How a Single Regex Crashed Cloudflare's Global Network for 27 Minutes in 2019

·1 views

On July 2, 2019, Cloudflare suffered a 27-minute global outage after a single regular expression drove CPU usage to nearly 100% across every edge server handling HTTP and HTTPS traffic. The culprit was a ReDoS vulnerability caused by nested quantifiers on the same character class, a pattern that forces backtracking regex engines to explore an exponentially growing number of possibilities on near-matching inputs. Just 40 specially crafted characters were enough to pin an entire CPU core, requiring no exploit chain or malicious payload. The flaw passed code review undetected because the regex compiled correctly and performed normally on standard inputs — the vulnerability is structural, not a coding error. DFA-based engines such as RE2, Go's regexp, and Rust's regex crate are immune to this class of bug as they guarantee linear-time matching, unlike Python, JavaScript, and Java engines which rely on backtracking.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Founder Shuts Down Startup Ravah Despite 100 Waitlist Signups, Shares Key Lessons

A founder has shut down Ravah, an AI content-generation startup for founders, after months of building and growing the product. Despite attracting around 100 waitlist signups — many from a Reddit post — the founder concluded that interest alone did not constitute genuine product-market fit. The scope of the product kept expanding, from content generation to campaign coordination, analytics, and integrations, but customer evidence of repeated use or willingness to pay never materialized. The founder acknowledged that technical progress, such as shipping features and improving onboarding, created a false sense of momentum while the core business question went unanswered. The key takeaway is that a waitlist validates a promise, not a product, and founders must distinguish between signals of interest and evidence of genuine, recurring need.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FastMCP lets developers build Claude-compatible AI tools in dozens of lines of Python

FastMCP is a Python library that simplifies building Model Context Protocol (MCP) servers, which allow AI models like Claude to call external tools and functions. Normally, creating an MCP server requires implementing complex low-level protocol details, but FastMCP handles that automatically when a developer marks a standard Python function with the @mcp.tool decorator. The library auto-generates the required schema by inspecting the function's argument and return types, making the process accessible to anyone with basic web development experience. A DEV Community tutorial demonstrates this by building a fortune-telling tool — named after the Japanese word for fortune-telling, 'uranai' — that Claude Code can invoke, using only a few dozen lines of code. The guide also flags a common pitfall: decorator syntax differs between the standalone fastmcp package and the official MCP Python SDK, which can cause confusing errors if code is copied between tutorials.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Founder Builds In-App Learning Tool HeyBraza to Teach Software by Doing

Timur, a solo founder from Uzbekistan, has launched HeyBraza, a tool designed to help users learn complex software such as Photoshop, video editing, and 3D modeling without leaving the application. The platform addresses a common frustration where learners watch tutorials elsewhere, return to their own screen, and still struggle to replicate the steps. HeyBraza works by letting users trigger help via a hotkey, ask a question aloud, and receive real-time visual guidance drawn directly onto their screen within the app. Unlike traditional online courses or certificates, the tool focuses on guiding users through actual workflows on their own files. HeyBraza is currently live at heybraza.com, and the founder is actively seeking user feedback to improve the product.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build GDPR-Compliant AI Agent KPI Dashboards with Metrics and Logs

Engineering guidance for gaming AI-agent admin dashboards recommends using pre-aggregated metrics for KPI charts and structured logs for incident investigation, rather than relying on a single storage system for both. Metrics suit recurring, bounded questions like p95 latency by release, while logs preserve the event-level detail needed to reconstruct why a specific game session behaved unexpectedly. Rollback safety is framed as a release requirement, meaning teams must retain the measurements that justified a change even after reverting it. For EU-based SaaS teams, the approach also addresses GDPR compliance by classifying data fields upfront — separating aggregate metrics from personally identifiable content — rather than applying privacy labels after implementation. A pre-release signal catalog defining each metric's name, unit, dimensions, freshness target, and rollback question is recommended to avoid the common mistake of adding charts simply because data is available.

0 comments Read more at DEV Community