SUMMIT China 2023 ## Unleashing the Magic: Harnessing eBPF for Traffic Redirection in Istio Ambient Mode Chun Li & Iris Ding, Intel ## Outline • What is ambient mesh • How ambient mesh works • How reinforces ambient mesh • Next(lesson learned)... ## Background • Ambient mesh is a new Istio data plane mode • Launched in Sep. 2022. announcement • Currently in alpha status, moving forward to beta phase 1. Follow the instructions in Getting Started with Ambient Mesh 2. In istio install stage set the mode to ebpf by ' --set values.cni.ambient.redirectMode="ebpf", e.g.: istioctl install --set

Packing Obfuscated Scripts 8 2.8 Improving Security Further 8 3 Advanced Topics 11 3.1 Using Super Mode 11 3.2 How to use outer license file 12 3.3 Obfuscating Many Packages 12 3.4 Solve Conflicts 3.12 Bundle obfuscated scripts with customized spec file 20 3.13 Improving The Security By Restrict Mode 21 3.14 Using Plugin To Improve Security 22 3.15 Call pyarmor From Python Script 24 3.16 3.25 How to protect data files ..... 30 3.26 How to remove docstrings ..... 31 3.27 Using restrict mode with threading and multiprocessing ..... 31 4 Examples ..... 33 4.1 Obfuscating and Packing

3.10 Bundle obfuscated scripts with customized spec file 16 3.11 Improving The Security By Restrict Mode 17 3.12 Checking Imported Function Is Obfuscated 18 3.13 Call pyarmor From Python Script 19 Modes of Obfuscated Scripts 67 11.1 Advanced Mode 67 11.2 Obfuscating Code Mode 68 11.3 Wrap Mode 68 11.4 Obfuscating module Mode 69 11.5 Restrict Mode 69 12 The Performance of Obfuscated Scripts number stands for the features: • 0: No anti-debug, JIT, advanced mode features, high speed • 7: Include anti-debug, JIT, advanced mode features, high security It’s possible to obfuscate the scripts with

导致优化后结果不一样，这就是 编译器放弃优化的原因。 ## 告诉编译器别怕指针别名：___ restrict 关键字 void func(int *__restrict a, int *__restrict b, int *__restrict c) { *c = *a; *c = *b; } __restrict 是一个提示性的关键字，是程序员向编译器保证：这些指针之间不会发生重叠！从而他可以放心地优化成功： *b_5(D), *c_4(D) # main.cpp:4: } ret .cfi_endproc ## __restrict 关键字：只需加在非 const 的即可 void func(int const *a, int const *b, int *__restrict c) 实际上，___ restrict 只需要加在所有具有写入访问的指针（这里是 c）上，就可以优化成功。而我们可以用 const 禁止写入访问。 volatile *a 2. int * restrict a • 语法上区别：volatile 在 * 前面而 ___ restrict 在 * 后面。 功能上区别：volatile 是禁用优化，___ restrict 是帮助优化。 • 是否属于标准上区别： • volatile 和 const 一样是 C++ 标准的一部分。 • restrict 是 C99 标准关键字，但不是 C++

'./src/index.html'}) } }; ## 核心概念之 Mode Mode 用来指定当前的构建环境是：production、development 还是 none 设置 mode 可以使用 webpack 内置的函数，默认值为 production ## Mode 的内置函数功能 |选项|描述| |---|---| |development|设置 process

Package • Packing Obfuscated Scripts • Improving Security Further • Advanced Topics ○ Using Super Mode Obfuscating Many Packages Solve Conflicts With Other Obfuscated Libraries Distributing Obfuscated Executable File ○ Bundle obfuscated scripts with customized spec file ○ Improving The Security By Restrict Mode ☐ Using Plugin To Improve Security. ☐ Call pyarmor From Python Script ☐ Check license periodically of Obfuscated Scripts - Super Mode - Advanced Mode - Obfuscating Code Mode - Wrap Mode - Obfuscating module Mode - Restrict Mode - The Performance of Obfuscated Scripts

name }) } ## Scope control for implicit receivers in DSLs The @DslMarker annotation allows to restrict the use of receivers from outer scopes in a DSL context. Consider the canonical HTML builder example: td and thus to put a tag in a . In Kotlin 1.1, you can restrict that, so that only methods defined on the implicit receiver of td will be available inside the lambda a command-line option (-Xnormalize-constructor-calls=MODE) that tells the compiler to generate more Java-like bytecode for such constructs. Here MODE is one of: — disable (default) – generate bytecode

tokens print axioms : display assumed axioms print options : display options set by user or emacs mode print prefix : display all declarations in the namespace print coercions : display all simplifier subst : substitution lemma, used for calc-expressions and simplifier ## Proof Elements ## Term Mode take, assume : syntactic sugar for lambda let : introduce local definitions have : introduce auxiliary name. ## Tactic Mode At any point in a proof or definition you can switch to tactic mode and apply tactics to finish that part of the proof or definition. begin ... end : enter tactic mode, and blocking

、ctrl キーを押した場合は5の倍数になります。 バージョン 5.1 で変更: Shift while dragging will now also enable "relative mode", which means that the cursor can be dragged outside the slider area. ## ツールバー ツールバーは大事なアクシ blending modes to achieve different, interesting effects. For example, glazing with the multiply blending mode to create nice shadows: ![Image](/uploads/documents/c/0/b/8/c0b844a43a2890b4066643a5301cd978/p242_1 set to multiply, we can add colored layers to suggest shadows and mid-tones. The multiply blending mode will darken and interact with each base color differently. ![Image](/uploads/documents/c/0/b/8/c