Darlington

Lover of fine things.

[Yomi Kazeem @TheYomiKazeem]

@DoubleEph So grateful for all the success I experienced with United in my childhood. Because only God knows if I will smell another league title with these people.

[Darlington @Dino16m]

Settling transactions should ideally be separate from checking if a user can afford a transaction.

[Darlington @Dino16m]

This doesn't scale properly when customers with large balances trigger multiple small transactions. E.g. a customer with account balance of 1m creating 100 withdrawals of 10k each.

[os @segun_os_]

i'd use a queue that guarantees message ordering, partitioned by customer ID, so the system processes at most one transaction per customer at any given time.

and, of course, i'd make the check and debit one atomic DB operation.

[TheDarkNurse🩺🇳🇬 @nr_davidolise]

Today, I will be given Reddington Hospital, Lekki, her flower.

I did my internship in this facility, and all through my stay there as an intern nurse from July 1st, 2025, to June 15th 2026, only 2 persons died while they were treated.

In this hospital, you are attended to like a king or queen!!!
The doctors and nurses are special to me.

During a C-section, the O&G surgeon, medical officer, midwife, pediatrician, peri-op nurse, circulating nurse, anesthesiologist, and anesthetics technician are all present in the OR.

During an SVD, the midwife, medical officer, and nurse are present.
You will clearly see the attention the patient is receiving.

The baby is attended to with utmost urgency.

The quality of care is superb,
The environment is so clean,
I really loved my stay in that facility.

I will recommend it to anyone, anytime, and any day.

[Darlington @Dino16m]

@Oni_Okun Are you saying that Kogi is more dense than Edo?

[Oleg @olegsvn]

@EOEboh 50m records is nothing.
Renaming is metadata operation, should not be heavy/critical. But depends on database.

[Darlington @Dino16m]

I was working on a plan with OpenCode in plan mode and it modified files in my working directory using sed. Is it supposed to do that? @thdxr

[Darlington @Dino16m]

@yewiedewie @mba_sunday

[Darlington @Dino16m]

This is a cheap shortcut to achieve the same effect as universal high quality education.

[Imago Dei @eldivine]

The day I said voting shouldn't be universal, and you need to pass a civics test people started shouting because they are so indoctrinated with one way of doing things.

But like, you need a test to get a drivers license. But you shouldn't require one to get a voter's card?

Okay then.

[Darlington @Dino16m]

Deadlocks can occur independent of transaction duration. Deadlocks are a consequence of lock based concurrency and not a good example of the effect of DB load.

[Darlington @Dino16m]

0.0.0.0 binds your application to that port on all available interfaces while 127.0.0.1 binds to just that IP address. E.g. you can bind 127.0.0.1:443 and 127.0.0.2:443 but when you bind to 0.0.0.0:443, you generally can't bind to :443 on any other IP.

[K. @kwesi_dadson]

0.0.0.0 exposes it outside the host machine. Makes it available on the same network.

If it’s in docker, other services in the same docker network can reach it now. If it’s on your local machine, other people on the network can reach it using your internal ip.

This is what I know sir.

[Black Jaguar @A_Feranmi]

Moniepoint and Chowdeck are economy transforming businesses.

Years ago, Iya Oyo would not even take bank transfers talk less of card payments. Today, they use POS.

Today, Amoke is serving more customers because of Chowdeck. Real impact!

[O @DroidPostBlog]

@seunonigbinde The reason is, historically, those who have been privileged to be given such infrastructures & institutions have weaponized it against others. Why should I continue to support that?

There's an example happening right before us

Everybody should get a piece of the same thing.

[Darlington @Dino16m]

@PrincewiIIChuka @Mrpossidez Stripe will consider this as money laundering and they will block the account.

[Darlington @Dino16m]

@abolorreeeee Here's a pull request that refactors the limit to remove lock contention. https://t.co/rdPDUuRvVg

[Darlington @Dino16m]

This is interesting, don't you think the mutex will become a bottleneck with an increased request load?

[Fathiu @abolorreeeee]

Rate Limiter in #Golang using net/http

I implemented: -

-Token bucket algorithm (https://t.co/mlIgHkf17T) each IP gets a bucket with 4 tokens, refills at 2/sec. Every request costs 1 token. No tokens? HTTP 429 until your bucket refills.

- Per-IP tracking with an in-memory map protected by sync.Mutex. Without proper locking, multiple goroutines writing to the same map will corrupt your data instantly. Learned this the hard way when -race flag lit up during testing caught 3 concurrency bugs before they hit production.

- Background goroutine runs every minute to cleanup visitors inactive for 3+ minutes. Prevents memory leaks from one-time visitors.

Next phase: Making it production ready
→ Adding context.Context for request lifecycle management
→ Integrating Redis for distributed rate limiting across multiple server instances
→ Currently single-server only, need horizontal scalability

Completed code: https://t.co/y3ABfHawKE

[Darlington @Dino16m]

@abolorreeeee You can implement it without the second go routine. I'll post a sample.

[Darlington @Dino16m]

@abolorreeeee The idea is to avoid using the shared mutex on every request, and use it only when adding a new visitor. Add a mutex to the Allow method and use that to control last seen updates. Also you don't need a second go routine, visitor#Allow should reset by calculating the last seen.

[Darlington @Dino16m]

Your intercept works because you established a TLS terminating proxy between the client and server. Client side encryption will not protect a client on a web browser since the encryption keys travel on the same network. It might help on mobile clients though.

[Ghost St Badmus @commando_skiipz]

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on.

Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly.

Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing.

That is why validation needs to be performed on both the client and the server side.

To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used.

In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers.

In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

[Darlington @Dino16m]

The point of salting is to slowdown rainbow table attacks, the salts are not secret. Bcrypt for example appends the salt to the password hash, with the hash being a random string.

[Orion Callaghan @MainMeowMix]

@EOEboh @ronnie_tech1 If you use a different salt for each password, you need to have a way to store and tie that salt to each user. Otherwise you wouldn't be able to authenticate them. How would store the salt value in a way that if an attacker gets access to your data, doesn't make it useless?