Links 2016-05-17

A failure, a success story, and several thoughts on system design.

  • Inside the sad, expensive failure of Google+
    Create a social network or risk everything.
  • Jetbrains: The unicorn Silicon Valley doesn’t like to talk about
    The reason why Jetbrains has such little competition is because few startups and programmers are willing to learn and embrace non-sexy tech.
  • Why I Strive to be a 0.1x Engineer
    Given the cost of maintaining everything we build, it would literally be better for us to do 10% the work and sit around doing nothing for the rest of our time, if we could figure out the right 10% to work on.
  • Boring Systems Build Badass Businesses
    Build the most minimal solution you possibly can. See if customer’s like it, use it, and will pay enough for it. Only then build it into a full solution.
  • Logging v. instrumentation
    Logging and instrumentation are two perennially hot topics in software development generally, and seem to be enjoying a certain renaissance in the context of microservices particularly. And I see quite a lot of confusion on the topic.
  • How to build stable systems — Medium
    The first decision is easily the most important. It is one of ideology: the developers are in control of the software. Not the other way around. Managers are not in control of the software. Product Owners are not in control of the software. Developers are.

OSDC 2016

This year was my second OSDC, and the first one as a speaker. Thanks to Netways for organizing this great conference (and also for inviting me to talk there). The conference archive for 2016 with all presentation slides is now online.
Read the rest of this entry »

AWS Summit Berlin 2016

A few remarks on the AWS Summit in Berlin this April…

Thanks to several sponsors the event was free of charge and a welcome opportunity to visit Berlin. Given this background it is probably not fair to compare it to normal tech conferences. Although it did have several tracks with technical talks and presentations, most of them were on an introductory level so you might as well watch a few AWS webinar videos. So one has to see the summit as a pure marketing event, one you should attend to celebrate AWS itself, meet fellow AWS user group members, and see a few product demos as well as startup pitches.

Chemnitzer Linuxtage 2016

CLT2016-Tasse

Und noch ein kleiner Hinweis: Bei den Chemnitzer Linux-Tagen sind nun seit einigen Tagen die Audio-Aufzeichnungen der Vorträge online.

Getreu dem Motto „Es ist Dein Projekt“ fand ich viele Vorträge recht kleinteilig und bastelig (à la „Meine drölfzigste Raspberry Pi Lampensteuerung“). Meine persönlichen Highlights waren dann auch zwei Vorträge, die mehr zu meinem eigenen Arbeitsbereich passen: Valentin Haenels Vorstellung des AWS Federation Proxy (leider noch ohne Audio) und René Kochs Übersicht zu oVirt.

Links 2016-03-02

Politik & Menschen

Links 2016-02-29

Security & Crypto edition

  • On the Juniper backdoor, Matthew Green
    And while every reasonable person knows you can’t just drop “passive decryption vulnerability” and expect the world to go on with its business, this is exactly what Juniper tried to do. Since they weren’t talking about it, it fell to software experts to try to work out what was happening by looking carefully at firmware released by the company.
  • Why I don’t care that Dell installs Rogue Certificates On Laptops, Tom Limoncelli
    Every new machine should be wiped and reloaded with your organization’s “standard build”. Having a “standard build” is one of the foundational pieces of infrastructure that your organization is responsible for. It is so fundamental that not having this kind of infrastructure is negligent.
  • The Moral Character of Cryptographic Work, Phillip Rogaway
    As computer scientists and cryptographers, we are twice culpable when it comes to mass surveillance: computer science created the technologies that underlie our communications infrastructure, and that are now turning it into an apparatus for surveillance and control; while cryptography contains within it the underused potential to redirect this tragic turn.
  • The IPv6 Numeric IP Format is a Serious Usability Problem, Adam Ierymenko
    While the IPv6 protocol itself is fine, its original designers made some truly bizarre decisions around how to represent numeric addresses.
  • How to C (as of 2016), Matt Stancliff
    The first rule of C is don’t write C if you can avoid it. If you must write in C, you should follow modern rules.
  • Mozilla SSL Configuration Generator
    The goal of this document is to help operational teams with the configuration of TLS on servers.

Links 2016-01-19

A few good articles on cloud development and operations.

  • Sort out deployment first, Lars Wirzenius
    It is tempting to start a new project with the interesting bits, but it’s often a mistake. One of the first steps in a new project should be to sort out deployment: getting the software installed and configured so it can be used.
  • 5 AWS mistakes you should avoid, Michael Wittig
    Useful to evaluate your own AWS web application.
  • 12 Fractured Apps, Kelsey Hightower
    Once Docker hit the scene the benefits of the 12 Factor App (12FA) really started to shine. […] Unfortunately legacy applications, including the soon-to-be-legacy application you are working on right now, have many shortcomings, especially around the startup process.
  • Moving a team from Scala to Golang, Jim Plush
    You can jump into any Go project and know immediately what it’s doing. Do I miss immutable types and some of the great features of Scala? Sure do, but I think the maintainability side of the story is too great to overlook with Go.
  • Ansible 2.0 Has Arrived
    After a year of work, we are extremely proud to announce that Ansible 2.0 (“Over the Hills and Far Away”) has been released and is now generally available. This looks like a big step forward. Finally Ansible gets a usable parsing/error reporting and with the new execution strategies you no longer have to update all hosts in lockstep.
  • What’s in a Name?, Geoff Huston (ISP Column Dec 2015)
    What’s the difference between .local and .here? Or between .onion and .apple?

New Year’s Crypto Cleanup

Just did some housekeeping of my server I want to document.

Most importantly I got myself a Let’s Encrypt TLS certificate for this blog (and my mailserver), so you no longer have to deal with my self-signed cert to use HTTPS. There has been some discussion about their official client tool, but for a first release it does not seem to be too bad; at least it is written in Python and not in Java or Scala etc. The ACME protocol itself looks sensible and I look forward to more lightweight implementations in the future.

Having a public CA also gave me the opportunity to add an HTTP Strict Transport Security header. Now the next step would be HTTP Public Key Pinning, but that is still out of range for a non-professional website; because Let’s Encrypt may still change their intermediary CA certificate and I also do not have a backup CA that I could use in case of a problem. (BTW, nice HPKP advice on the Let’s Encrypt community site.)

Somewhat related I also expired my old 1024 bit PGP key from  as well as the PGP key of my former work address at DECK36. (BTW, here is a nice description how-to edit gpg key expiration dates by George Notaras.) In order to reach me securely please use my current PGP key (0x4dc5e2280a327754, also on my Contact page).