User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
How Uploadcare Built a Stack That Handles 350M File API Requests per Day
11–20 of 42 posts
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#12350M/day = just about 4K QPS. Is that considered impressive nowadays?
If it's a natural distribution the peak QPS will not be 4k QPS.
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#13User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
How so? Obviously they won’t be executing (or likely even analysing) any of the uploaded content.
Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. )
It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#14User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
How so? Obviously they won’t be executing (or likely even analysing) any of the uploaded content. Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. ) It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#15I wonder what's the breakdown between unique files delivered as opposed to files delivered from the CDN cache. Also, what's the breakdown for file uploads, manipulation and delivery? The 350M API requests per day would make more sense if we get this brakdown
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#16350M/day = just about 4K QPS. Is that considered impressive nowadays?
Impressive or not I just wish people would stop using monthly averages in the headline like this. You can't really make the case that this in-depth stack dive is for a layman audience, so you have to know what a meaningless metric it is.
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#17User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
How so? Obviously they won’t be executing (or likely even analysing) any of the uploaded content. Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. ) It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?
Image and Video codecs come under attack quite often see https://blog.sucuri.net/2016/05/imagemagick-remote-command-e...
In this context the image manipulation they do with pillow and the underlying libjpeg would be a potential source of vulnerabilities.
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#18User generated content (especially images) are a great attack vector, what do you do to isolate/mitigate against attacks like that ?.
How so? Obviously they won’t be executing (or likely even analysing) any of the uploaded content. Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. ) It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?
They say right in the article that they're doing image resizes on the server, for instance. With a customized library too...Hope it's sandboxed well!
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#19That's a great read. I've always been interested in learning how such tech-oriented companies found their initial traction. Are there any blog posts / articles / podcasts about Uploadcare's early days and the search for the product/market fit?
Re: How Uploadcare Built a Stack That Handles 350M File API Requests per Day
#20By using AWS.