Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Tune your App Perf (and get fit for summer)

Tune your App Perf (and get fit for summer)

Evolution of Sqreen app performance over the last few months: what we learned about monitoring, asynchronism, ExecJS and performance tuning.

630bcbf98d335080f59e77b73f55c510?s=128

Jean-Baptiste Aviat

April 05, 2016
Tweet

Transcript

  1. Confidential & proprietary © Sqreen, 2015 Tune your app perf


    (and get fit for summer) We make products antifragile
  2. © Sqreen sqreen.io Jean-Baptiste Aviat CTO @SqreenIO (https://sqreen.io) Former hacker

    at
 Apple (Red Team) @JbAviat jb@sqreen.io
  3. Confidential & proprietary © Sqreen, 2015 – Donald Knuth “Premature

    optimization is the root of all evil.”
  4. Confidential & proprietary © Sqreen, 2015 sqreen.io « We don’t

    have bugs. » « Or maybe one… » « Okay, beta are done for that! »
  5. Confidential & proprietary © Sqreen, 2015 sqreen.io Sqreen behind the

    scenes Examine the environment Run code specific to the class of vulnerability Log security events Automatically check for Sqreen
 security rules updates
 While keeping the app fast.
  6. Confidential & proprietary © Sqreen, 2015 sqreen.io HTTP request anatomy

    DB Cache Query Query JSON request response Services Rails server Client Rails app code
  7. Confidential & proprietary © Sqreen, 2015 sqreen.io HTTP request with

    Sqreen Query Query DB Cache JSON Services Rails server Client Sqreen code request response Rails app code
  8. Confidential & proprietary © Sqreen, 2015 sqreen.io Attack blocked by

    Sqreen Attack Error Query Sqreen backend Log
 event DB Cache Services Rails server Client Sqreen code Rails app code
  9. Confidential & proprietary © Sqreen, 2015 sqreen.io Thanks early adopters,

    we owe you one! Our beta customers raised different concerns: 1. Average response time 2. CPU consumption (mostly machine facing APIs) 3. Memory usage 4. Bandwidth
  10. Confidential & proprietary © Sqreen, 2015 sqreen.io Endless path to

    perf optimization Know what you are looking for Measure: understand precisely
 what need change Pareto law: 80% of execution time
 is spent in 20% of your code Change: just code it Evaluate: compare to previous measures Start over. Change Evaluate Measure
  11. Confidential & proprietary © Sqreen, 2015 What about our Gem?

  12. Confidential & proprietary © Sqreen, 2015 sqreen.io Sqreen code executed

    during a client request: doesn’t use network doesn’t interact with filesystem The decision to block is made in the application Back-end communication is performed in a dedicated thread Request processing Query
  13. Confidential & proprietary © Sqreen, 2015 sqreen.io Asynchronous by design

    Sqreen worker Rails threads Sqreen thread request response Rails server Sqreen backend Sqreen code Rails / app code
  14. Confidential & proprietary © Sqreen, 2015 sqreen.io 156ms Asynchronism benefits

    + X ms + XX % time 150ms 225ms + 0 % Default Dumb 0ms + 4 % Sqreen
  15. Confidential & proprietary © Sqreen, 2015 sqreen.io Reduce I/O Bandwith

    Memory Requests Aggregate Strip Required? I/O
  16. Confidential & proprietary © Sqreen, 2015 sqreen.io ExecJS call time

    ExecJS allows many runtimes: V8 (close to Pure Ruby) JSCore (OSX only) Node (ExecJS runs the Node binary) miliseconds 0 17,5 35 52,5 70 Pure Ruby V8 JSCore (OSX) Node
  17. Confidential & proprietary © Sqreen, 2015 sqreen.io ExecJS memory usage

    Low memory usage But it leaks! @samsaffron helped a lot Can be solved using
 context recycling ExecJS should be 
 reset regularly memory (MB) 0 175 350 525 700 seconds 0 150 300 450 600
  18. Confidential & proprietary © Sqreen, 2015 sqreen.io Optimize ExecJS use

    Reduce ExecJS spawn time Precompile everything Spawn ExecJS as less as possible We introduced pure Ruby pre-conditions Now the decision to call ExecJS is taken in Ruby
  19. Confidential & proprietary © Sqreen, 2015 sqreen.io Minimize ExecJS overhead

    Perform analysis only on requests using a risky API Pick relevant methods The JS engine is spawned and performs further analysis Analyze Check if the API uses arguments that can be vulnerable Validate exposure If there is a security risk, we block the request and alert our back-end Alert & block if method.include?(watch_methods) if method_arg.include?(parameters) if ExecJS.is_an_attack? tell_thread_to_record_alert block_this_request end end end
  20. Confidential & proprietary © Sqreen, 2015 sqreen.io Mem I/O CPU

    Band- width Reducing memory usage leads to smaller objects to be treated, faster garbage collection Memory Reducing CPU usage leads to overall faster process CPU Less bandwidth means less server occupation and leads to faster responses Bandwidth Reducing I/O reduces time needed for tasks I/O Virtuous circle of optimization
  21. Confidential & proprietary © Sqreen, 2015 sqreen.io Benefits of multithreading

    144% (over dumb implementation)
  22. Confidential & proprietary © Sqreen, 2015 sqreen.io -1000% Benefits of

    V8 (over Node runtime)
  23. Confidential & proprietary © Sqreen, 2015 sqreen.io reduce leaks Benefits

    of recycling ExecJS context (garbage collection, overall memory usage…)
  24. Confidential & proprietary © Sqreen, 2015 sqreen.io 
 just faster

    :) Benefits of pre-condition (less context recycling, less context switch…)
  25. Confidential & proprietary © Sqreen, 2015 sqreen.io Client perf is

    not all about client How to reduce I/O time without changing the client? The exposed APIs need to respond faster We are applying the same method to our back-end
  26. Confidential & proprietary © Sqreen, 2015 sqreen.io Set up your

    feedback loop Now, you should to monitor 
 your performances (automatically)! And do the same with Security ;) Keep on coding…