Jamil Bou Kheir

former security engineer @cisco, now building @firezonehq.

[Jamil Bou Kheir @jamilbk]

sendmsg_x silently falls back to single-packet mode instead of batching when you use unconnected sockets too.

The fix is just to use a connected socket to talk to each WireGuard peer. kqueue then wakes us reliably when the socket is ready too.

[Jamil Bou Kheir @jamilbk]

Found the source of our mysterious packet loss issue on macOS and iOS: Apple's BSD sockets API fails to surface ENOBUFS for *unconnected sockets* - sockets which have no specific destination.

The datagrams (or batches in our case) are just silently dropped.

No backpressure.

[Aikido Security @AikidoSecurity]

🚨 Ongoing supply chain attack on Composer packages! We just found multiple laravel-lang/* packages compromised on Packagist (lang, http-statuses, attributes). Payload runs at autoload time. At least 50 package versions were compromised.

If you installed a compromised version, the malware already executed. Pin to a clean COMMIT (not version) and rotate secrets immediately.

If your lockfile already had an older commit from before today, you are safe. But you should not update at the moment.

[Jamil Bou Kheir @jamilbk]

I don't know who needs to hear this, but:

Replacing an explicit button or form in your app that works 100% of the time with an AI chat bot that works 50% of the time is a UX disaster.

[Jamil Bou Kheir @jamilbk]

@Jonathan_Blow Or the open source version: how dare you give it to me for free and not support my niche use cases

[Jamil Bou Kheir @jamilbk]

@PalmerLuckey The problem is we aren't the customers, the advertisers are. It funds them.

[Jamil Bou Kheir @jamilbk]

Claude for mermaid diagrams... game changer when writing PR descriptions

[Jamil Bou Kheir @jamilbk]

Attempting to generate a reliable repro for a bug in some of our open source code (not sec-related).

It's failing with:

"API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy"

@claudeai is this a known issue?

[Jamil Bou Kheir @jamilbk]

@amasad Disturbing if this is valid

[Jamil Bou Kheir @jamilbk]

@tqbf Tis our stack - no major regrets thus far!

[Jamil Bou Kheir @jamilbk]

I have to say Claude + Codex have greatly increased the amount of code I can write, but this is how writing that code now feels sometimes:

[Jamil Bou Kheir @jamilbk]

At @firezonehq we've done a TON of work recently to make Gateways more performant with lots of clients (>1000) connected.

Thanks to work by our Rust team on the STUN / TURN signaling code paths we've managed to increase client capacity more than 20x!

https://t.co/iQUyDbR8Av

[Jamil Bou Kheir @jamilbk]

Found a bug in OTP's pg module!

I believe this is the first real OTP bug I've hit in 7+ years of using Elixir/Erlang.

https://t.co/c4VQYYcrFQ

[Jamil Bou Kheir @jamilbk]

Getting tired of having to download a 200 MB app for every business I need to interact with.

How did things get this bad?

[Jamil Bou Kheir @jamilbk]

@chris_mccord Interesting! How does spinning down the old VM work? Can it migrate processes over (e.g. connected Phoenix Channels)?

We ended up doing blue - green using containers with an iptables cutover but avoiding the reconnect storm would be super nice.

[Jamil Bou Kheir @jamilbk]

Amazing how even "small" packet pacing / loss problems can tank throughput, especially with any kind of latency.

Just fixed an issue in our eventloop to more fairly process rx packets while under high tx load - a three-line change.

Got a 3-4x throughput increase on a 100ms RTT simulated link:

[Jamil Bou Kheir @jamilbk]

@mitchellh We hit crashes like these with the old Obj-C File API. Such a hassle to wrap and convert to Swift.Error.