

devto-to-markdown -u <devto-url>

Replace <devto-url> with the URL of the Dev.to blog you want to convert.

For example:

devto-to-markdown -u https://dev.to/oryaacov/how-to-setup-http-server-with-security-headers-using-nginx-docker-dok

How to pass exceptions in Electron.js from main process to renderer and other way around

Or Yaacov — Sat, 13 May 2023 10:51:21 +0000

If you struggled as well with "bubbling" exceptions between IpcMain and IpcRenderer in electron.js here is a self-exploratory, and simple solution that I created to solve this issue:

import {ipcMain, IpcMainInvokeEvent, ipcRenderer} from 'electron';

export interface channelMessage<T> {
  message?: T;
  error?: any;
}

export function handleMessageFromRenderer<T>(channel: string, listener: (event: IpcMainInvokeEvent, ...args: any[]) => Promise<void> | any) {
  ipcMain.handle(channel, async (event, args) => {
    const response: channelMessage<T> = {};

    try {
      response.message = await listener(event, args);
    } catch (e) {
      response.error = e;
    }

    return response;
  });
}

export async function sendMessageToMain(channel: string, ...args: any[]): Promise<any> {
  const {message, error} = await ipcRenderer.invoke(channel, ...args);
  if (error) {
    throw error;
  }

  return message;
}

now instead of passing a message using ipcRenderer.invoke and icpMain.handle you can just use sendMessageToMain and sendMessageToMain

as in the following example:

xport const settingChannels = {
  openLogFile: 'open-log-file',
  updateApplication: 'update-application',
};

export const settingsApi = {
  openLogFile: async () => {
    await sendMessageToMain(settingChannels.openLogFile);
  },
  updateApplication: async (version) => {
    await sendMessageToMain(settingChannels.updateApplication, {version});
  },
 };

export function registerSettingsApi() {
  log.debug('registering settings apis');

  handleMessageFromRenderer(settingChannels.openLogFile, async (event): Promise<void> => {
    log.trace('handling open log');
    await settingsHandler.openLogFile();
  });

  handleMessageFromRenderer(settingChannels.updateApplication, async (event, args): Promise<void> => {
    log.trace('handling start app update');
    await settingsHandler.updateApplication(args.version);
  });
}

iptables rules that every Linux user should have - part one

Or Yaacov — Mon, 17 Apr 2023 14:49:11 +0000

After that I read about another cyber attack, again, as a software engineer in Zero Networks, I asked myself what the hell is going on in my network? who tries, or even worse succeeds communicating with my machine? and is my machine trying to talk to specious servers without me knowing? Well, let's create some iptables rules that will help answer those questions

Step 1 - Log chains

iptables has 3 action chains, Drop, Reject, and Accept. Let's create 3 new chains, which will log any NEW connection attempt, and then perform the wanted action:

sudo iptables -N LOG_AND_ACCEPT
sudo iptables -A LOG_AND_ACCEPT -m conntrack --ctstate "NEW,RELATED" -j LOG --log-prefix '[OY-A]:' --log-level 7
sudo iptables -A LOG_AND_ACCEPT -j ACCEPT

sudo iptables -N LOG_AND_DROP
sudo iptables -A LOG_AND_DROP -m conntrack --ctstate "NEW,RELATED" -j LOG --log-prefix '[OY-D]:' --log-level 7
sudo iptables -A LOG_AND_DROP -j DROP

sudo iptables -N LOG_AND_REJECT
sudo iptables -A LOG_AND_REJECT -m conntrack --ctstate "NEW,RELATED" -j LOG --log-prefix '[OY-R]:' --log-level 7
sudo iptables -A LOG_AND_REJECT -j REJECT

by running those commands, we are generating the following 3 new chains which logging (with special prefix [{two letters}-{ACTION}]):

chain: LOG_AND_ACCEPT, log prefix: [OY-A]
chain: LOG_AND_DROP, log prefix: [OY-D]
chain: LOG_AND_REJECT, log prefix: [OY-R]

the log prefix will help us find our records, or even to separate our records to another file using rsyslog (please let me know if you wish me to write a guide on how to do that)

Converting existing rules

If you already have rules, all you need to do is to convert any existing rule target from:

ACCEPT -> LOG_AND_ACCEPT
DROP -> LOG_AND_DROP
REJECT -> LOG_AND_REJECT

Step 2 - Inbound

well, I'm using my system76 machine (powered by arch ❤) as a client, so I don't expect any kind of EXTERNAL INBOUND traffic at all, so let's see how to block it without affecting internal machine communication (e.g. docker containers)

Log and drop incoming external traffic

before that, we will add our inbound protection rule, let's take it apart and see how it works:

Match new inbound connections only - since iptables operate at the packet level, we don't wish to drop packets that are a response to our own initiated outbound communication. e.g. we are initiating a DNS query to resolve yaacov.dev address, we do not wish to block the response to that request.
DROP vs Reject both DROP and REJECT actions will prevent packets from being processed, but using REJECT will show attackers that your machine exists and refuse to accept packets. by using DROP we simply ignore the packets, and the attackers won't know that your machine exists or is "online" and will usually timeout.
Network devices well, lots are going on our machines, and programs such as docker are creating iptables rules to make everything work behind the scenes. Instead of dropping all of the new inbound packets, we need to drop only packets that come from our ethernet/wifi or another network device that connect us to the network. Internal loopback/docker or any other virtual interface will stay untouched.

you can list your networks devices by running the following command:

ip link show

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DORMANT group default qlen 1000
    link/ether ff:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default 
    link/ether ff:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff

since I'm using my Wifi I'll use wlan0

So, after understanding all of that let's create our first real firewall rule!

sudo iptables -A INPUT -m conntrack --ctstate "NEW,RELATED" -i wlan0 -j LOG_AND_DROP

-m conntrack - ctstate "NEW,RELATED": use the conntrack module to apply this rule only on:

NEW: Represents the start of a new connection. It is typically used to track the initial packet of a new connection attempt.
RELATED: Represents related connections, such as those associated with an existing connection. For example, FTP data connections are considered RELATED to the original FTP control connection

-i : networks interface (you can add multiple rules for multiple network devices)

Step 3 - Outbound

so since I'm using my machine as a client and I'm over 18, I don't wish to restrict myself from imitating any kind of communication, but I surely want to know about each one of them, and make sure that my machine doesn't talk to other machines that I don't want it to talk to.

we can do that by setting an outbound rule of LOG_AND_ACCEPT, this way, any new communication will be logged and we could examine it later.

sudo iptables -A OUTPUT -m conntrack --ctstate "NEW,RELATED"  -j LOG_AND_ACCEPT

Step 4 - Persistence

well iptables, isn't persistence, which means that after a restart all of the rules that you had will disappear. But there are a few ways to make iptables persistent. you can read about here: 3 ways to make iptables persistent

Step 5 - analyze

I will create a complete guide and share some of my own scripts about how to analyze your iptables logs and see when and with who our machine talked or tried to talk at least. (Please let me know if you wish another guide about how to analyze and personal tools)

How to boot from iso file using GRUB & internal HDD (without external USB/CD)

Or Yaacov — Sat, 06 Aug 2022 19:15:00 +0000

I just received my new System76's Lemp11 pro, and even though I love Pop!_OS I prefer to use Arch (btw), but… I didn't have an external USB drive that will use me as installation media, so…

Creating Partition

I have two internal hard drives and I'm going to shrink my secondary one to allocate more space for a new partition, you can skip this step in case you have some available memory.

Open Disks, and resize your partition

I Choose to leave 32GB my internal partition

in the free space create a new ext4 and name it as you want :)

Copying the ISO files

step one, copy the iso files to the new disk that you just created.
step two, None.

Preparing the data

in the next and last step, we will need to configure our grub, and for this, we will need to collect a few pieces of data:

your .iso file hdd number: you can run lsblk | grep disk to list your hard drives:

/dev/hda refers to the first IDE hard drive
/dev/sda refers to the first SCSI or SATA hard drive.
If you use a NMVe SSD, it might be named as /dev/nvme0n1, /dev/nvme1n1 and so on.
But in GRUB, the first hard drive is always referred to as hd0, no matter what the interface type is

your .iso file partition number:
you can run the following command sudo parted -l and locate your iso's files partition number
your setup's .efi files
browse trough your .iso files (you can do it by mount your iso or open it an archive manager), and locate your desired linuz .efi file and image file
for example:
Ubuntu setup:
/casper/vmlinuz and /casper/initrd
Arch setup
/arch/boot/x86_64/vmlinuz-linux and /arch/boot/x86_64/initramfs-linux

Configuring GRUB

use your favorite text editor to add the following line to

your custom configuration file:
sudo vi /etc/grub.d/40_custom
(if the file doesn't exists /etc/grub.d/40_custom and
update-grub executable install, please install grub-disk)

and add the following lines:



menuentry "{{menu entry name}}" {
  insmod ext2
  set isopartition=hd{{hdd number}},{{partition number}}
  set isofile="{{iso file path (relative to hdd)}}"
  loopback loop (hd{{hdd number}},{{partition number}})$isofile
  linux (loop){{iso's vm linuz efi file path}} img_dev=/dev/disk/by-uuid/$isouuid img_loop=$isofile
  initrd (loop){{iso's ram memory image file path}}
}

working example (Arch linux)



menuentry "archlinux-2022.07.01-x86_64.iso" {
  insmod ext2
  set isopartition=hd1,2
  set isofile="/iso/archlinux-2022.07.01-x86_64.iso"
  loopback loop (hd1,2)$isofile
  linux (loop)/arch/boot/x86_64/vmlinuz-linux img_dev=/dev/disk/by-uuid/$isouuid img_loop=$isofile
  initrd (loop)/arch/boot/x86_64/initramfs-linux.img
}

Ubuntu:



menuentry "ubuntu-20.04.2.0-desktop-amd64.iso" {
  insmod ext2
  set isofile="/iso/ubuntu-20.04.2.0-desktop-amd64.iso"
  loopback loop (hd1,2)$isofile
  linux (loop)/casper/vmlinuz boot=casper iso-scan/filename=$isofile quiet noeject noprompt splash
  initrd (loop)/casper/initrd
}

menuentry: your GRUB2 menu entry, name it as you like.
insmod: inserts a module. Since the ISO file is stored in ext4 partition he ext2 module is needed.
set isofile: Specify that path of your ISO image file
loopback: Mount the ISO file. hd0 means the first hard drive in the computer and 5 means the ISO file is stored on the 5th disk partition.
The linux command loads a Linux kernel from the specified path. casper/vmlinuz.efi is the linux kernel inside the Ubuntu ISO image.
initrd: initrd command loads an initial ramdisk from the specified path. It can only be used after the linux command has been run. The initial ramdisk is a minimal root file system mounted to the RAM. casper/initrd.lz is the initrd file inside the Ubuntu ISO image.

next all you need to do is to run the following command sudo update-grub and reboot.

All done :)

Healthy snacks ideas? (office)

Or Yaacov — Tue, 10 May 2022 13:33:10 +0000

I'm looking to find some healthy snacks idea for the office.

All of the healthy 0-guilt food that I have by now is:

Baby cucumber
Baby carrots
Sparkling water

Help please :)

Don't abuse critical sections

Or Yaacov — Sat, 07 May 2022 17:30:03 +0000

Critical section is a code block that cannot be executed by more than one process/thread at a time, which is why critical sections are expensive and can lead to a performance "bottle neck" at a specific flow.

Critical sections must be as short, simple (if possible), and efficient as possible.

For example, let's examine the following code block, which generates a new UUID for a shared object:

with self._mutex:
    # start of lock 
    try:
        self._action.id = str(uuid.uuid4())                      
        self._logger.trace("action generated, action_id={action_id}".format(action_id=self._action.id))
    except BaseException as err:
        self._logger.error(err,"failed to generate uuid")
    # end of lock

I did three common mistakes here:

try & catch, ok, I admit it, probably not a common mistake since no one will put a try & catch that could be outside of a critical section inside of it without a good reason
logging inside a critical section. Usually, logging is an expensive IO operation which could have be done outside
generating the UUID inside the critical section

Here is the another code block which does the exact same thing, just without the three mistakes:

try:
    action_id = str(uuid.uuid4())
    with self._mutex:
        # start of lock
        self._action.id = action_id                  
        # end of lock

    self._logger.trace("action generated, action_id={action_id}".format(id=action_id))  
except BaseException as err:
    self._logger.error(err,"failed to generate uuid")

When you are using lock remember that is purpose is to avoid more than one thread access shared resources at the same time

3 ways to make iptables persistent

Or Yaacov — Sat, 23 Apr 2022 15:32:08 +0000

If you are using iptables, it's very likely that you wish to make it persistent, and restore your firewall rules after a reboot.

I'll present here 3 ways to make your iptables persistent:

using systemd,my personal favorite way, since it works for all Linux distributions and without requiring 3rd party software.
using iptables-persistent mostly for DEB-based Linux distributions, required 3rd party software
using iptables-services for RPM-based Linux distributions, required 3rd party software

systemd

systemd is a system and service manager for Linux operating systems. Using systemd we can run a script file after boot, that will restore our firewall rules and make it persistent without installing a 3rd party software.
first let's create the script that we wish to run to restore our firewall:
sudo vi /etc/iptables-persistent/restore.sh

with the following script:
#!/bin/sh /usr/bin/flock /run/.iptables-restore /sbin/iptables-restore < {{your ip tables dump file}}

next we will need to create an host file for our systemd service using:
sudo vi /etc/systemd/system/iptables-persistent.service

and paste the following
[Unit] Description=iptables persistent service ConditionFileIsExecutable=/etc/iptables/restore-iptables.sh After=network.target [Service] Type=forking ExecStart=/etc/iptables/restore-iptables.sh start TimeoutSec=0 RemainAfterExit=yes GuessMainPID=no [Install] WantedBy=multi-user.target

great, now all that is left to do is simply enable our service by running the following command:
sudo systemctl enable iptables-persistent.service

iptables-persistent (DEB)

iptables-persistent automatically loads your saved ip-tables rules after a reboot.
First step will be to install iptables-persistent using sudo apt-get install iptables-persistent
since iptables-persistant will look for two dump files:

/etc/iptables/rules.v4 #for ipv4 rules
/etc/iptables/rules.v6 #for, wait for it, ipv6 rules

which you can easily create running the following commands:
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6

Depends on your OS version, behind the scenes iptables-persistent works with netfilter-persistent.service you can verify that your service up and running using sudo systemctl status netfilter-persistent.service

and your output should look like the following:

netfilter-persistent.service - netfilter persistent
configuration
Loaded: loaded (/lib/systemd/system/netfilter-persistent.service; enabled; ve
Active: active (exited) since Sat 2022–04–09 18:14:42 IDT; 29min ago

iptables-services (RPM)

iptables-services contains a persistent utility that loads your saved ip-tables rules after a reboot.
Let's start with installing iptables-services using sudo dnf install iptables-services
after installing iptables-services we will need to make sure that our service is up and that firewalld is disabled and won't interfere with our iptables configuration, using the following commands:
sudo systemctl stop firewalld sudo systemctl disable firewalld sudo systemctl start iptables sudo systemctl enable iptables

since iptables-services will look for two dump files:

/etc/sysconfig/iptables #for ipv4 rules
/etc/sysconfig/ip6tables #for, wait for it, ipv6 rules

which you can easily create running the following commands:
sudo iptables-save > /etc/iptables/rules.v4 sudo ip6tables-save > /etc/iptables/rules.v6

and that's it, you can feel free to reboot your machine without losing your changes :)