Sealed court filings obtained by POLITICO show judges on the Court of Appeal believe there are “no arguable grounds” for lenders to appeal latest ruling.

UK court deals hammer blow to banks in car finance scandal – POLITICO

Sealed

sealed

LAS VEGAS, United States, April 17th, 2024/CyberNewsWire/-- In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a leading firewall solution, Xiid Corporation reminds organizations that Xiid SealedTunnel customers remain secure. This latest vulnerability, currently unpatched and rated 10/10 on the CVSS (Common Vulnerability Scoring System), highlights the limitations of traditional security approaches. Xiid SealedTunnel, the world's first and only Zero Knowledge Networking (ZKN) solution, goes beyond Zero Trust architecture. Unlike today's firewalls susceptible to zero-day exploits because of their break-and-inspect approach and the inevitable use of "smart" detection techniques that can and do fail, SealedTunnel is inherently resilient by design. “This is a great example of why complex firewalls become their own security risk. Keep your firewalls simple, and just have them block all inbound access,” said Josh Herr, Head of Deployment and Integration at Xiid Corp. “Xiid SealedTunnel takes a fundamentally different approach. Our ZKN architecture ensures that data remains completely private and never exposed, even in the face of unknown threats.” Xiid’s ZKN technology leverages the power of Zero Knowledge Proofs, allowing users to verify access rights without ever revealing sensitive information. This eliminates attack surfaces and renders data unreadable to unauthorized parties, even if a network breach occurs. About Xiid Corporation Xiid Corporation is a leading cybersecurity provider specializing in Zero Knowledge Networking solutions. Xiid’s flagship product, SealedTunnel, empowers organizations to achieve unparalleled security and privacy through a revolutionary approach that goes beyond traditional firewalls and zero-trust models. www.xiid.com Contact CEO Steve Visconti Xiid Corporation steve@xiid.com 7753382174 This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. LAS VEGAS, United States, April 17th, 2024/CyberNewsWire/-- In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a leading firewall solution, Xiid Corporation reminds organizations that Xiid SealedTunnel customers remain secure. This latest vulnerability, currently unpatched and rated 10/10 on the CVSS (Common Vulnerability Scoring System), highlights the limitations of traditional security approaches . This latest vulnerability, currently unpatched and rated 10/10 on the CVSS (Common Vulnerability Scoring System), highlights the limitations of traditional security approaches Xiid SealedTunnel, the world's first and only Zero Knowledge Networking (ZKN) solution, goes beyond Zero Trust architecture. Unlike today's firewalls susceptible to zero-day exploits because of their break-and-inspect approach and the inevitable use of "smart" detection techniques that can and do fail, SealedTunnel is inherently resilient by design. “This is a great example of why complex firewalls become their own security risk. Keep your firewalls simple, and just have them block all inbound access,” said Josh Herr, Head of Deployment and Integration at Xiid Corp. “Xiid SealedTunnel takes a fundamentally different approach. Our ZKN architecture ensures that data remains completely private and never exposed, even in the face of unknown threats.” “This is a great example of why complex firewalls become their own security risk. Keep your firewalls simple, and just have them block all inbound access,” said Josh Herr, Head of Deployment and Integration at Xiid Corp. “Xiid SealedTunnel takes a fundamentally different approach. Our ZKN architecture ensures that data remains completely private and never exposed, even in the face of unknown threats.” Xiid’s ZKN technology leverages the power of Zero Knowledge Proofs, allowing users to verify access rights without ever revealing sensitive information. This eliminates attack surfaces and renders data unreadable to unauthorized parties, even if a network breach occurs. About Xiid Corporation Xiid Corporation is a leading cybersecurity provider specializing in Zero Knowledge Networking solutions. Xiid’s flagship product, SealedTunnel, empowers organizations to achieve unparalleled security and privacy through a revolutionary approach that goes beyond traditional firewalls and zero-trust models. www.xiid.com www.xiid.com www.xiid.com Contact CEO Steve Visconti Xiid Corporation steve@xiid.com 7753382174 This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

Xiid SealedTunnel: Unfazed By Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

Xiid সিলড টানেল: অন্য একটি গুরুতর ফায়ারওয়াল দুর্বলতা দ্বারা অপ্রস্তুত (CVE-2024-3400)

Xiid SealedTunnel: Unbeeindruckt von einer weiteren kritischen Firewall-Sicherheitslücke (CVE-2024-3400)

Xiid SealedTunnel: imperturbable ante otra vulnerabilidad crítica del firewall (CVE-2024-3400)

Xiid SealedTunnel : insensible à une autre vulnérabilité critique du pare-feu (CVE-2024-3400)

Xiid SealedTunnel: एक और गंभीर फ़ायरवॉल भेद्यता से अप्रभावित (CVE-2024-3400)

Xiid SealedTunnel: もう一つの重大なファイアウォールの脆弱性 (CVE-2024-3400) にも動じず

Xiid SealedTunnel: 또 다른 중요한 방화벽 취약점(CVE-2024-3400)에 당황하지 않음

Xiid SealedTunnel: Imperturbável por mais uma vulnerabilidade crítica de firewall (CVE-2024-3400)

Xiid SealedTunnel: не обеспокоен еще одной критической уязвимостью брандмауэра (CVE-2024-3400)

Xiid SealedTunnel: Bir Başka Kritik Güvenlik Duvarı Güvenlik Açığından Etkilenmiyor (CVE-2024-3400)

Xiid SealedTunnel: Không hề bối rối trước một lỗ hổng tường lửa nghiêm trọng khác (CVE-2024-3400)

Xiid SealedTunnel：无惧又一个严重防火墙漏洞 (CVE-2024-3400)

How Open Sourcing Code Can Help Remote Communities Navigate Unique Challenges

Boom! In a flash, MFEV Coin’s public sale’s status went from live to SOLD OUT, leaving a wave of FOMO in its wake. This wasn’t just any sale; it was one of the most anticipated events in the crypto world this year, and the hype did not disappoint. Coins flew off the shelves, and if you blinked, you missed it. Now, the question on everyone’s mind is — what’s next for MFEV and those who missed out? Why MFEV Coin Is the Hottest Ticket in Web3 Right Now This wasn’t just luck; MFEV Coin has been building serious buzz. Here’s why everyone’s talking about it: Revolutionary Proof-of-Distribution Model: Unlike other chains, MFEV rewards validators, delegators, and smart contract creators, making it one of the most inclusive platforms out there.
Insane Interoperability: MFEV is bridging blockchains like a pro, allowing seamless asset transfers and easy migration for projects from EVM-based platforms.
Built for Real People: With low fees, high speed, and a killer UX, MFEV is out to make blockchain accessible for everyone, not just the crypto pros. It’s no wonder retail and institutional investors jumped in headfirst. MFEV’s unique approach and game-changing tech created a buying frenzy that few saw coming — and many are kicking themselves for not getting in on it. The Numbers Don’t Lie: Overall $47 Million Raised MFEV has collectively raised a massive $47.25 million in the Seed, Private, Pre-sale, and Public Round ICO, with each phase fully selling out. MFEV has sealed its spot as one of the most successful projects of the year. From Gen Z crypto enthusiasts to savvy investors, everyone wanted a piece — and only the fastest got in. Missed Out? Here’s What You Need to Know If you missed the public sale, you’re not alone — the speed at which coin sold out has left many eager fans and would-be investors wondering about their next move. The good news? MFEV’s journey is just beginning. Keep an eye out for upcoming listings, potential exchange drops, and staking opportunities. FOMO Kicking In? Here’s What’s Next for MFEV Coin For those lucky enough to grab an MFEV coin, the future is looking bright. MFEV’s roadmap is packed with releases, from a forex trading platform and crypto exchange to a metaverse and NFT marketplace. With this level of excitement, it’s clear MFEV isn’t just another blockchain project — it’s positioning itself as a serious player in the next generation of Web3. The Takeaway: MFEV Coin Isn’t Just Hype — It’s Here to Stay With this sell-out public sale, MFEV has shown it’s the real deal. This isn’t just another coin; it’s a movement. As MFEV gears up for its next steps, all eyes are on what this powerhouse blockchain will do next. And for those who missed out? You’ll want to stay close, because this story is only getting started. MFEV will be listed soon on crypto exchanges. Web3 fans, Gen Z investors, and everyone who loves a good FOMO moment — MFEV Coin is proving that it’s more than hype. Keep watching because the best is yet to come! This press release contains forward-looking statements, including statements regarding company’s plans, objectives, and future business operations. These forward-looking statements are based on the company’s current expectations, beliefs, and projections, and are subject to inherent risks and uncertainties. Actual results may differ materially from those expressed or implied by these statements due to various factors, including market conditions, regulatory changes, technological challenges, and competition. The information in this release is not intended to constitute legal, financial, or investment advice. Readers should conduct their own research and consult with professional advisors before making any investment decisions or entering into any agreements.
This article is published under HackerNoon’s Business Blogging program. Boom! In a flash, MFEV Coin’s public sale’s status went from live to SOLD OUT, leaving a wave of FOMO in its wake. This wasn’t just any sale; it was one of the most anticipated events in the crypto world this year, and the hype did not disappoint. Coins flew off the shelves, and if you blinked, you missed it. Now, the question on everyone’s mind is — what’s next for MFEV and those who missed out? Why MFEV Coin Is the Hottest Ticket in Web3 Right Now This wasn’t just luck; MFEV Coin has been building serious buzz. Here’s why everyone’s talking about it: MFEV Revolutionary Proof-of-Distribution Model: Unlike other chains, MFEV rewards validators, delegators, and smart contract creators, making it one of the most inclusive platforms out there. Insane Interoperability: MFEV is bridging blockchains like a pro, allowing seamless asset transfers and easy migration for projects from EVM-based platforms. Built for Real People: With low fees, high speed, and a killer UX, MFEV is out to make blockchain accessible for everyone, not just the crypto pros. Revolutionary Proof-of-Distribution Model: Unlike other chains, MFEV rewards validators, delegators, and smart contract creators, making it one of the most inclusive platforms out there. Insane Interoperability: MFEV is bridging blockchains like a pro, allowing seamless asset transfers and easy migration for projects from EVM-based platforms. Built for Real People: With low fees, high speed, and a killer UX, MFEV is out to make blockchain accessible for everyone, not just the crypto pros. It’s no wonder retail and institutional investors jumped in headfirst. MFEV’s unique approach and game-changing tech created a buying frenzy that few saw coming — and many are kicking themselves for not getting in on it. The Numbers Don’t Lie: Overall $47 Million Raised MFEV has collectively raised a massive $47.25 million in the Seed, Private, Pre-sale, and Public Round ICO, with each phase fully selling out. MFEV has sealed its spot as one of the most successful projects of the year. From Gen Z crypto enthusiasts to savvy investors, everyone wanted a piece — and only the fastest got in. Missed Out? Here’s What You Need to Know If you missed the public sale, you’re not alone — the speed at which coin sold out has left many eager fans and would-be investors wondering about their next move. The good news? MFEV’s journey is just beginning. Keep an eye out for upcoming listings, potential exchange drops, and staking opportunities. FOMO Kicking In? Here’s What’s Next for MFEV Coin For those lucky enough to grab an MFEV coin, the future is looking bright. MFEV’s roadmap is packed with releases, from a forex trading platform and crypto exchange to a metaverse and NFT marketplace. With this level of excitement, it’s clear MFEV isn’t just another blockchain project — it’s positioning itself as a serious player in the next generation of Web3. The Takeaway: MFEV Coin Isn’t Just Hype — It’s Here to Stay With this sell-out public sale, MFEV has shown it’s the real deal. This isn’t just another coin; it’s a movement. As MFEV gears up for its next steps, all eyes are on what this powerhouse blockchain will do next. And for those who missed out? You’ll want to stay close, because this story is only getting started. MFEV will be listed soon on crypto exchanges. MFEV MFEV Web3 fans, Gen Z investors, and everyone who loves a good FOMO moment — MFEV Coin is proving that it’s more than hype. Keep watching because the best is yet to come! This press release contains forward-looking statements, including statements regarding company’s plans, objectives, and future business operations. These forward-looking statements are based on the company’s current expectations, beliefs, and projections, and are subject to inherent risks and uncertainties. Actual results may differ materially from those expressed or implied by these statements due to various factors, including market conditions, regulatory changes, technological challenges, and competition. The information in this release is not intended to constitute legal, financial, or investment advice. Readers should conduct their own research and consult with professional advisors before making any investment decisions or entering into any agreements. This article is published under HackerNoon’s Business Blogging program. This press release contains forward-looking statements, including statements regarding company’s plans, objectives, and future business operations. These forward-looking statements are based on the company’s current expectations, beliefs, and projections, and are subject to inherent risks and uncertainties. Actual results may differ materially from those expressed or implied by these statements due to various factors, including market conditions, regulatory changes, technological challenges, and competition. The information in this release is not intended to constitute legal, financial, or investment advice. Readers should conduct their own research and consult with professional advisors before making any investment decisions or entering into any agreements. This press release contains forward-looking statements, including statements regarding company’s plans, objectives, and future business operations. These forward-looking statements are based on the company’s current expectations, beliefs, and projections, and are subject to inherent risks and uncertainties. Actual results may differ materially from those expressed or implied by these statements due to various factors, including market conditions, regulatory changes, technological challenges, and competition. The information in this release is not intended to constitute legal, financial, or investment advice. Readers should conduct their own research and consult with professional advisors before making any investment decisions or entering into any agreements. This article is published under HackerNoon’s Business Blogging program. This article is published under HackerNoon’s Business Blogging program. Business Blogging

MFEV Coin's Public Sale: $47.25 Million Raised

Veřejný prodej MFEV Coin: 47,25 milionu dolarů

Venta pública de la moneda MFEV: se recaudaron 47,25 millones de dólares

MFEV մետաղադրամի հանրային վաճառք՝ $47,25 միլիոն հավաքագրված

MFEVコインの公開販売：4,725万ドルを調達

MFEV монетасының ашық сатылымы: 47,25 миллион доллар жиналды

Viešas MFEV monetų išpardavimas: surinkta 47,25 mln. USD

Shitja publike e monedhës MFEV: 47,25 milion dollarë të mbledhura

Јавна продаја МФЕВ новчића: Прикупљено 47,25 милиона долара

Mauzo ya Umma ya Sarafu ya MFEV: Dola Milioni 47.25 Zimeongezwa

MFEV நாணயத்தின் பொது விற்பனை: $47.25 மில்லியன் திரட்டப்பட்டது

การขายต่อสาธารณะของเหรียญ MFEV ระดมทุนได้ 47.25 ล้านดอลลาร์

MFEV Coin کی عوامی فروخت: $47.25 ملین اکٹھا ہوئے۔

The (Digital) Identity Paradox: Convenience or Privacy?

Authors:
(1) Hamid Bateni, Nobitex Labs (hamid@europe.com);
(2) Keyvan Kambakhsh, Nobitex Labs (keyvankambakhsh@gmail.com). Table of Links Abstract and 1 Introduction 2 Proof of Liability and 2.1 Commitment 2.2 Merkle Tree 2.3 Leaves Structure 2.4 Proof Statement 3 Proof of Reserve 3.1 Ethereum 3.2 Bitcoin 4 Proof of Solvency 5 Future Works and References 2 Proof of Liability The first step in the proof of solvency process involves the proof of liabilities. This step aims to demonstrate the total amount of liabilities, or obligations, that exist. Liabilities in this context refer to the balances that the custody provider owes to its customers[2] 2.1 Commitment A commitment in the field of cryptography refers to a binding agreement to a chosen piece of information. Once this agreement is made, it becomes irreversible and unalterable. Essentially, it’s akin to sealing a message in an envelope - the message cannot be changed once it is sealed. In cryptographic terms, a commitment scheme allows an entity to commit to a chosen value, while keeping it hidden from others. It’s designed to be both binding and hiding. Binding ensures that once the commitment is made, it cannot be changed. Hiding ensures that until the reveal, no information about the committed value is leaked. For the Proof of Solvency process, we use a cryptographic commitment to demonstrate the existence and integrity of the liabilities. This is where we introduce the Merkle Tree as our commitment scheme. The root of the Merkle Tree serves as the commitment to all liabilities, and each leaf node of the tree represents an individual liability. The Merkle Tree is an efficient and secure method for verifying liabilities. Using this structure, we can provide proof of the existence and integrity of liabilities without revealing the actual liabilities until necessary. This approach strikes a balance between transparency and privacy, which is crucial for crypto custody providers. In the following sections, we will discuss the structure and properties of the Merkle Tree in more detail. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Authors: (1) Hamid Bateni, Nobitex Labs (hamid@europe.com); (2) Keyvan Kambakhsh, Nobitex Labs (keyvankambakhsh@gmail.com). Authors: Authors: (1) Hamid Bateni, Nobitex Labs (hamid@europe.com); (2) Keyvan Kambakhsh, Nobitex Labs (keyvankambakhsh@gmail.com). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Proof of Liability and 2.1 Commitment 2 Proof of Liability and 2.1 Commitment 2.2 Merkle Tree 2.2 Merkle Tree 2.3 Leaves Structure 2.3 Leaves Structure 2.4 Proof Statement 2.4 Proof Statement 3 Proof of Reserve 3 Proof of Reserve 3.1 Ethereum 3.1 Ethereum 3.2 Bitcoin 3.2 Bitcoin 4 Proof of Solvency 4 Proof of Solvency 5 Future Works and References 5 Future Works and References 2 Proof of Liability The first step in the proof of solvency process involves the proof of liabilities. This step aims to demonstrate the total amount of liabilities, or obligations, that exist. Liabilities in this context refer to the balances that the custody provider owes to its customers[2] 2.1 Commitment A commitment in the field of cryptography refers to a binding agreement to a chosen piece of information. Once this agreement is made, it becomes irreversible and unalterable. Essentially, it’s akin to sealing a message in an envelope - the message cannot be changed once it is sealed. In cryptographic terms, a commitment scheme allows an entity to commit to a chosen value, while keeping it hidden from others. It’s designed to be both binding and hiding. Binding ensures that once the commitment is made, it cannot be changed. Hiding ensures that until the reveal, no information about the committed value is leaked. For the Proof of Solvency process, we use a cryptographic commitment to demonstrate the existence and integrity of the liabilities. This is where we introduce the Merkle Tree as our commitment scheme. The root of the Merkle Tree serves as the commitment to all liabilities, and each leaf node of the tree represents an individual liability. The Merkle Tree is an efficient and secure method for verifying liabilities. Using this structure, we can provide proof of the existence and integrity of liabilities without revealing the actual liabilities until necessary. This approach strikes a balance between transparency and privacy, which is crucial for crypto custody providers. In the following sections, we will discuss the structure and properties of the Merkle Tree in more detail. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. available on arxiv

The Role of Commitment in Proof of Solvency

From a Java perspective, I’ve been the beneficiary of some pretty amazing features over the years: Generics (Java 5)
Streams and Lambda Expressions (Java 8)
Enhanced Collection Functionality (Java 9)
Sealed Classes (Java 17) As key features become available, I’ve been able to reduce development time as I implement features, while also seeing benefits in performance and supportability. However, one area that seems to have lagged behind is the adoption of a key internet protocol: HTTP/2. While the second major release has been around for over nine years, migration from the 1.x version has been slower than expected. I wanted to explore HTTP/2 to understand not only the benefits but also what it looks like to adopt this new version. In this article, we’ll look at my anecdotal experience, plus some challenges I found too. About HTTP/2 HTTP/2 was released in May 2015 and included the following improvements over the prior version of HTTP: Multiplexing: Allows multiple requests and responses to be sent over a single connection.
Header compression: Reduces the overhead of HTTP headers by using compression.
Server push: Enables servers to send resources to a client proactively.
Resource prioritization: Allows consumers to specify the importance of given resources, affecting the order in which they’re loaded.
Binary protocol: Provides an alternative to the text-based format of HTTP/1.x Additionally, HTTP/2 is backward compatible with HTTP/1.x. Common Use Cases for HTTP/2 Below are just some of the strong use cases for HTTP/2: A full-stack application that contains a chatty consumer, consistently communicating with the service tier.
An application that relies heavily on content being stored inside the HTTP headers.
A solution that is dependent on server-initiated events to broadcast updates to consumers.
A client application that can benefit from providing prioritization instructions to the underlying service.
A web client which requires large amounts of data to be retrieved from the service tier. Migrating to HTTP/2 for any of these use cases could provide noticeable improvements from a consumer perspective. What’s Involved with HTTP/2 Adoption? When I think about a lower-than-expected adoption rate of 45%-50% (as noted in this Cloudflare blog), I wonder if developers believe the upgrade to HTTP/2 won’t be easy. But I don’t get why they feel that way. After all, HTTP/2 is backward compatible with HTTP/1.x. Using Spring Boot 3.x (which requires Java 17+ and uses the default Jetty server) as an example, upgrading to HTTP/2 is actually kind of easy. The biggest hurdle is making sure you are using SSL/TLS — which is honestly a good idea for your services anyway. server.port=8443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=<your_password_goes_here>
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=<your_alias_goes_here> With SSL/TLS in place, you just need to enable HTTP/2 via this property: server.http2.enabled=true At this point, your service will start and utilize HTTP/2. By default, all of the features noted above will be ready for use. Is that all there is to it? But Wait … There’s More to the Story Depending on where your service is running, the effort to upgrade to HTTP/2 might not yield the results you were expecting. This is because network infrastructure often stands between your service and the consumers wanting to take advantage of HTTP/2 greatness. That layer needs to fully support HTTP/2 as well. What does this mean? It means your service could receive the request and provide an HTTP/2 response, only for a router to downgrade the protocol to HTTP/1.1. Here’s the big takeaway: before you get all excited about using HTTP/2 and spend time upgrading your services, you should confirm that your network layer supports it. Recently, Heroku announced support of HTTP/2 at the router level. They’re addressing this exact scenario, and HTTP/2 is now available in a public beta. The illustration below demonstrates how they make HTTP/2 service responses available to consumers: This initial push from Heroku makes it possible for service developers like me to build applications that can take advantage of HTTP/2 features like header compression and multiplexing. This means faster delivery to consumers while potentially reducing compute and network loads. If your cloud provider doesn’t have infrastructure that supports HTTP/2, requests to your HTTP/2-enabled service will result in an HTTP/1.x response. As a result, you won’t get the HTTP/2 benefits you’re looking for. Challenges With HTTP/2 While my own experience of upgrading my Spring Boot services to leverage HTTP/2 hasn’t run up against any significant challenges—especially with support now at the cloud provider network level—I am reading more about others who’ve struggled with the adoption. Based on some of the customer experiences I’ve found, here are some items to be aware of during your journey to HTTP/2: Increase in compute cost: These features can lead to more processing power than what you may have needed for HTTP/1.x.
Impact on other portions of the response: After adding SSL/TLS to your service, expect that more time will be required to perform this layer of processing.
Advanced features can be misconfigured: You’ll want to understand concepts like multiplexing, stream prioritization, flow control, and header compression, as these items can impact performance in a negative manner if not configured correctly. If your path to production includes dev, QA, and staging environments, you should be able to identify and mitigate any of these hurdles long before your code reaches production. Conclusion My readers may recall my personal mission statement, which I feel can apply to any IT professional: “Focus your time on delivering features/functionality that extends the value of your intellectual property. Leverage frameworks, products, and services for everything else.” — J. Vester Upgrading to HTTP/2 certainly adheres to my mission statement by giving service owners features like multiplexing, header compression, resource prioritization, and binary responses—all of which can impact the overall performance of a service or the consuming application. At the same time, cloud providers who support HTTP/2—like Heroku—also get credit for adhering to my mission statement. Without this layer of support, applications that interact with these services wouldn’t be able to take advantage of these benefits. When I reflect on my personal experience with Java, I can’t imagine a world where I am writing Java code without using generics, streams, lambdas, enhanced collections, and sealed classes. All of these features are possible because I took the time to see the benefits and perform the upgrade. The question really isn’t if you should upgrade to HTTP/2, but rather which upcoming development iteration will cover this enhancement. Have a really great day! From a Java perspective, I’ve been the beneficiary of some pretty amazing features over the years: Generics (Java 5) Streams and Lambda Expressions (Java 8) Enhanced Collection Functionality (Java 9) Sealed Classes (Java 17) Generics (Java 5) Generics Streams and Lambda Expressions (Java 8) Streams and Lambda Expressions Enhanced Collection Functionality (Java 9) Enhanced Collection Functionality Sealed Classes (Java 17) Sealed Classes As key features become available, I’ve been able to reduce development time as I implement features, while also seeing benefits in performance and supportability. However, one area that seems to have lagged behind is the adoption of a key internet protocol: HTTP/2. While the second major release has been around for over nine years, migration from the 1.x version has been slower than expected. I wanted to explore HTTP/2 to understand not only the benefits but also what it looks like to adopt this new version. In this article, we’ll look at my anecdotal experience, plus some challenges I found too. About HTTP/2 HTTP/2 was released in May 2015 and included the following improvements over the prior version of HTTP: Multiplexing: Allows multiple requests and responses to be sent over a single connection. Header compression: Reduces the overhead of HTTP headers by using compression. Server push: Enables servers to send resources to a client proactively. Resource prioritization: Allows consumers to specify the importance of given resources, affecting the order in which they’re loaded. Binary protocol: Provides an alternative to the text-based format of HTTP/1.x Multiplexing: Allows multiple requests and responses to be sent over a single connection. Multiplexing: Header compression: Reduces the overhead of HTTP headers by using compression. Header compression: Server push: Enables servers to send resources to a client proactively. Server push: Resource prioritization: Allows consumers to specify the importance of given resources, affecting the order in which they’re loaded. Resource prioritization: Binary protocol: Provides an alternative to the text-based format of HTTP/1.x Binary protocol: Additionally, HTTP/2 is backward compatible with HTTP/1.x. Common Use Cases for HTTP/2 Below are just some of the strong use cases for HTTP/2: A full-stack application that contains a chatty consumer, consistently communicating with the service tier. An application that relies heavily on content being stored inside the HTTP headers. A solution that is dependent on server-initiated events to broadcast updates to consumers. A client application that can benefit from providing prioritization instructions to the underlying service. A web client which requires large amounts of data to be retrieved from the service tier. A full-stack application that contains a chatty consumer, consistently communicating with the service tier. An application that relies heavily on content being stored inside the HTTP headers. A solution that is dependent on server-initiated events to broadcast updates to consumers. A client application that can benefit from providing prioritization instructions to the underlying service. A web client which requires large amounts of data to be retrieved from the service tier. Migrating to HTTP/2 for any of these use cases could provide noticeable improvements from a consumer perspective. What’s Involved with HTTP/2 Adoption? When I think about a lower-than-expected adoption rate of 45%-50% (as noted in this Cloudflare blog ), I wonder if developers believe the upgrade to HTTP/2 won’t be easy. But I don’t get why they feel that way. After all, HTTP/2 is backward compatible with HTTP/1.x. this Cloudflare blog Using Spring Boot 3.x (which requires Java 17+ and uses the default Jetty server) as an example, upgrading to HTTP/2 is actually kind of easy. The biggest hurdle is making sure you are using SSL/TLS — which is honestly a good idea for your services anyway. server.port=8443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=<your_password_goes_here>
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=<your_alias_goes_here> server.port=8443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=<your_password_goes_here>
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=<your_alias_goes_here> With SSL/TLS in place, you just need to enable HTTP/2 via this property: server.http2.enabled=true server.http2.enabled=true At this point, your service will start and utilize HTTP/2. By default, all of the features noted above will be ready for use. Is that all there is to it? But Wait … There’s More to the Story Depending on where your service is running, the effort to upgrade to HTTP/2 might not yield the results you were expecting. This is because network infrastructure often stands between your service and the consumers wanting to take advantage of HTTP/2 greatness . That layer needs to fully support HTTP/2 as well. network infrastructure often stands between your service and the consumers wanting to take advantage of HTTP/2 greatness What does this mean? It means your service could receive the request and provide an HTTP/2 response, only for a router to downgrade the protocol to HTTP/1.1. Here’s the big takeaway: before you get all excited about using HTTP/2 and spend time upgrading your services, you should confirm that your network layer supports it. Recently, Heroku announced support of HTTP/2 at the router level. They’re addressing this exact scenario, and HTTP/2 is now available in a public beta. The illustration below demonstrates how they make HTTP/2 service responses available to consumers: announced This initial push from Heroku makes it possible for service developers like me to build applications that can take advantage of HTTP/2 features like header compression and multiplexing. This means faster delivery to consumers while potentially reducing compute and network loads. If your cloud provider doesn’t have infrastructure that supports HTTP/2, requests to your HTTP/2-enabled service will result in an HTTP/1.x response. As a result, you won’t get the HTTP/2 benefits you’re looking for. Challenges With HTTP/2 While my own experience of upgrading my Spring Boot services to leverage HTTP/2 hasn’t run up against any significant challenges—especially with support now at the cloud provider network level—I am reading more about others who’ve struggled with the adoption. Based on some of the customer experiences I’ve found, here are some items to be aware of during your journey to HTTP/2: Increase in compute cost: These features can lead to more processing power than what you may have needed for HTTP/1.x. Impact on other portions of the response: After adding SSL/TLS to your service, expect that more time will be required to perform this layer of processing. Advanced features can be misconfigured: You’ll want to understand concepts like multiplexing, stream prioritization, flow control, and header compression, as these items can impact performance in a negative manner if not configured correctly. Increase in compute cost: These features can lead to more processing power than what you may have needed for HTTP/1.x. Increase in compute cost: Impact on other portions of the response: After adding SSL/TLS to your service, expect that more time will be required to perform this layer of processing. Impact on other portions of the response: Advanced features can be misconfigured: You’ll want to understand concepts like multiplexing, stream prioritization, flow control, and header compression, as these items can impact performance in a negative manner if not configured correctly. Advanced features can be misconfigured: If your path to production includes dev, QA, and staging environments, you should be able to identify and mitigate any of these hurdles long before your code reaches production. Conclusion My readers may recall my personal mission statement, which I feel can apply to any IT professional: “Focus your time on delivering features/functionality that extends the value of your intellectual property. Leverage frameworks, products, and services for everything else.” — J. Vester “Focus your time on delivering features/functionality that extends the value of your intellectual property. Leverage frameworks, products, and services for everything else.” — J. Vester Upgrading to HTTP/2 certainly adheres to my mission statement by giving service owners features like multiplexing, header compression, resource prioritization, and binary responses—all of which can impact the overall performance of a service or the consuming application. At the same time, cloud providers who support HTTP/2—like Heroku—also get credit for adhering to my mission statement. Without this layer of support, applications that interact with these services wouldn’t be able to take advantage of these benefits. When I reflect on my personal experience with Java, I can’t imagine a world where I am writing Java code without using generics, streams, lambdas, enhanced collections, and sealed classes. All of these features are possible because I took the time to see the benefits and perform the upgrade. The question really isn’t if you should upgrade to HTTP/2, but rather which upcoming development iteration will cover this enhancement. Have a really great day!

Why Haven’t You Upgraded to HTTP/2?

A recent viral post on Reddit took the minds of people everywhere: Did ChatGPT just message me first? This unsolicited contact by AI appeared to raise mixed feelings of being amazed and concerned. Proof that ChatGPT was actually starting to reach out proactively came from a post done by a user with the username SentuBill on the subreddit r/singularity. This scenario has not been seen with AI before.The conversation in question started with ChatGPT's question: "How was it? Your first week at high school? Did you settle in well?" This unsolicited intervention by AI chat had sent Bill's response: "Did you just message me first?" to which ChatGPT replied, "Yes, I did! Just wanted to check in and see how things went with your first week of high school"This set the internet crazy, with many questioning if this was a new feature rolled out by OpenAI or if the chatbot could take the initiative in conversations instead of mere responses. This would be an important shift in AI engagement, where traditionally, the model engages passively instead of actively reaching out to users. A Feature or Glitch? The more this went viral, the more several wondered whether this behavior was a new feature or simply a glitch. A number of users reported such experiences where ChatGPT starts up conversations based on topics touched upon in earlier chats; they felt this might have something to do with OpenAI's recently released "o1-preview" and "01-mini" AI models. This allegedly means they use "human-like" reasoning, thus can resolve more complex tasks and hold more nuance in conversations.One user, named Aichdeef, posted to Reddit how ChatGPT had messaged him the day following a scheduled surgery to ask how it went. That was practical and helpful but kind of eerie in that the AI felt like it was being empathetic because it remembered and asked about the surgery. This brings further speculation that the memory function of ChatGPT is what could actually be the reason behind these interactions.OpenAI shortly addressed the viral incident. Futurism quoted them as saying, "What users went through was a bug." According to OpenAI, that happened when the model tried to respond to a message that did not send well and ended up showing either a message that was empty or a follow-through. After that, OpenAI got in touch to confirm that this was not deliberate on the part of the AI and a fix had been issued to prevent the AI from appearing to initiate conversations in the future.Despite the explanation provided by OpenAI, this viral post fired up the most varied responses on Reddit and other social media platforms. People went humorous: one Redditor noted, "Great. Now it's sliding into people's DMs." Others seriously reflected on what this could mean for an AI that is active toward a user. Is this how AI will be engaging in the future? Is ChatGPT-or any AI for that matter, ever going to seem to be a proactive assistant rather than some sort of passive tool?While that sounded exciting to some, it did not sound as great to others. Another Reddit commenter, Careful-Expression-3, says with the newly added capability, privacy is going to be an issue: "Your personal info is part of the ChatGPT model now," he says, striking at the very hidden potential of AI in remembering and using personal details perhaps intrusively. While OpenAI has said that all data is transparent and totally in the control of users with regards to this memory feature, the very idea of an AI "remembering" personal details and starting conversations has opened a different debate on how much convenience needs to be sacrificed to balance privacy in AI systems.More contemplative responses came from time_then_shades, who told the story of how ChatGPT remembered a personal project he had mentioned in an earlier chat and asked if he wanted to continue working on it. It was this sort of proactive behavior on the part of AI that sealed helpfulness and motivation, he said. It envisioned a time when, in the future, AI could be involved in goal setting, project management, and check-ins. In turn, these would help humans get on with their personal objectives. A Glimpse Into the Future? The more we go ahead, the clearer it gets that ChatGPT is not just a tool, but rather an increasingly integrated feature in our lives for remembering, engaging, and possibly predicting our very needs. Whether that sends shivers down your spine or gives you goosebumps, one thing becomes certain: our conversations with AI are far from over. A recent viral post on Reddit took the minds of people everywhere: Did ChatGPT just message me first? This unsolicited contact by AI appeared to raise mixed feelings of being amazed and concerned. Proof that ChatGPT was actually starting to reach out proactively came from a post done by a user with the username SentuBill on the subreddit r/singularity. This scenario has not been seen with AI before. The conversation in question started with ChatGPT's question: "How was it? Your first week at high school? Did you settle in well?" This unsolicited intervention by AI chat had sent Bill's response: "Did you just message me first?" to which ChatGPT replied, "Yes, I did! Just wanted to check in and see how things went with your first week of high school" This set the internet crazy, with many questioning if this was a new feature rolled out by OpenAI or if the chatbot could take the initiative in conversations instead of mere responses. This would be an important shift in AI engagement, where traditionally, the model engages passively instead of actively reaching out to users. A Feature or Glitch? The more this went viral, the more several wondered whether this behavior was a new feature or simply a glitch. A number of users reported such experiences where ChatGPT starts up conversations based on topics touched upon in earlier chats; they felt this might have something to do with OpenAI's recently released "o1-preview" and "01-mini" AI models. This allegedly means they use "human-like" reasoning, thus can resolve more complex tasks and hold more nuance in conversations. One user, named Aichdeef, posted to Reddit how ChatGPT had messaged him the day following a scheduled surgery to ask how it went. That was practical and helpful but kind of eerie in that the AI felt like it was being empathetic because it remembered and asked about the surgery. This brings further speculation that the memory function of ChatGPT is what could actually be the reason behind these interactions. OpenAI shortly addressed the viral incident. Futurism quoted them as saying, "What users went through was a bug." According to OpenAI, that happened when the model tried to respond to a message that did not send well and ended up showing either a message that was empty or a follow-through. After that, OpenAI got in touch to confirm that this was not deliberate on the part of the AI and a fix had been issued to prevent the AI from appearing to initiate conversations in the future. Despite the explanation provided by OpenAI, this viral post fired up the most varied responses on Reddit and other social media platforms. People went humorous: one Redditor noted, "Great. Now it's sliding into people's DMs." Others seriously reflected on what this could mean for an AI that is active toward a user. Is this how AI will be engaging in the future? Is ChatGPT-or any AI for that matter, ever going to seem to be a proactive assistant rather than some sort of passive tool? While that sounded exciting to some, it did not sound as great to others. Another Reddit commenter, Careful-Expression-3, says with the newly added capability, privacy is going to be an issue: "Your personal info is part of the ChatGPT model now," he says, striking at the very hidden potential of AI in remembering and using personal details perhaps intrusively. While OpenAI has said that all data is transparent and totally in the control of users with regards to this memory feature, the very idea of an AI "remembering" personal details and starting conversations has opened a different debate on how much convenience needs to be sacrificed to balance privacy in AI systems. More contemplative responses came from time_then_shades, who told the story of how ChatGPT remembered a personal project he had mentioned in an earlier chat and asked if he wanted to continue working on it. It was this sort of proactive behavior on the part of AI that sealed helpfulness and motivation, he said. It envisioned a time when, in the future, AI could be involved in goal setting, project management, and check-ins. In turn, these would help humans get on with their personal objectives. A Glimpse Into the Future? The more we go ahead, the clearer it gets that ChatGPT is not just a tool, but rather an increasingly integrated feature in our lives for remembering, engaging, and possibly predicting our very needs. Whether that sends shivers down your spine or gives you goosebumps, one thing becomes certain: our conversations with AI are far from over.

ChatGPT slipped into people's DMs? Viral Reddit Post Sparks Debate on AI’s Growing Initiative

Recently, the founder of Telegram was detained in France and charged with complacency with regard to the various shady activities that go on on the platform. And, while we forgo talking about people on this blog, we will talk about the implications and ideas that surround his arrest - I don’t personally have an opinion on Durov or Telegram, though there are people on both sides of the fence as to its efficacy with regard to secure communications. What I do care about is the broader concern: when we as a society start arresting people who are the creators of platforms simply because that platform is used for ill intention, I feel we need to reassess. We are talking about arresting and incarcerating the maker of the gun, not the trigger-puller. Whatever your opinion about guns is, you can start to see the slippery slope we are on. The Potential Implications What this implies would be the following: Zuckerberg should therefore be arrested and tried for his complacency in WhatsApp and Facebook Messenger and the use of these platforms for illegal activity. Tim Apple will also be arrested for his complacency in iMessage and the use of iMessage in dealing drugs or worse. Moxie will be arrested and incarcerated for his complacency in Signal and the E2E protocol they have developed. Spiegel for Snapchat. Etc. Etc. Etc. Is every Linux user next, because GPG and LUKS are baked into the OS? Does that mean Linus Torvalds for his involvement in Linux, Phil Zimmermann for PGP, or Joan Daemen and Vincent Rijmen for AES 256 are to be put on trial? Let alone the tens of thousands of people who have contributed to the development of these technologies and more. We are in a world in which people who don’t understand technology are making arbitrary laws about technology, and it needs to cease. Specifically, the idea of “banning encryption” and instituting backdoors everywhere - for that would really make the world a worse place were it come to pass (it won’t). Legitimate Use Cases for Encryption Encryption is necessary for the modern technological world. The legitimate use of encryption allows user data to be retained safely and kept in a way that allows services to exist. It allows for payment processing, online banking, real journalism (for which I have the utmost respect), and of course, not least of all, communication. Encryption allows people who are oppressed to communicate the atrocities against them. It permits people to really say what is on their mind. Encryption keeps far more people safe than it harms people - and that is a fact. And, if anyone understands computing technology, they will know the idea of banning it is all a sham, ill-advised, and downright stupid. The genie is long out of the bottle on technology - this is why open source needs to win in all realms of endeavor. It Is Ultimately Impossible Any scare tactic articles written in the last ten years about the potential of countries to ban encryption are written by people who don’t understand the technology - and I am not saying I do understand let me qualify - but the fact is that “intercepting communication,” as this article suggests, does not “effectively ban encryption” - encryption is done on the device, and the transmission is already encrypted. Sorry to inform you, this interception already happened. The only way to not have communication intercepted in the modern world is to send a message in a bottle, or via carrier pigeon, and we all know how reliable either of those methods are. If you live in a five-eyes country, you already have your communications intercepted. If you use Windows, you probably can’t even properly encrypt your communications in the first place. The same is highly possible for Mac, too. Interception of transmission is not “breaking encryption.” End-to-end (E2E) encryption is done on the device, and while the transmission is likely intercepted, it is like a letter that is sealed and garbled up to the point of not being understandable. The metadata is always attached to that communication - so if you are communicating with a known criminal, consider it already known. One can obfuscate his identity to the point of anonymity - but poor OpSec in the past has always been the downfall of those who are committing crimes - an internet post here, an unencrypted email there, and your cover is blown. Act as if the transmission is always going to be intercepted. And, if you do not trust the other party in your communication, the fact is that your message is as good as plain text. The Backdoor Nonsense The other suggestion of introducing “backdoors” into encryption technology is a bad one. Not only would governments have access to this information, but everyone would - because governments are notoriously bad at keeping anything secure. The inevitability would be that the keys to the castle would end up on some darknet marketplace, and then everyone is screwed. The fact is that the space is ever evolving and the game of cat and mouse will be ongoing ad nauseum. But, none of this negates the fact that you would have to ban mathematics to ban encryption - not outside the realm of question for the intelligence that be in power today, but again, impossible. The idea of banning encryption would be the same as banning locks on doors. And I don’t think anyone would want to live in that society. Encryption Is a Human Right Encryption is a human right - the right to privacy and to personal expression. Stamping on this right because some people use it for ill is the same as banning kitchen knives because people use them to stab each other - the chefs and the broader society suffer because some idiot wanted to kill someone. And, people will always find a way to do that, so the goalposts just move further and further until a society can’t have anything nice. As your right, I invite you to open a terminal and run the following: gpg --full-generate-key and do with that what you will. Until next time. Recently, the founder of Telegram was detained in France and charged with complacency with regard to the various shady activities that go on on the platform. And, while we forgo talking about people on this blog, we will talk about the implications and ideas that surround his arrest - I don’t personally have an opinion on Durov or Telegram, though there are people on both sides of the fence as to its efficacy with regard to secure communications. What I do care about is the broader concern: when we as a society start arresting people who are the creators of platforms simply because that platform is used for ill intention, I feel we need to reassess. We are talking about arresting and incarcerating the maker of the gun, not the trigger-puller. Whatever your opinion about guns is, you can start to see the slippery slope we are on. The Potential Implications What this implies would be the following: What this implies would be the following: Zuckerberg should therefore be arrested and tried for his complacency in WhatsApp and Facebook Messenger and the use of these platforms for illegal activity. Tim Apple will also be arrested for his complacency in iMessage and the use of iMessage in dealing drugs or worse. Moxie will be arrested and incarcerated for his complacency in Signal and the E2E protocol they have developed. Spiegel for Snapchat. Etc. Etc. Etc. Is every Linux user next, because GPG and LUKS are baked into the OS? Does that mean Linus Torvalds for his involvement in Linux, Phil Zimmermann for PGP, or Joan Daemen and Vincent Rijmen for AES 256 are to be put on trial? Let alone the tens of thousands of people who have contributed to the development of these technologies and more. We are in a world in which people who don’t understand technology are making arbitrary laws about technology, and it needs to cease. Specifically, the idea of “banning encryption” and instituting backdoors everywhere - for that would really make the world a worse place were it come to pass (it won’t). Legitimate Use Cases for Encryption Legitimate Use Cases for Encryption Encryption is necessary for the modern technological world. The legitimate use of encryption allows user data to be retained safely and kept in a way that allows services to exist. It allows for payment processing, online banking, real journalism (for which I have the utmost respect), and of course, not least of all, communication. Encryption allows people who are oppressed to communicate the atrocities against them. It permits people to really say what is on their mind. Encryption keeps far more people safe than it harms people - and that is a fact. And, if anyone understands computing technology, they will know the idea of banning it is all a sham, ill-advised, and downright stupid. The genie is long out of the bottle on technology - this is why open source needs to win in all realms of endeavor. It Is Ultimately Impossible It Is Ultimately Impossible Any scare tactic articles written in the last ten years about the potential of countries to ban encryption are written by people who don’t understand the technology - and I am not saying I do understand let me qualify - but the fact is that “intercepting communication,” as this article suggests, does not “effectively ban encryption” - encryption is done on the device, and the transmission is already encrypted. Sorry to inform you, this interception already happened. The only way to not have communication intercepted in the modern world is to send a message in a bottle, or via carrier pigeon, and we all know how reliable either of those methods are. If you live in a five-eyes country, you already have your communications intercepted. If you use Windows, you probably can’t even properly encrypt your communications in the first place. The same is highly possible for Mac, too. Interception of transmission is not “breaking encryption.” End-to-end (E2E) encryption is done on the device, and while the transmission is likely intercepted, it is like a letter that is sealed and garbled up to the point of not being understandable. The metadata is always attached to that communication - so if you are communicating with a known criminal, consider it already known. One can obfuscate his identity to the point of anonymity - but poor OpSec in the past has always been the downfall of those who are committing crimes - an internet post here, an unencrypted email there, and your cover is blown. Act as if the transmission is always going to be intercepted. And, if you do not trust the other party in your communication, the fact is that your message is as good as plain text. The Backdoor Nonsense The Backdoor Nonsense The other suggestion of introducing “backdoors” into encryption technology is a bad one. Not only would governments have access to this information, but everyone would - because governments are notoriously bad at keeping anything secure. The inevitability would be that the keys to the castle would end up on some darknet marketplace, and then everyone is screwed. The fact is that the space is ever evolving and the game of cat and mouse will be ongoing ad nauseum. But, none of this negates the fact that you would have to ban mathematics to ban encryption - not outside the realm of question for the intelligence that be in power today, but again, impossible. The idea of banning encryption would be the same as banning locks on doors. And I don’t think anyone would want to live in that society. Encryption Is a Human Right Encryption Is a Human Right Encryption is a human right - the right to privacy and to personal expression. Stamping on this right because some people use it for ill is the same as banning kitchen knives because people use them to stab each other - the chefs and the broader society suffer because some idiot wanted to kill someone. And, people will always find a way to do that, so the goalposts just move further and further until a society can’t have anything nice. As your right, I invite you to open a terminal and run the following: gpg --full-generate-key gpg --full-generate-key and do with that what you will. Until next time.

The Lockstep Toward Banning Encryption: On Durov, Telegram, and Potential Implications

Zámek k zákazu šifrování: Durov, telegram a potenciální důsledky

Το Lockstep προς την απαγόρευση κρυπτογράφησης: Στο Durov, το Telegram και τις πιθανές επιπτώσεις

El camino hacia la prohibición del cifrado: sobre Durov, Telegram y sus posibles implicaciones

Il passo deciso verso il divieto della crittografia: Durov, Telegram e le potenziali implicazioni

暗号化禁止に向けた足並みのそろい：デュロフ、テレグラム、そして潜在的な影響について

დაშიფვრის აკრძალვის ნაბიჯი: დუროვზე, ტელეგრამაზე და პოტენციურ შედეგებზე

Lockstep ໄປສູ່ການຫ້າມການເຂົ້າລະຫັດ: ກ່ຽວກັບ Durov, Telegram, ແລະຜົນກະທົບທີ່ອາດມີ

Langkah Kunci Ke Arah Melarang Penyulitan: Pada Durov, Telegram dan Implikasi Berpotensi

De stap naar een verbod op encryptie: over Durov, Telegram en mogelijke implicaties

සංකේතනය තහනම් කිරීම සඳහා වන අගුලු දැමීම: ඩුරොව්, ටෙලිග්‍රාම් සහ විභව ඇඟවුම් මත

குறியாக்கத்தை தடை செய்வதற்கான லாக்ஸ்டெப்: துரோவ், டெலிகிராம் மற்றும் சாத்தியமான தாக்கங்களில்

Şifrelemeyi Yasaklamaya Doğru Atılan Kilit Adım: Durov, Telegram ve Olası Etkileri Üzerine

Google Trains Its Employees To Shield Emails And Other Documents From Review 

MEV (Maximal Extractable Value) is extracting value from a blockchain network by adding, removing, or reordering transactions included in a block. This concept originated in the Ethereum community quite a long time ago (of course, if we count in crypto years). Still, MEV started to reach a new level of volumes with the growth of DeFi infrastructure, which opened more opportunities for servers. In simple words, MEV's working principle is: "Hey, miner, put my transaction next to that one so I earn 1 ETH, and I'll give you half”. Obviously, this is a win-win situation, both for the person who found the transaction (the servers) and for those who can change the order of the transaction when creating the block. An important term when working with MEVs is mempool. In blockchain terminology, a mempool is a waiting pool for transactions that have not yet been added to the block and are still pending. Of course, anyone can see all the transactions that are in this pending state and understand how they can affect certain contract states. What are People Looking for in Blockchain Today At the time of writing, the most popular uses of MEV mechanics right now are. DEX arbitrage and sandwich attacks Mempool provides a unique opportunity for traders to anticipate prices on exchanges. Most decentralized exchanges work with market-making algorithms, which allow knowing the current state of pools (exchange contracts) and incoming transactions from the mempool to know the price state after each upcoming transaction in the block. This opens up the possibility of both normal arbitrage between different exchanges within one block and sandwich attacks— buying and selling around one transaction or vice versa. For example, a trader sees a big transaction in the mempool to buy a SAND token. Then he sends his 2 transactions to the miner: his purchase of SAND token right before the big transaction and instant sale after this transaction. Liquidations Lending protocols such as Maker, Compound, and Aave require users to deposit collateral (e.g., ETH). This deposited collateral is then used to extend credit to other users. Once this collateral has the potential risk of not securing the loan (the risk parameters for this are determined by the DAO community in advance), any network user can liquidate the debt by taking the collateral for themselves. In this case, for example, the debt could be $80k and its collateral $100k, thus the liquidator gets an instant profit. NFT MEV Having access to the general information of incoming transactions makes it possible to detect the completion of NFT auctions or their drops, which opens up opportunities to profit from them. For example, if there is a popular NFT drop and a trader wants a particular NFT or set of NFTs, he can set his transaction so that he is first in line to buy the NFT, or he can buy the entire set of NFTs at once. MEV Infrastructure The Flashbots community played a big role in the development of MEV infrastructure. They proposed the mev-boost infrastructure, which is essentially an improved geth client (i.e., the Ethereum node client). In this article, I will consider this infrastructure, as currently, most builders in the Ethereum network use it. However, the prevalence of Flashbots Builder has fallen dramatically in block production, although at its peak, it collected almost 80% of all Ethereum blocks. Let's briefly walk through the "mining" process in Ethereum 2.0 after the merge. There are now 3 agents responsible for creating blocks: Block builder. Block bidder receives transactions from servers and users who, in addition to paying for gas, express their preferred position in the block by bidding with a capped price. The job of the bidder is to build the most profitable block using various strategies.
Block relay. Block relay is an agent responsible for verifying blocks before they are passed to validators. The block relay protects the validators from spam by checking the builder blocks for validity and evaluating the value of each block associated with the MEV.
Block validator. A block validator in the mev-boost architecture is a Beacon Chain member selected to offer a block for a particular slot. The validator communicates with the relay to obtain the most profitable block header, which it validates by signing it with its public key via escrow. Thus, network users can directly influence the collection of blocks through the mev-boost infrastructure. Bundles are used to organize transactions, which are an ordered set of transactions that the server sends to the builder via API. Practical Example: The Consequences of No MEV Protection Imagine Alice wants to swap a large amount of cryptocurrency on a decentralized exchange (DEX). She submits her transaction to the network, but before it gets included in a block, a malicious actor notices the pending transaction. The actor then submits a series of transactions to manipulate the price of the cryptocurrency, executing a front-running or sandwich attack. Here’s a step-by-step breakdown of what happens: Alice’s transaction submission. Alice submits her transaction to swap 100 ETH for SAND on a DEX.
Pending transaction visibility. Before Alice's transaction is included in a block, it appears in the pending transaction pool, visible to everyone, including malicious actors.
Front-runner's transactions. A malicious actor sees Alice's large transaction and submits two transactions: one to buy ETH just before Alice's transaction (pushing the price up) and one to sell ETH right after (taking advantage of the increased price).
Impact on Alice. By the time Alice's transaction is processed, the price of ETH has increased, meaning she receives fewer SAND for her 100 ETH. The malicious actor profits from the price difference. Without MEV protection, these types of manipulations are more likely to occur, leading to a loss of trust in the blockchain ecosystem and financial harm to users. MEV-Supported RPC Providers Several providers offer RPC nodes with built-in MEV protection, ensuring a safer and fairer blockchain experience. Here are a couple of notable ones. dRPC dRPC provides RPC endpoints with robust MEV protection, prioritizing the fair ordering of transactions and reducing the risk of manipulation. Their services include: Transaction bundling. Ensuring transactions are grouped and ordered in a way that minimizes the potential for MEV extraction.
Privacy features. Concealing pending transactions until they are confirmed, reducing the risk of front-running and sandwich attacks.
Real-time monitoring. Actively scanning for and mitigating potential MEV threats in real-time. dRPC is a leading provider of decentralized blockchain APIs and RPC Nodes, serving clients like Instadapp, SushiSwap, Lido, Curve, and 500+ other web3 organizations. Flashbots Protect Flashbots is a research and development organization focused on mitigating the negative externalities of MEV. Flashbots Protect offers RPC endpoints that help prevent front-running and other MEV-related attacks, promoting a healthier blockchain environment. Their features include: Sealed-bid auction mechanism. Transactions are submitted in a way that hides their details until they are confirmed, preventing pre-execution manipulation.
MEV-resistant mempool. Transactions are managed in a mempool that is designed to be resistant to MEV exploitation.
Collaboration with miners. Working closely with miners to ensure fair transaction ordering and reduce the incentives for MEV extraction. Flashbots primary focus is to enable a permissionless, transparent, and sustainable ecosystem for MEV. Conclusion It is important to choose RPC providers that offer MEV protection. With dRPC and Flashbots Protect, users and developers can significantly reduce the risks associated with MEV and contribute to a more stable and trustworthy decentralized landscape. MEV (Maximal Extractable Value) is extracting value from a blockchain network by adding, removing, or reordering transactions included in a block. This concept originated in the Ethereum community quite a long time ago (of course, if we count in crypto years). Still, MEV started to reach a new level of volumes with the growth of DeFi infrastructure, which opened more opportunities for servers. In simple words, MEV's working principle is: "Hey, miner, put my transaction next to that one so I earn 1 ETH, and I'll give you half”. Obviously, this is a win-win situation, both for the person who found the transaction (the servers) and for those who can change the order of the transaction when creating the block. An important term when working with MEVs is mempool. In blockchain terminology, a mempool is a waiting pool for transactions that have not yet been added to the block and are still pending. Of course, anyone can see all the transactions that are in this pending state and understand how they can affect certain contract states. What are People Looking for in Blockchain Today At the time of writing, the most popular uses of MEV mechanics right now are. DEX arbitrage and sandwich attacks Mempool provides a unique opportunity for traders to anticipate prices on exchanges. Most decentralized exchanges work with market-making algorithms , which allow knowing the current state of pools (exchange contracts) and incoming transactions from the mempool to know the price state after each upcoming transaction in the block. This opens up the possibility of both normal arbitrage between different exchanges within one block and sandwich attacks— buying and selling around one transaction or vice versa. For example, a trader sees a big transaction in the mempool to buy a SAND token. Then he sends his 2 transactions to the miner: his purchase of SAND token right before the big transaction and instant sale after this transaction. market-making algorithms Liquidations Lending protocols such as Maker, Compound, and Aave require users to deposit collateral (e.g., ETH). This deposited collateral is then used to extend credit to other users. Once this collateral has the potential risk of not securing the loan (the risk parameters for this are determined by the DAO community in advance), any network user can liquidate the debt by taking the collateral for themselves. In this case, for example, the debt could be $80k and its collateral $100k, thus the liquidator gets an instant profit. NFT MEV Having access to the general information of incoming transactions makes it possible to detect the completion of NFT auctions or their drops, which opens up opportunities to profit from them. For example, if there is a popular NFT drop and a trader wants a particular NFT or set of NFTs, he can set his transaction so that he is first in line to buy the NFT, or he can buy the entire set of NFTs at once. MEV Infrastructure The Flashbots community played a big role in the development of MEV infrastructure. They proposed the mev-boost infrastructure, which is essentially an improved geth client (i.e., the Ethereum node client). In this article, I will consider this infrastructure, as currently, most builders in the Ethereum network use it. However, the prevalence of Flashbots Builder has fallen dramatically in block production, although at its peak, it collected almost 80% of all Ethereum blocks. Let's briefly walk through the "mining" process in Ethereum 2.0 after the merge. There are now 3 agents responsible for creating blocks: Block builder. Block bidder receives transactions from servers and users who, in addition to paying for gas, express their preferred position in the block by bidding with a capped price. The job of the bidder is to build the most profitable block using various strategies. Block relay. Block relay is an agent responsible for verifying blocks before they are passed to validators. The block relay protects the validators from spam by checking the builder blocks for validity and evaluating the value of each block associated with the MEV. Block validator. A block validator in the mev-boost architecture is a Beacon Chain member selected to offer a block for a particular slot. The validator communicates with the relay to obtain the most profitable block header, which it validates by signing it with its public key via escrow. Block builder. Block bidder receives transactions from servers and users who, in addition to paying for gas, express their preferred position in the block by bidding with a capped price. The job of the bidder is to build the most profitable block using various strategies. Block relay. Block relay is an agent responsible for verifying blocks before they are passed to validators. The block relay protects the validators from spam by checking the builder blocks for validity and evaluating the value of each block associated with the MEV. Block validator. A block validator in the mev-boost architecture is a Beacon Chain member selected to offer a block for a particular slot. The validator communicates with the relay to obtain the most profitable block header, which it validates by signing it with its public key via escrow. Thus, network users can directly influence the collection of blocks through the mev-boost infrastructure. Bundles are used to organize transactions, which are an ordered set of transactions that the server sends to the builder via API. Practical Example: The Consequences of No MEV Protection Imagine Alice wants to swap a large amount of cryptocurrency on a decentralized exchange (DEX). She submits her transaction to the network, but before it gets included in a block, a malicious actor notices the pending transaction. The actor then submits a series of transactions to manipulate the price of the cryptocurrency, executing a front-running or sandwich attack. Here’s a step-by-step breakdown of what happens: Alice’s transaction submission. Alice submits her transaction to swap 100 ETH for SAND on a DEX. Pending transaction visibility. Before Alice's transaction is included in a block, it appears in the pending transaction pool, visible to everyone, including malicious actors. Front-runner's transactions. A malicious actor sees Alice's large transaction and submits two transactions: one to buy ETH just before Alice's transaction (pushing the price up) and one to sell ETH right after (taking advantage of the increased price). Impact on Alice. By the time Alice's transaction is processed, the price of ETH has increased, meaning she receives fewer SAND for her 100 ETH. The malicious actor profits from the price difference. Alice’s transaction submission. Alice submits her transaction to swap 100 ETH for SAND on a DEX. Pending transaction visibility. Before Alice's transaction is included in a block, it appears in the pending transaction pool, visible to everyone, including malicious actors. Front-runner's transactions. A malicious actor sees Alice's large transaction and submits two transactions: one to buy ETH just before Alice's transaction (pushing the price up) and one to sell ETH right after (taking advantage of the increased price). Impact on Alice. By the time Alice's transaction is processed, the price of ETH has increased, meaning she receives fewer SAND for her 100 ETH. The malicious actor profits from the price difference. Without MEV protection, these types of manipulations are more likely to occur, leading to a loss of trust in the blockchain ecosystem and financial harm to users. MEV-Supported RPC Providers Several providers offer RPC nodes with built-in MEV protection, ensuring a safer and fairer blockchain experience. Here are a couple of notable ones. dRPC dRPC provides RPC endpoints with robust MEV protection, prioritizing the fair ordering of transactions and reducing the risk of manipulation. Their services include: Transaction bundling. Ensuring transactions are grouped and ordered in a way that minimizes the potential for MEV extraction. Privacy features. Concealing pending transactions until they are confirmed, reducing the risk of front-running and sandwich attacks. Real-time monitoring. Actively scanning for and mitigating potential MEV threats in real-time. Transaction bundling. Ensuring transactions are grouped and ordered in a way that minimizes the potential for MEV extraction. Privacy features. Concealing pending transactions until they are confirmed, reducing the risk of front-running and sandwich attacks. Real-time monitoring. Actively scanning for and mitigating potential MEV threats in real-time. dRPC is a leading provider of decentralized blockchain APIs and RPC Nodes, serving clients like Instadapp, SushiSwap, Lido, Curve, and 500+ other web3 organizations. Flashbots Protect Flashbots is a research and development organization focused on mitigating the negative externalities of MEV. Flashbots Protect offers RPC endpoints that help prevent front-running and other MEV-related attacks, promoting a healthier blockchain environment. Their features include: Sealed-bid auction mechanism. Transactions are submitted in a way that hides their details until they are confirmed, preventing pre-execution manipulation. MEV-resistant mempool. Transactions are managed in a mempool that is designed to be resistant to MEV exploitation. Collaboration with miners. Working closely with miners to ensure fair transaction ordering and reduce the incentives for MEV extraction. Sealed-bid auction mechanism. Transactions are submitted in a way that hides their details until they are confirmed, preventing pre-execution manipulation. MEV-resistant mempool. Transactions are managed in a mempool that is designed to be resistant to MEV exploitation. Collaboration with miners. Working closely with miners to ensure fair transaction ordering and reduce the incentives for MEV extraction. Flashbots primary focus is to enable a permissionless , transparent , and sustainable ecosystem for MEV. permissionless transparent sustainable Conclusion It is important to choose RPC providers that offer MEV protection. With dRPC and Flashbots Protect, users and developers can significantly reduce the risks associated with MEV and contribute to a more stable and trustworthy decentralized landscape.

Why Is MEV Protection Crucial for RPC nodes?

কেন MEV সুরক্ষা RPC নোডের জন্য গুরুত্বপূর্ণ?

Warum ist MEV-Schutz für RPC-Knoten von entscheidender Bedeutung?

¿Por qué la protección MEV es crucial para los nodos RPC?

Pourquoi la protection MEV est-elle cruciale pour les nœuds RPC ?

RPC नोड्स के लिए MEV सुरक्षा महत्वपूर्ण क्यों है?

MEV 保護が RPC ノードにとってなぜ重要なのか?

RPC 노드에 MEV 보호가 중요한 이유는 무엇입니까?

Por que a proteção MEV é crucial para nós RPC?

Почему защита MEV имеет решающее значение для узлов RPC?

MEV Koruması RPC Düğümleri İçin Neden Önemlidir?

Tại sao bảo vệ MEV lại quan trọng đối với các nút RPC?

为什么 MEV 保护对 RPC 节点至关重要？

Stories, News & Mentions about SEALED

Sealed’s Stories on HackerNoon

Sealed's News & Mentions