#orientdb

#Guess

Let's play 'Guess The Logo!' 🤔

Can you name it?

Drop your guesses below!👇

💻 Explore insights on the latest in #technology on our Blog Page 👉 https://simplelogic-it.com/simple-logic-it-services-tech-insights-blog/

OrientDB 2.2.x Remote Code Execution

This Metasploit module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable. Source: OrientDB 2.2.x Remote Code Execution The post OrientDB 2.2.x Remote Code Execution appeared first on MondoUnix.

As some may have noticed, I’ve recently left OrientDB and am moving on to the next adventure. During the multi-model database journey I’ve learned a lot and have fond memories of what we’ve achieved with the amazing team there. Some details are in a recent Press Release, but working with a startup means much more than what you can capture in words.

I’d like to say thank you to my former colleagues who’ve been working alongside me to transform the company and deliver results that we didn’t even dream of. You’re rising stars of the database ecosystem and in the graph of life I will always be one hop away!

What comes next?

There are three things that I’m passionate for and always accompanied me in my career: Data, Analytics and Marketing.

Data, whether big, fast, diverse or connected, is the new currency and there are endless opportunities to exploit it. Companies are swimming in data-lakes and fishing for information in an endless stream of data, sometimes with little success. That’s why analytics is data’s alter-ego and an exciting field to explore. Descriptive, predictive or prescriptive, it’s how you connect the dots and give sense to your assets. Marketing is my main non-technical passion. It’s the art and science driving the success or failure of products and even our behaviour, willingly or not. Marketing is also the function that can benefit more from understanding customers through actionable data and analytics.

My next adventure is a beautiful convergence of all of them.

ContactLab, here I come.

Talking about rising stars, I like to join companies that are close to a tipping point (or crossing the chasm for Moore’s fans). ContactLab has been serving hundreds of customers with its digital customer engagement platform, recently got funded and is on the cusp of a profound transformation that will accelerate growth even more.

I’ve met the CEO and Founder, Massimo Fubini, years ago and witnessed first-hand his vision, passion and execution capabilities. ContactLab’s approach including technology, marketing, advisory and data science offers unique advantages to clients. They’re a strategic partner on a global scale for top brands who generate growth through digital direct marketing.

ContactLab’s platform is processing hundreds of millions of digital interactions per day its customers. Those data-sets are both an opportunity and a challenge. That’s why I decided to join the company as the Chief Data Officer. Data is a product and products around data are what my team and I are going to focus on.

For the first time in my career I will be both building and selling cutting edge solutions (yes, we’re a technology provider) as well as experimenting with multiple data-management products in a massively scalable data infrastructure without being tied to a single vendor.

I won’t forget my open source background though. During my tenure at MySQL and MongoDB I’ve learned the huge difference an active and knowledgeable community can make to both product innovation as well as talent sourcing. That’s why we will strive to be a place to capture interest and knowledge around data, marketing and analytics.

We’ve an ambitious plan to deliver, interesting products in the pipeline and a chance to build something unique. I’m really looking forward to see what we will achieve... and of course, I’m also going to continue advising startups and larger organizations. 

Since 2.2 version we support incremental backup feature. So what perks do you get if you use incremental backup instead of classical backup :

Database stores on disk only data which were changed after previous backup.

Database is not switched to read only mode and users may continue to work with it.

Lets look how does it work inside of OrientDB.

Every time when we change data, together with user data we put some kind of timestamp which will show us when this change was happend, we call it LSN. Despite normal timestamp, every time, when we make update, LSN will continuously grow and can not be equal to previous LSN. In each snippet of incremental backup (file which is created during single incremental backup operation) we put maximum LSN of changes which we added into this snippet. So merge of different snippets and finding of changes happened after previous backup is kinda simple. We iterate over all data in sequential way and compare latest stored LSN and LSN of processed change, if last one is bigger we put it in new backup file.

To prevent situation when we lose changes happened during iteration over all database data, we log all operation since start of incremental backup process into database journal and at the end of backup process we append list of those operations to the backup file.

During restore process we import all data added into backup files and apply operations from database journal, so at the end of the process we get database in the state which it had at the end of last incremental backup.

To perform incremental backup from Java you can call method ODatabase#incrementalBackup(path-to-incremental-backup-directory) or from console the same will look like: backup database path-to-incremental-backup-directory -incremental .

To create database from incremental backup you can call from Java ODatabase#create(path-to-incremental-backup-directory) or from console: create database root root plocal graph -restore=path-to-incremental-backup-directory

Every user who works with OrientDB knows that to manipulate records he or she has to create ODatabaseDocumetTX instance first. But there is  wide misunderstanding about meaning of this object. Many users think that this object may be treated as abstraction of data which are stored on disk and placed on server. As result they create single instance of this object per thread, assign it to the class field and use the same object during whole application life. That is "not performance" wise decision. There are several reason why you should consider to use short living database instance acquired from the pool for example from OPartitionedDatabasePool instead.

The most important reason is that during loading of records we put records into local cache which is based on WeakHashMap.  We need this cache for 2 reasons:

To avoid OConcurrentModificationException in case of loading of the same record in call stack.

To speed up graph traversal.

Lets look how WeakHashMap works (in OpenJDK at least):

Every put/get/remove method of this HashMap calls getTable() method.

Which in turn calls expungeStaleEntries() method.

Responsibility of last method is to remove weak references which are already not accessible. expungeStaleEntries() uses ReferenceQueue which was passed during creation of WeakReference object to detect unreachable references.

The main problem there is mechanics which is used to fill in and pull items from  reference queue. When weak reference is becoming a subject of garbage collection special thread which has high priority java.lang.ref.Reference.ReferenceHandler put such reference into reference queue. But reference queue itself is guarded by object wide lock !

Let's put all of this together:

You have long living ODatabaseDocumetTX instance.

You use it to load many short living record objects.

You have WeakHashMap polluted by many WeakReferences.

After next GC run ReferenceHandler starts to pull and lock ReferenceQueue and as result lock WeakHashMap objects.

Your threads are become frozen for a long time. We know situations when threads were frozen for several seconds !

So main rule of thumb - never use long living ODatabaseDocumetTX instances, use database pool instead. Despite of solving of problem described above pool also provides support for nested transactions.

We are looking at driver developers for OrientDB database (http://www.orientdb.com) with good knowledge of at least 2 of the following languages: PHP, Python and C#(.NET platform). The candidate will learn the missing language and will contribute in the long term to the development/support of other drivers, like Golang.

Good knowledge of TCP/IP and HTTP protocols is a big bonus. In short term perspective this developer will analyse existing community drivers, fix existing issues and implement new API together with the OrientDB core team.

Furthermore, the candidate has to stay updated with the new trending frameworks and evaluate what to support as a new connector for OrientDB.

So in nutshell wer are looking for developers with the insane passion for the polyglot programming and studying of the next cool framework.

News itself is written in blog title, but in blog itself I want to clarify some details of implementation. To do not loose disk cache statistics of frequently used data and as result to do not slow down user queries we store whole statistic inside of file with name cache.stt  and then load those data when database is opened for the first time. Which means that users will experience slow down during server shutdown and during the cases database is opened for the first time. 

If you want to avoid slow down during database open operation you may indicate that database should be opened during the server start. Simply add attribute loaded-at-startup=true in orientdb-server-config.xml->storages->storage tag. It may look like following: <storage name="db"         path="plocal:${ORIENTDB_HOME}/db"  loaded-at-startup="true"/>