TOCTOU Explained: From Symlink Attacks to the AWS DynamoDB Outage [HkgUZ4nVrK7]
TOCTOU (Time-Of-Check to Time-Of-Use) is a race condition pattern that shows up in C system calls, web APIs, payment systems, and distributed databases. In October 2025, a TOCTOU bug in AWS's DynamoDB DNS system caused a 15-hour outage affecting over 1,000 services globally. In this video I walk through three real examples: → A C filesystem race using access() and open() on macOS → A web API coupon double-redemption race in Python/Flask → The AWS DynamoDB DNS outage — root cause, timeline, and cascade All code in this video was written and tested before recording. ───────────────────────────── LINKS ───────────────────────────── AWS post-incident report (Oct 2025): ───────────────────────────── TIMESTAMPS ───────────────────────────── 0:00 Introduction — the AWS outage 0:50 What TOCTOU actually is 01:44 Example 1: C filesystem symlink race (macOS) 03:56 Example 2: Web API coupon race (Python/Flask) 05:48 Example 3: AWS DynamoDB DNS outage deep dive