Debug School: Suyash Sambhare

[Boost]

Suyash Sambhare — Tue, 03 Nov 2026 23:37:14 +0000

Suyash Sambhare

Nov 2

Integer Overflow or Wraparound

#devops #development #programming #security

3 min read

Integer Overflow or Wraparound

Suyash Sambhare — Mon, 02 Nov 2026 02:20:55 +0000

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

While integer overflows are most commonly cited for memory-corruption issues, they can apply to other situations in which the developer assumes certain properties of integer arithmetic that might not hold, e.g., financial calculations, physical dimensions, date/timestamp, etc.

Sample

img_t table_ptr; /*struct containing img data, 10kB each*/
int num_imgs;
...
num_imgs = get_num_imgs();
table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);

nresp = packet_get_int();
if (nresp > 0) {
response = xmalloc(nresp*sizeof(char*));
for (i = 0; i < nresp; i++) response[i] = packet_get_string(NULL);
}

The method determineFirstQuarterRevenue is used to determine the first quarter revenue for an accounting/business application. The method retrieves the monthly sales totals for the first three months of the year, calculates the first quarter sales totals from the monthly sales totals, calculates the first quarter revenue based on the first quarter sales, and finally saves the first quarter revenue results to the database.

#define JAN 1
#define FEB 2
#define MAR 3

short getMonthlySales(int month) {...}

float calculateRevenueForQuarter(short quarterSold) {...}

int determineFirstQuarterRevenue() {

// Variable for sales revenue for the quarter
float quarterRevenue = 0.0f;

short JanSold = getMonthlySales(JAN); /* Get sales in January */
short FebSold = getMonthlySales(FEB); /* Get sales in February */
short MarSold = getMonthlySales(MAR); /* Get sales in March */

// Calculate quarterly total
short quarterSold = JanSold + FebSold + MarSold;

// Calculate the total revenue for the quarter
quarterRevenue = calculateRevenueForQuarter(quarterSold);

saveFirstQuarterRevenue(quarterRevenue);

return 0;
}

"Integer overflow" is sometimes used to cover several types of errors, including signedness errors, or buffer overflows that involve manipulation of integer data types instead of characters. Part of the confusion results from the fact that 0xffffffff is -1 in a signed context. Other confusion also arises because of the role that integer overflows have in chains.

A "wraparound" is a well-defined, standard behavior that follows specific rules for how to handle situations when the intended numeric value is too large or too small to be represented, as specified in standards such as C11.

"Overflow" is sometimes conflated with "wraparound" but typically indicates a non-standard or undefined behavior.

The "overflow" term is sometimes used to indicate cases where either the maximum or the minimum is exceeded, but others might only use "overflow" to indicate exceeding the maximum while using "underflow" for exceeding the minimum.

Some people use "overflow" to mean any value outside the representable range - whether greater than the maximum, or less than the minimum - but CWE uses "underflow" for cases in which the intended result is less than the minimum.

While there may be circumstances in which the logic intentionally relies on wrapping - such as with modular arithmetic in timers or counters - it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs.

It could be considered by some stakeholders that some time-based overflows would not count as weaknesses or vulnerabilities, especially if there is no influence from an adversary. However, CWE allows for cases in which physical phenomena and measurements can contribute to insecure states, and temporal phenomena - which are outside the direct control of the product - also apply.

In the following Java example, the method updateSalesForProduct is part of a business application class that updates the sales information for a particular product. The method receives as arguments the product ID and the integer amount sold. The product ID is used to retrieve the total product count from an inventory object which returns the count as an integer. Before calling the method of the sales object to update the sales count the integer values are converted to The primitive type short since the method requires short type for the method arguments.

...
// update sales database for number of product sold with product ID
public void updateSalesForProduct(String productID, int amountSold) {

// get the total number of products in inventory database
int productCount = inventory.getProductCount(productID);
// convert integer values to short, the method for the

// sales object requires the parameters to be of type short
short count = (short) productCount;
short sold = (short) amountSold;
// update sales database for product
sales.updateSalesCount(productID, count, sold);
}

Ref: https://cwe.mitre.org/data/definitions/190.html

Refactor CloudFormation Stack

Suyash Sambhare — Sun, 18 Oct 2026 22:48:09 +0000

Reorganise resources in your CloudFormation stacks, preserving existing resource properties and data. Move resources between stacks, split large stacks into smaller ones, or combine multiple stacks into one.

How it works

Assess your current infrastructure – Review your existing CloudFormation stacks and resources to identify stack refactoring opportunities.
Plan your refactor – Define how resources should be organised. Consider your dependencies, naming conventions, and operational limits. These can affect the CloudFormation validation later.
Determine the destination stacks – Decide which stacks you will refactor resources into. You can move resources between at least 2 stacks (using the console), and a maximum of 5 stacks (using the AWS CLI). Resources can be moved between nested stacks.
Update your templates – Change your CloudFormation templates to reflect the planned change, such as moving resource definitions between templates. You can rename logical IDs during this process.
Create the stack refactor – Provide a list of stack names and templates that you want to refactor.
Review the refactor impact and resolve any conflicts – CloudFormation validates the templates you provide and checks cross-stack dependencies, resource types with tag update problems, and resource logical ID conflicts.
If the validation succeeds, CloudFormation will generate a preview of the refactor actions that will occur during execution.
If the validation fails, resolve the identified issues and retry. For conflicts, provide a resource logical ID mapping that shows the source and destination of the conflicting resources.
Execute the refactor – After confirming the changes align with your refactoring goals, complete the stack refactor.
Monitor – Track the execution status to ensure the operation completes successfully.

Considerations

Stack refactoring is limited to reorganising existing resources. You cannot create or delete resources, modify resource configurations, or change or add new parameters, conditions, or mappings during refactoring. To make these changes, update your stacks first, and then perform the stack refactor.
You can't refactor the same resource into multiple stacks.
You can't refactor resources that refer to pseudo parameters whose values differ between the source and destination stacks, such as AWS::StackName.
CloudFormation doesn't support empty stacks. If refactoring would leave a stack with no resources, you must first add at least one resource to that stack before you run create-stack-refactor. This can be a simple resource like AWS::SNS::Topic or AWS::CloudFormation::WaitCondition. For example:

Resources:
  MySimpleSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: MySimpleTopic

Stack refactor doesn't support stacks that have stack policies attached, regardless of what the policies allow or deny.

Prerequisites

To refactor stacks, you must have already created the revised templates.
Use the get-template command to retrieve the CloudFormation templates for the stacks that you want to refactor.
aws cloudformation get-template --stack-name Stack1
When you have the templates, use the integrated development environment (IDE) of your choice to update them to use the desired structure and resource organisation.

Refactor stacks using AWS CLI

create-stack-refactor to validate and generate a preview of planned changes.
describe-stack-refactor to retrieve the status and details of a stack refactoring operation.
execute-stack-refactor to complete the validated stack refactoring operation.
list-stack-refactors to list all stack refactoring operations in your account with their current status and basic information.
list-stack-refactor-actions to show a preview of the specific actions CloudFormation will perform on each stack and resource during the refactor execution.

Use the create-stack-refactor command and provide the stack names and updated templates for the stacks to refactor. Include the --enable-stack-creation option to allow CloudFormation to create new stacks if they don't already exist.

aws cloudformation create-stack-refactor \
  --stack-definitions \
    StackName=Stack1,TemplateBody@=file://template1-updated.yaml \
    StackName=Stack2,TemplateBody@=file://template2-updated.yaml \
  --enable-stack-creation

Note down the StackRefactorId

{
    "StackRefactorId": "9c384f70-4e07-4ed7-a65d-fee5eb430841"
}

If conflicts are detected during template validation, you can confirm in the next step. Then use the create-stack-refactor command with the --resource-mappings option.

aws cloudformation create-stack-refactor \
  --stack-definitions \
    StackName=Stack1,TemplateBody@=file://template1-updated.yaml \
    StackName=Stack2,TemplateBody@=file://template2-updated.yaml \
  --enable-stack-creation \ 
  --resource-mappings file://resource-mapping.json

Sample file:

[
    {
        "Source": {
            "StackName": "Stack1",
            "LogicalResourceId": "MySNSTopic"
        },
        "Destination": {
            "StackName": "Stack2",
            "LogicalResourceId": "MyLambdaSNSTopic"
        }
    }
]

Use the describe-stack-refactor command to make sure the Status is CREATE_COMPLETE. This verifies that the validation is complete.

aws cloudformation describe-stack-refactor --stack-refactor-id 9c384f70-4e07-4ed7-a65d-fee5eb430841

{
    "StackRefactorId": "9c384f70-4e07-4ed7-a65d-fee5eb430841",
    "StackIds": [
        "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack1/3e6a1ff0-94b1-11f0-aa6f-0a88d2e03acf",
        "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack2/5da91650-94b1-11f0-81cf-0a23500e151b"
    ],
    "ExecutionStatus": "AVAILABLE",
    "Status": "CREATE_COMPLETE"
}

Use the list-stack-refactor-actions command to preview the specific actions that will be performed.
aws cloudformation list-stack-refactor-actions --stack-refactor-id 9c384f70-4e07-4ed7-a65d-fee5eb430841

{
    "StackRefactorActions": [
        {
            "Action": "MOVE",
            "Entity": "RESOURCE",
            "PhysicalResourceId": "MyTestLambdaRole",
            "Description": "No configuration changes detected.",
            "Detection": "AUTO",
            "TagResources": [],
            "UntagResources": [],
            "ResourceMapping": {
                "Source": {
                    "StackName": "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack1/3e6a1ff0-94b1-11f0-aa6f-0a88d2e03acf",
                    "LogicalResourceId": "MyLambdaRole"
                },
                "Destination": {
                    "StackName": "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack2/5da91650-94b1-11f0-81cf-0a23500e151b",
                    "LogicalResourceId": "MyLambdaRole"
                }
            }
        },
        {
            "Action": "MOVE",
            "Entity": "RESOURCE",
            "PhysicalResourceId": "MyTestFunction",
            "Description": "Resource configuration changes will be validated during refactor execution.",
            "Detection": "AUTO",
            "TagResources": [
                {
                    "Key": "aws:cloudformation:stack-name",
                    "Value": "Stack2"
                },
                {
                    "Key": "aws:cloudformation:logical-id",
                    "Value": "MyFunction"
                },
                {
                    "Key": "aws:cloudformation:stack-id",
                    "Value": "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack2/5da91650-94b1-11f0-81cf-0a23500e151b"
                }
            ],
            "UntagResources": [
                "aws:cloudformation:stack-name",
                "aws:cloudformation:logical-id",
                "aws:cloudformation:stack-id"
            ],
            "ResourceMapping": {
                "Source": {
                    "StackName": "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack1/3e6a1ff0-94b1-11f0-aa6f-0a88d2e03acf",
                    "LogicalResourceId": "MyFunction"
                },
                "Destination": {
                    "StackName": "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack2/5da91650-94b1-11f0-81cf-0a23500e151b",
                    "LogicalResourceId": "MyFunction"
                }
            }
        }
    ]
}

After reviewing and confirming your changes, use the execute-stack-refactor command to complete the stack refactoring operation.
aws cloudformation execute-stack-refactor --stack-refactor-id 9c384f70-4e07-4ed7-a65d-fee5eb430841
Use the describe-stack-refactor command to monitor the execution status.
aws cloudformation describe-stack-refactor --stack-refactor-id 9c384f70-4e07-4ed7-a65d-fee5eb430841

{
    "StackRefactorId": "9c384f70-4e07-4ed7-a65d-fee5eb430841",
    "StackIds": [
        "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack1/3e6a1ff0-94b1-11f0-aa6f-0a88d2e03acf",
        "arn:aws:cloudformation:us-east-1:123456789012:stack/Stack2/5da91650-94b1-11f0-81cf-0a23500e151b"
    ],
    "ExecutionStatus": "SUCCEEDED",
    "Status": "COMPLETE"
}

Ref: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stack-refactoring.html

Server Maintenance Window

Suyash Sambhare — Tue, 29 Sep 2026 03:27:28 +0000

For decades, server maintenance has assumed one core constraint: time is reserved.

Institutions identify vulnerabilities, evaluate fixes, test changes, coordinate across teams, and deploy during controlled maintenance windows. In regulated environments, that cycle can take weeks or even months.

Today, AI is collapsing that timeline. Powerful new AI models are making the slow, traditional patch cycles an operational risk.

The Assumption of Time Is Disappearing

Frontier AI models are the most advanced, cutting-edge AI models available. They possess levels of enhanced computational training, problem-solving, and cross-domain reasoning at the leading edge of our technological capabilities today. This makes frontier AI models both incredibly powerful and fast. These Frontier AI systems are accelerating both software development and vulnerability research. They can analyse large codebases, reason across execution paths, surface subtle flaws, and infer how those flaws could be exploited at scale for all compute platforms.

At the same time, we are seeing the rise of machine-speed offensive collectives. These are not linear human workflows. They are increasingly automated, distributed systems that compress the full attack loop: discovery, validation, weaponisation, and deployment. This creates a structural imbalance. Adversaries are moving toward AI-accelerated threat exploitation, while enterprise remediation remains largely human-paced. For server operators, maintenance can no longer be treated as periodic operations. It must become a continuous, architecture-level security capability.

Attack Cycles No Longer Wait for Maintenance Windows

Traditionally, security fixes follow a predictable path:

Security fix is Available
Assess it's requirement
Schedule it's implementation
Test
Deploy

That model assumes attackers and defenders operate on similar human timescales which is no longer true.

Consider the widely reported Hugging Face security event: roughly 1,200 autonomous AI agents transmitted nearly 70,000 messages to converge on a unified attack vector. Orchestrating an offensive campaign of that scale and synchronisation using conventional, human-paced methods would be virtually impossible within the same time frame.

Frontier AI models compress the offensive lifecycle:

Vulnerability discovery becomes automated or semi-automated
Exploit generation becomes assisted or fully generated
Targeting becomes highly scalable
Execution runs in parallel across systems and agents

Adversarial behaviour is shifting from campaigns to continuous systems, and the enterprise response must accelerate accordingly.
The key question is now unavoidable: How do we defend systems when adversaries can discover and operationalise vulnerabilities faster than traditional remediation processes can respond?
This is not a future or theoretical risk. This structural asymmetry is.
Traditional maintenance discipline is still necessary, but it must be redesigned for time compression under active adversarial pressure.

Server Stability Cannot Mean Server Inertia

The server remains foundational to global enterprise computing because of its reliability, security, transactional scale, and operational rigour. Those strengths are important, but availability cannot come at the expense of security. In some circumstances, accepting controlled disruption is safer than preserving continuous operation with known vulnerabilities.

In many environments, customisation, complex testing, limited maintenance windows, institutional silos, and procedural overhead significantly slow security updates. That delay is no longer just operational friction. It’s a direct exposure window that adversaries are actively optimising against.

The objective must shift. Preserve server stability while dramatically increasing the velocity of safe change. These goals are not in conflict. In an AI-accelerated threat landscape, they are mutually reinforcing.

The New Cybersecurity Metric: Time to Remediation
Severity alone is no longer sufficient. A more meaningful metric has emerged: time to remediation under compressed attack timelines.

Consider two institutions facing the same critical vulnerability:

Institution X remediates in hours.
Institution Y requires six weeks.

In a human-paced threat environment, both are exposed. In an increasingly automated threat landscape, only one remains continuously exposed. The difference is not the vulnerability itself, but the exposure duration relative to the adversarial cycle time.

As automation scales offensive capability, the time a vulnerability remains unpatched becomes a primary driver of breach probability. Maintenance velocity, therefore, is not just an IT concern. It is a core cyber resilience control.

Questions Every Leader Should Be Asking

Server leaders must now evaluate the full remediation lifecycle through the lens of adversarial time compression.

Key questions they must consider include:

Where does the remediation pipeline slow, relative to attack speed?
Are fixes bundled into infrequent cycles that extend exposure windows?
Do security updates compete with functional changes for deployment capacity?
How much testing remains manual, and what parts can be automated?
Do approval chains add friction without reducing risk in urgent scenarios?
Can critical security fixes bypass non-essential coordination while preserving compliance?
Can patches be designed for minimal operational disruption by default?
Can systems ingest continuous updates rather than relying on episodic maintenance windows?
Most importantly, what is the trade-off between reducing risk and experiencing occasional operational outages?
And, has the institution defined its required remediation time in today’s AI-driven threat environment?

For many enterprises, the answer is unclear, and that gap, itself, is now a risk.

How OpenSource Can Help Close the Gap

IT Operators cannot solve this alone. Software providers have the opportunity to redesign maintenance delivery for adversaries that do not wait for change windows. The broader vendor ecosystem must move past traditional, slow-cadence patch delivery. Software providers have an opportunity to innovate how maintenance is delivered to enable operators to adapt in real time rather than waiting for quarterly change windows.

This includes:

Designing fixes for low-friction, rapid deployment.
Reducing configuration and dependency complexity.
Minimising operational disruption by default.
Increasing automation in testing and validation.
Providing machine-readable risk and remediation guidance.
Enabling fixes that avoid full system downtime where possible.

OpenSource owners have an opportunity to apply AI defensively:

Analyse codebases for latent risk at scale
Prioritise vulnerabilities by exploit ability, not just severity
Accelerate patch generation and validation
Expand automated regression testing
Reduce time from discovery to safe release
This is a defining opportunity of frontier AI: turn automated offence into machine-assisted defence and remediation.

Maintenance Is Becoming a Real-Time Security Capability

Enterprises have long invested in detection: SIEM, endpoint protection, monitoring, threat intelligence, penetration testing, and SOCs.

But detection assumes time to respond. That assumption is breaking. In an environment where attacks can progress continuously and at scale, remediation velocity becomes as important as detection capability. Finding vulnerabilities faster is insufficient if they cannot be fixed faster. This elevates maintenance from an operational process to a core security control plane function. For servers, the implications are significant:

Quarterly maintenance becomes continuous delivery
Manual testing becomes automated validation pipelines
Large change windows become frequent, smaller deployments
Security fixes become a distinct high-priority path
Remediation is measured in hours, not cycles
Institutions that cannot compress this loop will face exposure, not from isolated attackers, but from continuous automated adversarial systems.

The Time Has Changed

Even with the changes that frontier AI is forcing all enterprise systems to address, the server remains one of the most secure and resilient platforms ever built. Its strengths — security in the DNA of the hardware, centralisation, isolation, reliability, and operational discipline — are more critical than ever.

But they must now be paired with a new capability; the ability to respond to AI-accelerated threat cycles.

The next era of server security will not be defined by how difficult vulnerabilities are to find or exploit. It will be defined by whether institutions can close the remediation loop faster than adversaries can open it. The offensive loop is accelerating. The defensive loop must match it.

The maintenance window is no longer a window. It is a continuous security capability, and the clock is ticking.

Ref: https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/the-speed-problem-how-frontier-ai-exposes-weakness-in-enterprise-cybersecurity

Flesch Kincaid level statistics

Suyash Sambhare — Fri, 25 Sep 2026 04:42:15 +0000

The Flesch–Kincaid readability tests are readability tests designed to indicate how difficult it is for a reader to understand a given passage of written English. The Plain English proponent, Rudolf Flesch devised the Reading-Ease test to evaluate the readability of an English text. Later, Flesch and the psychologist J. Peter Kincaid jointly developed the Grade Level test for the U.S. Navy.

The two tests of the readability of an English text are: (i) the Flesch Reading-Ease test and (ii) the Flesch–Kincaid Grade Level test. Each test of written-language use applies the same core measures (word length and sentence length) to a text, but each test gives different critical weight in evaluating the readability-measures of a text written in English. The results of the readability tests correlate approximately inversely: a text with a high-readability score on the Reading-Ease test should have a low-readability score on the Grade-Level test.

Understand readability scores

Each readability test bases its rating on the average number of syllables per word and words per sentence. The following sections explain how each test scores your file's readability.

Flesch Reading Ease test

This test rates text on a 100-point scale. The higher the score, the easier it is to understand the document. For most standard files, you want the score to be between 60 and 70.

The formula for the Flesch Reading Ease score is:

206.835 – (1.015 x ASL) – (84.6 x ASW)

where:

ASL = average sentence length (the number of words divided by the number of sentences)
ASW = average number of syllables per word (the number of syllables divided by the number of words)

Flesch-Kincaid Grade Level test

This test rates text on a U.S. school grade level. For example, a score of 8.0 means that an eighth grader can understand the document. For most documents, aim for a score of approximately 7.0 to 8.0.

The formula for the Flesch-Kincaid Grade Level score is:

(.39 x ASL) + (11.8 x ASW) – 15.59

where:

ASL = average sentence length (the number of words divided by the number of sentences)
ASW = average number of syllables per word (the number of syllables divided by the number of words)

Understand how languages affect readability scores

The languages that you use in a document can affect how your Office program checks and presents readability scores.

If you set up Word to check the spelling and grammar of text in other languages, and a document contains text in multiple languages, Word displays readability statistics for text in the last language that was checked. For example, if a document contains three paragraphs — the first in English, the second in French, and the third in English — Word displays readability statistics for the English text only.
For some European languages within an English document, Word displays only information about counts and averages, not readability.

Ref: https://support.microsoft.com/en-us/word/about-flesch-kincaid-readability-and-level-statistics

test

Suyash Sambhare — Thu, 27 Aug 2026 05:32:25 +0000

test

MSRC

Suyash Sambhare — Tue, 18 Aug 2026 05:36:20 +0000

In this PowerShell module, you will see script functions that show how to interact with the API, as well
as functions that organize data from the industry-standard CVRF document format to show some reporting scenarios.

You can clone this repo, or download the latest modules directly from the Microsoft Powershell Gallery (Powershell v3 and higher).

Installing directly from Microsoft Powershell Gallery

Must be running Powershell v5.1 or higher
With this solution, you do not need to download code from this Github repository.
Instead, you can download the directly from the Microsoft Powershell Gallery.
The Powershell version can be verified by checking the Major variable in the $PSVersionTable.PSVersion variable:

$PSVersionTable.PSVersion

Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      14393  693

If you're running as an administrator you can install the module in your program files:

Install-Module MSRCSecurityUpdates -Force 
Import-Module MSRCSecurityUpdates

If you're not running as an administrator, you can install the module in your profile by providing an additional parameter about the Scope:

Install-Module MSRCSecurityUpdates -Force -Scope CurrentUser
Import-Module MSRCSecurityUpdates

Generating a HTML document of Monthly Updates

In this common scenario, the Get-MsrcCvrfDocument and Get-MsrcVulnerabilityReportHtml can be pipelined together to generate a HTML document with out-file:

### Install the module from the PowerShell Gallery (must be run as Admin)
Install-Module -Name msrcsecurityupdates -force
Import-module MsrcSecurityUpdates
$monthOfInterest = '2017-Apr'

Get-MsrcCvrfDocument -ID $monthOfInterest -Verbose | 
Get-MsrcSecurityBulletinHtml -Verbose | 
Out-File c:\temp\MSRCAprilSecurityUpdates.html

You can also build a modified object to pass into Get-MsrcVulnerabilityReportHtml. This allows more customization of the report being generated. In this example, the generated report will only have the wanted CVE's included:

Install-Module -Name MsrcSecurityUpdates -Force
Import-Module -Name MsrcSecurityUpdates -Force

$monthOfInterest = "2017-Mar"

$CVEsWanted = @(
        "CVE-2017-0001", 
        "CVE-2017-0005"
        )
$Output_Location = "C:\your\path\here"

$CVRFDoc = Get-MsrcCvrfDocument -ID $monthOfInterest -Verbose
$CVRFHtmlProperties = @{
    Vulnerability = $CVRFDoc.Vulnerability | Where-Object {$_.CVE -in $CVEsWanted}
    ProductTree = $CVRFDoc.ProductTree
}

Get-MsrcVulnerabilityReportHtml @CVRFHtmlProperties -Verbose | Out-File $Output_Location

An alternate HTML template is also avalible which generates reports which are grouped into catagories rather than by each CVE. This report may be more helpful if you are interested in all the vulnerabilities that affect a certain product and platform. This report can be ran exactly like above, however if you are filtering based on CVE's (or not piping the output from Get-MsrcCvrfDocument) two aditional fields are required. the above examples are replicated here for the different report type.

Building a report that contains all CVE's:

### Install the module from the PowerShell Gallery (must be run as Admin)
Install-Module -Name MsrcSecurityUpdates -Force
Import-module MsrcSecurityUpdates
$monthOfInterest = '2017-Apr'

Get-MsrcCvrfDocument -ID $monthOfInterest -Verbose | Get-MsrcSecurityBulletinHtml -Verbose | Out-File c:\temp\MSRCAprilSecurityUpdates.html

Using powershell to filter the report to your liking:

Install-Module -Name MsrcSecurityUpdates -Force
Import-Module -Name MsrcSecurityUpdates -Force

$monthOfInterest = "2017-Mar"

$CVEsWanted = @(
        "CVE-2017-0001", 
        "CVE-2017-0005"
        )
$Output_Location = "C:\your\path\here"

$CVRFDoc = Get-MsrcCvrfDocument -ID $monthOfInterest -Verbose
$CVRFHtmlProperties = @{
    Vulnerability = $CVRFDoc.Vulnerability | Where-Object {$_.CVE -in $CVEsWanted}
    ProductTree = $CVRFDoc.ProductTree
    DocumentTracking = $CVRFDoc.DocumentTracking
    DocumentTitle = $CVRFDoc.DocumentTitle
}

Get-MsrcSecurityBulletinHtml @CVRFHtmlProperties -Verbose | Out-File $Output_Location

Finding Mitigations and Workarounds

In this scenario, you can use the Get-MsrcCvrfDocument and extract the migrations & remediations from each vulnerability.

### Install the module from the PowerShell Gallery (must be run as Admin)
Install-Module -Name MsrcSecurityUpdates

### Download the March CVRF as an object
$cvrfDoc = Get-MsrcCvrfDocument -ID 2017-Mar

### Get the Remediations of Type 'Workaround' (0)
$cvrfDoc.Vulnerability.Remediations | Where Type -EQ 0

### Get the Remediations of Type 'Mitigation' (1)
$cvrfDoc.Vulnerability.Remediations | Where Type -EQ 1

### Get the Remediations of Type 'VendorFix' (2)
$cvrfDoc.Vulnerability.Remediations | Where Type -EQ 2

Help!

You'll find help via Get-Help for each cmdlet:

Get-Help Get-MsrcSecurityUpdate

NAME
    Get-MsrcSecurityUpdate

SYNOPSIS
    Get MSRC security updates


SYNTAX
    Get-MsrcSecurityUpdate [<CommonParameters>]

    Get-MsrcSecurityUpdate [-After <DateTime>] [-Before <DateTime>] [<CommonParameters>]

    Get-MsrcSecurityUpdate -Year <Int32> [<CommonParameters>]

    Get-MsrcSecurityUpdate -Vulnerability <String> [<CommonParameters>]


DESCRIPTION
    Calls the CVRF Update API to get a list of security updates


RELATED LINKS

REMARKS
    To see the examples, type: "get-help Get-MsrcSecurityUpdate -examples".
    For more information, type: "get-help Get-MsrcSecurityUpdate -detailed".
    For technical information, type: "get-help Get-MsrcSecurityUpdate -full".

... as well as sample code with --examples:

Get-Help Get-MsrcSecurityUpdate -examples

NAME
    Get-MsrcSecurityUpdate

SYNOPSIS
    Get MSRC security updates

    -------------------------- EXAMPLE 1 --------------------------

    PS C:\>Get-MsrcSecurityUpdate


    Get all the updates




    -------------------------- EXAMPLE 2 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -Vulnerability CVE-2017-0003


    Get all the updates containing Vulnerability CVE-2017-003




    -------------------------- EXAMPLE 3 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -Year 2017


    Get all the updates for the year 2017




    -------------------------- EXAMPLE 4 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -Cvrf 2017-Jan


    Get all the updates for the CVRF document with ID of 2017-Jan




    -------------------------- EXAMPLE 5 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -Before 2017-01-01


    Get all the updates before January 1st, 2017




    -------------------------- EXAMPLE 6 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -After 2017-01-01


    Get all the updates after January 1st, 2017




    -------------------------- EXAMPLE 7 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -Before 2017-01-01 -After 2016-10-01


    Get all the updates before January 1st, 2017 and after October 1st, 2016




    -------------------------- EXAMPLE 8 --------------------------

    PS C:\>Get-MsrcSecurityUpdate -After (Get-Date).AddDays(-60) -Before (Get-Date)


    Get all updates between now and the last 60 days

Ref: https://msrc.microsoft.com/update-guide

Database references

Suyash Sambhare — Mon, 10 Aug 2026 05:31:07 +0000

Database references in SQL projects enable you to incorporate objects that aren't included in a project by linking to another project, .dacpac file, or published NuGet package. The database objects you add to a project can be part of the same database, a different database on the same server, or a different database on a different server. For SQL Server development, use database references to link to another database on the same server for three-part naming, or to link to a different database on a different server for cross-database queries. For databases with a large number of objects in distinct groups, use database references to break up a database into smaller, more manageable projects. Smaller project size can help improve performance and reduce the time required to build a project during iterative local development.

SQL project file sample and syntax

Include database references in a project through entries in the .sqlproj file, similar to C# projects. Use SQLCMD syntax to reference the database name in SQL project objects. When a database reference points to a different database on the same server, include a <DatabaseSqlCmdVariable> element in the project reference. When a database reference points to a different database on a different server, also include a <ServerSqlCmdVariable> element in the project reference. Database references to the same database don't include <ServerSqlCmdVariable> or <DatabaseSqlCmdVariable> elements.

To include a specific reference to the database reference in the SQL scripts, use SQLCMD variables named in the project file to specify the database name. For example, the following SQL script references a table in the Warehouse database:

SELECT ProductId,
       StorageLocation,
       BinNumber
FROM [$(Warehouse)].[Production].[ProductInventory];

UPDATE [$(DatabaseName)].[SalesLT].[Customer]
SET [SalesPerson] = 'John Doe',
    [ModifiedDate] = GETDATE()
WHERE [CustomerId] = @CustomerId;

Build with project references

Building a SQL project with database references might require extra configuration to ensure that the referenced objects are available during the build process. For example, if you're building a project in a continuous integration (CI) pipeline, you need to set up the build agent environment similarly to the local development environment.

.dacpac references in the SQL project require that the .dacpac be present on the build agent at the same relative file path as specified in the project file.

Project references in the SQL project require that the referenced project be present on the build agent at the same relative file path as specified in the project file and be able to build successfully on the build agent.
System database references created in original SQL projects in Visual Studio require that the build agent have Visual Studio installed.
NuGet package references in the SQL project require the package be published to a NuGet feed that is also set as a package source for the build agent.

Publish with project references

Publishing a .dacpac built from a project with database references requires no extra steps. The .dacpac file contains the referenced objects and the SQLCMD variables specified in the project file.

For database references to objects in the same database, the objects from the referenced project are included in the .dacpac file but aren't included in the deployment by default. To include the objects in the deployment, use the /p:IncludeCompositeObjects=true option in the SqlPackage command line tool. For example, the following command deploys the AdventureWorks project with the /p:IncludeCompositeObjects=true option to include the objects from database references to AdventureWorks:

Ref: https://learn.microsoft.com/en-gb/sql/tools/sql-database-projects/concepts/database-references

Disaster Recovery with AWS EKS on EFS

Suyash Sambhare — Fri, 07 Aug 2026 03:35:02 +0000

Start by cloning the samples.

git clone https://github.com/aws-samples/dr-with-eks-efs.git
cd dr-with-eks-efs/
chmod +x ~/dr-with-eks-efs/workshop/startup.sh
~/dr-with-eks-efs/workshop/startup.sh

Finally, let's make the environment variables persistent across our sessions by running the below command:

source ~/.bashrc
echo 'source ~/.bashrc' >> ~/.bash_profile
echo "AWS_DEFAULT_REGION : $AWS_DEFAULT_REGION"
echo "PRI_REGION         : $PRI_REGION"
echo "DR_REGION          : $DR_REGION"
echo "PRI_CLUSTER_NAME   : $PRI_CLUSTER_NAME"
echo "DR_CLUSTER_NAME    : $DR_CLUSTER_NAME"
echo "ACCOUNT_ID         : $(aws sts get-caller-identity --query Account --output text)"

Each line should print a non-empty value. If any variable is blank, re-run the setup steps above and then source ~/.bashrc.

Confirm connectivity to the primary EKS cluster:
aws eks update-kubeconfig --name $PRI_CLUSTER_NAME --region $PRI_REGION kubectl get nodes

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-sc
provisioner: efs.csi.aws.com
parameters:
  provisioningMode: efs-ap
  fileSystemId: fs-92107410
  directoryPerms: "700"
  gidRangeStart: "1000" # optional
  gidRangeEnd: "2000" # optional
  basePath: "/dynamic_provisioning" # optional
  subPathPattern: "${.PVC.namespace}/${.PVC.name}" # optional
  ensureUniqueDirectory: "false" # optional
  reuseAccessPoint: "false" # optional

Step 2 - Define the environment variables for the primary region

We will use a few variables during the next steps. Please configure these values with your choice. AWS region codes are listed

export PRI_REGION=<Replace with your choice>
export PRI_CFN_NAME=<Replace with your choice>
export PRI_CLUSTER_NAME=<Replace with your choice>

Create CloudFormation stack in the primary region :

aws cloudformation create-stack --stack-name $PRI_CFN_NAME --template-body file://config_files/pri_region_cfn.yaml --region $PRI_REGION

Check the status of the CloudFormation stack in the primary region

watch aws cloudformation describe-stacks --stack-name $PRI_CFN_NAME --query "Stacks[].StackStatus" --output text --region $PRI_REGION

Once the output shows CREATE_COMPLETE you can move on to the next step. Exit using CTRL + C.

Create the EKS cluster in the primary region

Have a look at the cluster configuration manifest file (pri_region_cluster.yaml). We specify Kubernetes version 1.28 and EFS CSI driver as an EKS managed addon.

Set and embed additional variables into manifest file and deploy the cluster to the primary region.

source config_files/pri_region_env.sh
envsubst < config_files/pri_region_eksctl_template.yaml | eksctl create cluster -f -

EKS cluster creation process completes in about 15 minutes. Once it completes update your kubeconfig file to access the cluster by doing aws eks update-kubeconfig --name $PRI_CLUSTER_NAME --region $PRI_REGION.

Verify that the worker nodes status is Ready by doing kubectl get nodes.

[!NOTE]

You can either wait for cluster creation or you can open a separate terminal and move on to deploy the infrastructure in the DR region. If you use a separate terminal then keep in mind that the variables you created in Step 1 and 5 above wont be available in that new terminal. You need to define them again as you will need to have all variables defined in the same terminal when configuring EFS replication at a later step.

Define the environment variables for the DR region

We will use a few variables during the next steps. Please configure the values of your choice below. AWS region codes are listed here.

export DR_REGION=<Replace with your choice>
export DR_CFN_NAME=<Replace with your choice>
export DR_CLUSTER_NAME=<Replace with your choice>

Set and embed additional variables into the eksctl cluster config file for the DR region

Have a look at the cluster configuration manifest file (dr_region_cluster.yaml). We specify Kubernetes version 1.28 and EFS CSI driver as an EKS managed addon.

Set and embed additional variables into manifest file and deploy the cluster to the primary region.

source config_files/dr_region_env.sh
envsubst < config_files/dr_region_eksctl_template.yaml | eksctl create cluster -f -

EKS cluster creation process completes in about 15 minutes. Once it completes update your kubeconfig file to access the cluster by doing aws eks update-kubeconfig --name $DR_CLUSTER_NAME --region $DR_REGION.

Verify that the worker nodes status is Ready by doing kubectl get nodes.

Enable EFS replication

Configure replication from primary to DR region.

aws efs update-file-system-protection --file-system-id $DR_EFS_ID --replication-overwrite-protection DISABLED --region $DR_REGION
aws efs create-replication-configuration --source-file-system-id $PRI_EFS_ID --destinations Region=$DR_REGION,FileSystemId=$DR_EFS_ID --region $PRI_REGION

You can check the status of the replication by watch aws efs describe-replication-configurations --file-system-id $PRI_EFS_ID --region $PRI_REGION --query 'Replications[].Destinations[].Status' --output text. It takes ~15 minutes for the initial replication to complete. Once you see the Status as Enabled you can then move on to the next step.

Ref: https://github.com/aws-samples/dr-with-eks-efs
Ref: https://aws.amazon.com/blogs/containers/multi-region-disaster-recovery-with-amazon-eks-and-amazon-efs-for-stateful-workloads/

Spark on EKS

Suyash Sambhare — Wed, 08 Jul 2026 02:31:15 +0000

Running and Optimizing Analytics Workloads on Amazon EKS

This advanced 400-level workshop demonstrates how to optimize Apache Spark workloads on Amazon EKS Auto Mode through hands-on exercises focusing on performance, and cost optimization using various pricing options (EC2 Spot ), processor architecture (AWS Graviton processor based instances), Amazon EC2 instance types (Memory Optimized and Compute Optimized families), and Amazon EC2 storage configurations (NVMe storage based instances). This workshop, designed to be completed in under two hours, provides you with practical experience in setting up observability tools, leveraging various processor choices, computes families, and storage options to achieve optimal performance and cost-effectiveness for your Spark jobs on Amazon EKS.

Provision the Stack

First, clone the spark-workshop branch from the data-on-eks repository:

sudo apt install terraform
git clone -b spark-workshop https://github.com/awslabs/data-on-eks.git
cd data-on-eks/analytics/terraform/spark-k8s-operator
./install.sh

The script will sequentially provision:

VPC and networking components
EKS cluster with AutoMode
Karpenter node classes and pools
EBS CSI driver and storage classes
EKS Blueprints addons

Update Kubeconfig

Once the deployment is complete, update your local kubeconfig to access the Kubernetes cluster:

aws eks update-kubeconfig --name spark-on-eks --region us-west-2
kubectl get nodes
NAME                  STATUS   ROLES    AGE     VERSION
i-02ffb325c17f97793   Ready    <none>   15m     v1.33.7-eks-3c60543
i-054759a89b32ca877   Ready    <none>   15m     v1.33.7-eks-3c60543
i-0cad804d029dcd457   Ready    <none>   6m44s   v1.33.7-eks-3c60543

kubectl get pods -A
NAMESPACE               NAME                                                              READY   STATUS    RESTARTS        AGE
amazon-cloudwatch       amazon-cloudwatch-observability-controller-manager-bbffd6cdtkbh   1/1     Running   0               16m
amazon-cloudwatch       cloudwatch-agent-fvnxt                                            1/1     Running   0               16m
amazon-cloudwatch       cloudwatch-agent-h97jm                                            1/1     Running   1 (7m36s ago)   7m49s
amazon-cloudwatch       cloudwatch-agent-ltrdn                                            1/1     Running   0               16m
amazon-cloudwatch       fluent-bit-5fj54                                                  1/1     Running   0               16m
amazon-cloudwatch       fluent-bit-f6jf9                                                  1/1     Running   0               7m49s
amazon-cloudwatch       fluent-bit-nd9jv                                                  1/1     Running   0               16m
ingress-nginx           ingress-nginx-controller-6f449f6b9d-52mfg                         1/1     Running   0               8m54s
kube-prometheus-stack   kube-prometheus-stack-grafana-b8644d6bb-9hr49                     3/3     Running   0               8m48s
kube-prometheus-stack   kube-prometheus-stack-kube-state-metrics-787d55fc86-zcx2g         1/1     Running   0               8m48s
kube-prometheus-stack   kube-prometheus-stack-operator-79df675c88-hzgmk                   1/1     Running   0               8m48s
kube-prometheus-stack   kube-prometheus-stack-prometheus-node-exporter-bqdkw              1/1     Running   0               8m48s
kube-prometheus-stack   kube-prometheus-stack-prometheus-node-exporter-lmwj5              1/1     Running   0               7m49s
kube-prometheus-stack   kube-prometheus-stack-prometheus-node-exporter-rdrbm              1/1     Running   0               8m48s
kube-prometheus-stack   prometheus-kube-prometheus-stack-prometheus-0                     2/2     Running   0               8m41s
kube-system             aws-for-fluent-bit-2qzqf                                          1/1     Running   0               8m40s
kube-system             aws-for-fluent-bit-tkwlt                                          1/1     Running   0               8m40s
kube-system             aws-for-fluent-bit-zsvb5                                          1/1     Running   0               7m47s
kube-system             coredns-7bf648ff5d-kszkh                                          1/1     Running   0               16m
kube-system             coredns-7bf648ff5d-vw5b8                                          1/1     Running   0               16m
kube-system             ebs-csi-controller-6554fb87b4-2cj2k                               6/6     Running   0               16m
kube-system             ebs-csi-controller-6554fb87b4-9kjbk                               6/6     Running   0               16m
kube-system             metrics-server-5b9d857696-2mthf                                   1/1     Running   0               16m
kube-system             metrics-server-5b9d857696-d9tvl                                   1/1     Running   0               16m
kube-system             s3-csi-controller-5c9697d6fd-hlkpd                                1/1     Running   0               16m
kube-system             s3-csi-node-5k56b                                                 3/3     Running   0               16m
kube-system             s3-csi-node-jtb2p                                                 3/3     Running   0               16m
kube-system             s3-csi-node-k2drl                                                 3/3     Running   0               7m49s
kubecost                kubecost-cost-analyzer-7b5cd5cdc6-rblrm                           4/4     Running   0               8m6s
kubecost                kubecost-forecasting-7b75bc5bbb-8nhfr                             1/1     Running   0               8m6s
kubecost                kubecost-network-costs-b2cmq                                      1/1     Running   0               8m6s
kubecost                kubecost-network-costs-hjsv2                                      1/1     Running   0               8m6s
kubecost                kubecost-network-costs-rz25g                                      1/1     Running   0               7m48s
spark-history-server    spark-history-server-0                                            1/1     Running   0               8m8s
spark-operator          spark-operator-controller-85d96b88fc-mr4qd                        1/1     Running   0               8m7s
spark-operator          spark-operator-webhook-66c6b99949-pdh6z                           1/1     Running   0               8m7s

cd data-on-eks/analytics/scripts
python3 data-gen.py

Gather Key Terraform Output Values

Set the repository's local home path as an environment variable:

export REPO_HOME=$(pwd)/data-on-eks
cd $REPO_HOME/analytics/terraform/spark-k8s-operator  

#Value for S3 Logs Bucket name
export s3_logs_bucket_name=$(terraform output -raw s3_bucket_id_spark_history_server)

#Value for S3 Logs Bucket region
export s3_logs_bucket_region=$(terraform output -raw s3_bucket_region_spark_history_server)

cd $REPO_HOME/analytics/scripts
bash order-execute.sh ${s3_logs_bucket_name} ${s3_logs_bucket_region}

Deploy and Monitor Spark Job

Configure the Spark job

cd $REPO_HOME/analytics/terraform/spark-k8s-operator/examples/karpenter
sed -i -e "s|<S3_BUCKET>|$s3_logs_bucket_name|g" spark-app-ondemand.yaml
kubectl apply -f spark-app-ondemand.yaml

Once you apply the Spark Job configuration the following happens:

Spark Driver Provisioning:

Spark Driver pod requests: 2 CPU cores, 6GB memory (4GB + 2GB overhead)
Auto Mode identifies no matching nodes with NodeGroupType=SparkComputeGeneral
Auto Mode provisions a new node matching requirements and AZ constraints
Spark Driver pod schedules and initializes

Spark Executor Setup:

Spark Driver requests 4 Spark Executor pods
Each Spark Executor needs: 2 CPU cores, 6GB memory
Total Spark Executor requirements: 8 cores, 24GB memory
Auto Mode provisions 1-2 nodes based on bin-packing efficiency
All nodes must support the requirements, capacity requirements, and be in correct AZ

Spark Job Execution:

Processes data from s3a://spark-on-eks/order/input/
Writes to s3a://spark-on-eks/order/output/ondemand/

AWS_REGION=$AWS_REGION eks-node-viewer -resources cpu,memory -extra-labels "karpenter.sh/nodepool,topology.kubernetes.io/zone"
kubectl get sparkapplication -n spark-team-a
NAME             STATUS      ATTEMPTS   START                  FINISH       AGE
order-ondemand   SUBMITTED   1          2025-11-21T00:42:07Z   <no value>   47s

kubectl get pod -n spark-team-a -l spark-role=driver
NAME                    READY   STATUS    RESTARTS   AGE
order-ondemand-driver   1/1     Running   0          84s

kubectl get pod -n spark-team-a -l spark-role=executor
NAME                    READY   STATUS    RESTARTS   AGE
order-ondemand-exec-1   1/1     Running   0          57s
order-ondemand-exec-2   1/1     Running   0          57s
order-ondemand-exec-3   1/1     Running   0          56s
order-ondemand-exec-4   1/1     Running   0          56s

kubectl describe sparkapplication order-ondemand -n spark-team-a
Name:         order-ondemand
Namespace:    spark-team-a
Labels:       app=order-ondemand
              queue=root.test
Annotations:  <none>
API Version:  sparkoperator.k8s.io/v1beta2
Kind:         SparkApplication
Metadata:
  Creation Timestamp:  2025-11-21T00:42:07Z
  Generation:          1
  Resource Version:    440830
  UID:                 660e1012-30a6-479c-92eb-6fa46b768029
Spec:
  Arguments:
    s3a://spark-on-eks-spark-logs-20251120082140604400000004/order/input/
    s3a://spark-on-eks-spark-logs-20251120082140604400000004/order/output/ondemand/
  Deps:
  Driver:
    Annotations:
      karpenter.sh/do-not-disrupt:  true
    Cores:                          2
    Memory:                         4g
    Memory Overhead:                2g
    Node Selector:
      Node Group Type:             SparkComputeGeneral
      karpenter.sh/capacity-type:  on-demand
    Service Account:               spark-team-a
  Executor:
    Affinity:
      Pod Affinity:
        Required During Scheduling Ignored During Execution:
          Label Selector:
            Match Expressions:
              Key:       app
              Operator:  In
              Values:
                order-ondemand
          Topology Key:  topology.kubernetes.io/zone
    Annotations:
      karpenter.sh/do-not-disrupt:  true
    Cores:                          2
    Instances:                      4
    Memory:                         4g
    Memory Overhead:                2g
    Node Selector:
      Node Group Type:             SparkComputeGeneral
      karpenter.sh/capacity-type:  on-demand
    Service Account:               spark-team-a
  Image:                           public.ecr.aws/data-on-eks/spark:4.0.1-scala2.13-java21-python3-r-ubuntu
  Image Pull Policy:               IfNotPresent
  Main Application File:           s3a://spark-on-eks-spark-logs-20251120082140604400000004/scripts/pyspark-order.py
  Mode:                            cluster
  Python Version:                  3
  Restart Policy:
    On Failure Retries:                    3
    On Failure Retry Interval:             10
    On Submission Failure Retries:         3
    On Submission Failure Retry Interval:  20
    Type:                                  OnFailure
  Spark Conf:
    spark.app.name:                                           order-ondemand
    spark.eventLog.dir:                                       s3a://spark-on-eks-spark-logs-20251120082140604400000004/spark-event-logs
    spark.eventLog.enabled:                                   true
    spark.eventLog.rolling.enabled:                           true
    spark.eventLog.rolling.maxFileSize:                       64m
    spark.executor.processTreeMetrics.enabled:                true
    spark.hadoop.fs.s3.impl:                                  org.apache.hadoop.fs.s3a.S3AFileSystem
    spark.hadoop.fs.s3a.aws.credentials.provider:             software.amazon.awssdk.auth.credentials.ContainerCredentialsProvider,software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider
    spark.hadoop.fs.s3a.connection.maximum:                   200
    spark.hadoop.fs.s3a.connection.timeout:                   1200000
    spark.hadoop.fs.s3a.fast.upload:                          true
    spark.hadoop.fs.s3a.input.fadvise:                        random
    spark.hadoop.fs.s3a.path.style.access:                    true
    spark.hadoop.fs.s3a.readahead.range:                      256K
    spark.kubernetes.driver.pod.name:                         order-ondemand-driver
    spark.kubernetes.executor.podNamePrefix:                  order-ondemand
    spark.metrics.conf.*.sink.prometheusServlet.class:        org.apache.spark.metrics.sink.PrometheusServlet
    spark.metrics.conf.driver.sink.prometheusServlet.path:    /metrics/driver/prometheus/
    spark.metrics.conf.executor.sink.prometheusServlet.path:  /metrics/executors/prometheus/
    spark.ui.prometheus.enabled:                              true
  Spark Version:                                              4.0.1
  Type:                                                       Python
Status:
  Application State:
    State:  COMPLETED
  Driver Info:
    Pod Name:             order-ondemand-driver
    Web UI Address:       172.20.177.132:4040
    Web UI Port:          4040
    Web UI Service Name:  order-ondemand-ui-svc
  Execution Attempts:     1
  Executor State:
    order-ondemand-exec-1:       COMPLETED
    order-ondemand-exec-2:       COMPLETED
    order-ondemand-exec-3:       COMPLETED
    order-ondemand-exec-4:       COMPLETED
  Last Submission Attempt Time:  2025-11-21T00:42:07Z
  Spark Application Id:          spark-279d190d2f8744d293baa49a9d8e2f82
  Submission Attempts:           1
  Submission ID:                 de37b837-657b-4795-a7f7-ddc2d65972e7
  Termination Time:              2025-11-21T00:45:01Z
Events:
  Type    Reason                     Age                From                          Message
  ----    ------                     ----               ----                          -------
  Normal  SparkApplicationSubmitted  2m57s              spark-application-controller  SparkApplication order-ondemand was submitted successfully
  Normal  SparkDriverRunning         115s               spark-application-controller  Driver order-ondemand-driver is running
  Normal  SparkExecutorPending       105s               spark-application-controller  Executor order-ondemand-exec-1 is pending
  Normal  SparkExecutorPending       105s               spark-application-controller  Executor order-ondemand-exec-2 is pending
  Normal  SparkExecutorPending       104s               spark-application-controller  Executor order-ondemand-exec-3 is pending
  Normal  SparkExecutorPending       104s               spark-application-controller  Executor order-ondemand-exec-4 is pending
  Normal  SparkExecutorRunning       68s                spark-application-controller  Executor order-ondemand-exec-3 is running
  Normal  SparkExecutorRunning       68s                spark-application-controller  Executor order-ondemand-exec-2 is running
  Normal  SparkExecutorRunning       68s (x2 over 68s)  spark-application-controller  Executor order-ondemand-exec-1 is running
  Normal  SparkExecutorRunning       68s (x3 over 68s)  spark-application-controller  Executor order-ondemand-exec-4 is running
  Normal  SparkExecutorCompleted     11s                spark-application-controller  Executor order-ondemand-exec-2 completed
  Normal  SparkExecutorCompleted     11s                spark-application-controller  Executor order-ondemand-exec-1 completed
  Normal  SparkExecutorCompleted     9s                 spark-application-controller  Executor order-ondemand-exec-4 completed
  Normal  SparkExecutorCompleted     9s                 spark-application-controller  Executor order-ondemand-exec-3 completed
  Normal  SparkDriverCompleted       6s                 spark-application-controller  Driver order-ondemand-driver completed

Ref: http://join.workshops.aws/8b34-065ee4-a5

ECDSA vs RSA

Suyash Sambhare — Wed, 08 Jul 2026 02:11:45 +0000

Elliptic Curve Digital Signature Algorithm vs Rivest, Shamir, and Adleman

ECDSA, or Elliptic Curve Digital Signature Algorithm, is a cryptographic method that uses the mathematics of elliptic curves to create digital signatures. It is known for its efficiency and strong security with smaller key sizes. This makes it particularly suitable for environments where computational power and storage are limited, such as mobile devices and Internet of Things (IoT) gadgets.

RSA is named after its inventors: Rivest, Shamir, and Adleman. It is one of the oldest and most widely adopted cryptographic algorithms. RSA uses the mathematical properties of large prime numbers to encrypt data and create digital signatures. While highly secure when using large key sizes, RSA requires more computational resources compared to ECDSA.

Asymmetric Encryption Algorithms

Asymmetric encryption algorithms are cryptographic methods that use a pair of keys—a public key and a private key—to secure data. The public key is used to encrypt information, and the private key is used to decrypt it

Anyone can use the public key to encrypt a message intended for a specific recipient since the public key is openly shared. However, only the person who holds the corresponding private key can decrypt the message and access its original content. This structure keeps the private key secret while receiving secure, encrypted messages.

ECDSA (elliptic curve digital signature algorithm), or ECC (elliptic curve cryptography) as it’s sometimes known, is the successor of the digital signature algorithm (DSA). ECDSA was born when two mathematicians named Neal Koblitz and Victor S. Miller proposed the use of elliptical curves in cryptography. However, it took almost two decades for the ECDSA algorithm to become standardized.

ECDSA is an asymmetric cryptography algorithm that’s constructed around elliptical curves and an underlying function that’s known as a “trapdoor function.” An elliptic curve represents the set of points that satisfy a mathematical equation $y^{2} = x^{3} + a x + b$ .

If compatibility is your top concern, go with RSA. It’s supported everywhere and doesn’t require changes to your infrastructure. It’s perfect for websites, email servers, and internal tools that rely on well-established cryptographic libraries.

If you care more about performance and efficiency, ECDSA is the clear winner. It’s faster, requires less memory, and is easier on power usage, ideal for mobile apps, connected devices, or blockchain platforms.

Some setups use both. For example, a site might use RSA for TLS while using ECDSA for internal API authentication. The two aren’t mutually exclusive.

Future Proofing against Quantum Computing

As encryption standards evolve, it’s not just about what works now, but also about what survives the next wave of change. That brings us to the threat both RSA and ECDSA can’t ignore.

Quantum computing is a real danger to current encryption systems. Algorithms like RSA and ECDSA rely on problems that a quantum computer running Shor’s algorithm could eventually solve. That would break both prime factorization and discrete logarithm-based systems.

Neither RSA nor ECDSA is safe in a fully quantum future. That’s why researchers are working on post-quantum security tools designed to resist quantum attacks. The shift is already in motion.

Ref:

Native messaging

Suyash Sambhare — Sun, 28 Jun 2026 23:50:35 +0000

To communicate with a native Win32 app that's installed on a user's device, an extension uses an API that's similar to the other message passing APIs. The native app host sends and receives messages with extensions using standard input and standard output.

Extensions that use native messaging are installed in Microsoft Edge similar to any other extension. However, native apps aren't installed or managed by Microsoft Edge.

To acquire the extension and native app host, there are two different distribution models:

Package your extension and the host together. When a user installs the package, both the extension and the host are installed.
Install your extension from Microsoft Edge Add-ons, and your extension prompts users to install the host.

To create your extension to send and receive messages with native app hosts, do the following steps.

Add permissions to the extension manifest

Add the nativeMessaging permission to the manifest.json file of the extension.

This is the extension manifest file, not the native messaging host manifest file, which is covered in later sections.

{
    "name": "Native Messaging Example",
    "version": "1.0",
    "manifest_version": 3,
    "description": "Send a message to a native app.",
    "app": {
        "launch": {
            "local_path": "main.html"
        }
    },
    "icons": {
        "128": "icon-128.png"
    },
    "permissions": ["nativeMessaging"]
}

Create your native messaging host manifest file

Native apps must provide a native messaging host manifest file. A native messaging host manifest file contains the following information:

The path to the native messaging host runtime.

The method of communication with the extension.

A list of allowed extensions to which it communicates.

The browser reads and validates the native messaging host manifest. The browser doesn't install or manage the native messaging host manifest file.

The native messaging host manifest file is distinct from the Manifest V3 or V2 file that is part of the Microsoft Edge extension.

Example of a native messaging host manifest file:

{
    "name": "com.my_company.my_app",
    "description": "My App",
    "path": "C:\\Program Files\\My App\\chrome_native_messaging_host.exe",
    "type": "stdio",
    "allowed_origins": [
        "chrome-extension://knldjmfmopnpolahpmmgbagdohdnhkik/"
    ]
}

The native messaging host manifest file must be a valid JSON file that contains the following keys:

name: Specifies the name of the native messaging host. Clients pass the string to runtime.connectNative or runtime.sendNativeMessage. The value must only contain lowercase alphanumeric characters, underscores, and dots. The value must not start or end with a dot (a period), and a dot must not be followed by another dot.
description: Describes the app.
path: Specifies the path to the native messaging host binary. On Windows devices, you can use relative paths to the directory that contains the native messaging host manifest file. On macOS and Linux, the path must be absolute. The host process starts with the current directory set to the directory that contains the host binary. For example (Windows), if the parameter is set to C:\App\nm_host.exe, the binary is started using the current directory (C:\App\).
type: Specifies the type of the interface used to communicate with the native messaging host. The value instructs Microsoft Edge to use stdin and stdout to communicate with the host. The only acceptable value is stdio.
allowed_origins: Specifies the list of extensions that have access to the native messaging host. To turn on your app to identify and communicate with an extension, in your native messaging host manifest file, set the following value: "allowed_origins": ["chrome-extension://{microsoft_catalog_extension_id}"]

Sideload

Sideload your extension to test native messaging with the host. To sideload your extension during development and retrieve microsoft_catalog_extension_id:

Go to edge://extensions, and then turn on the Developer mode toggle button.
Select Load unpacked, and then select your extension package to sideload.
Click OK.
Go to the edge://extensions page and verify that your extension is listed.
Copy the key from microsoft_catalog_extension_id (ID) from the extension listing on the page.

When you're ready to distribute your extension to users, publish your extension at Microsoft Edge Add-ons. The extension ID of the published extension might differ from the ID that's used while sideloading your extension. If the ID changed, update allowed_origins in the native messaging host manifest file with the ID of your published extension.

Copy the native messaging host manifest file to your system

The final step involves copying the native messaging host manifest file to your computer, and making sure that this manifest file is correctly configured. To ensure your native messaging host manifest file is placed in the expected location, do the following steps. The location varies by platform.
The native messaging host manifest file may be located anywhere in the file system. The app installer must create a registry key and set the default value of the key to the full path of the native messaging host manifest file.

The following locations are examples of registry keys:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app

To add a registry key to the directory with the manifest key run a command in the command prompt:

REG ADD "HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app" /ve /t REG_SZ /d "C:\path\to\nmh-manifest.json" /f

Microsoft Edge queries the HKEY_CURRENT_USER root key, followed by HKEY_LOCAL_MACHINE. In both of the keys, the 32-bit registry is searched first, and then the 64-bit registry is searched to identify native messaging hosts. The registry key specifies the location of the native messaging host manifest file.

If the registry entries for Microsoft Edge don't have the location of the native messaging host manifest file, the Chromium and Chrome registry locations are used as fallback options.

If Microsoft Edge finds the registry key at any of the previously listed locations, it doesn't query the locations that are listed in the following code snippet.

The search order for the registry locations is:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\
HKEY_CURRENT_USER\SOFTWARE\Chromium\NativeMessagingHosts\
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts\

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Edge\NativeMessagingHosts\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Chromium\NativeMessagingHosts\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Chrome\NativeMessagingHosts\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\
HKEY_LOCAL_MACHINE\SOFTWARE\Chromium\NativeMessagingHosts\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\

Native messaging protocol

Microsoft Edge starts each native messaging host in a separate process and communicates with it using standard input (stdin) and standard output (stdout). The same format is used to send messages in both directions; each message is serialized using JSON, UTF-8 encoded and is preceded with 32-bit message length in native byte order. The maximum size of a single message from the native messaging host is 1 MB, mainly to protect Microsoft Edge from misbehaving native applications. The maximum size of the message sent to the native messaging host is 4 GB.

The first argument to the native messaging host is the origin of the caller, usually chrome-extension://[ID of allowed extension]. This allows native messaging hosts to identify the source of the message when multiple extensions are specified in the allowed_origins key in the native messaging host manifest; see Step 2: Create your native messaging host manifest file, above.

On Windows, the native messaging host is also passed a command line argument with a handle to the calling Microsoft Edge native window: --parent-window=. This lets the native messaging host create native UI windows that are correctly parented. This value will be 0 if the calling context is a service worker.

When a messaging port is created by using runtime.connectNative, Microsoft Edge starts a native messaging host process and keeps it running until the port is destroyed. On the other hand, when a message is sent by using runtime.sendNativeMessage, without creating a messaging port, Microsoft Edge starts a new native messaging host process for each message. In that case, the first message that's generated by the host process is handled as a response to the original request, and Microsoft Edge will pass it to the response callback specified when runtime.sendNativeMessage is called. All other messages generated by the native messaging host in that case are ignored.

Connecting to a native application

Sending and receiving messages to and from a native application is very similar to cross-extension messaging. The main difference is that runtime.connectNative is used instead of runtime.connect, and runtime.sendNativeMessage is used instead of runtime.sendMessage.

To use these methods, the nativeMessaging permission must be declared in your extensions's manifest file; see Step 1: Add permissions to the extension manifest, above.

These methods are not available inside content scripts, only inside your extension's pages and service worker. If you want to communicate from a content script to the native application, send the message to your service worker to pass it along to the native application.

The following example creates a runtime.Port object that's connected to native messaging host com.my_company.my_application, starts listening for messages from that port and sends one outgoing message:

var port = chrome.runtime.connectNative('com.my_company.my_application');
port.onMessage.addListener(function (msg) {
  console.log('Received' + msg);
});
port.onDisconnect.addListener(function () {
  console.log('Disconnected');
});
port.postMessage({text: 'Hello, my_application'});
Use runtime.sendNativeMessage to send a message to the native application without creating a port; for example:

chrome.runtime.sendNativeMessage(
  'com.my_company.my_application',
  {text: 'Hello'},
  function (response) {
    console.log('Received ' + response);
  }
);

Ref: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/native-messaging