Posts

These are the songs I was listening to this year. Run – Joji – Run You Can Call Me Al – Paul Simon – Graceland Total Eclipse of the Heart – Bonnie Tyler – The Very Best of Bonnie Tyler Touch Me – Samantha Fox – Touch Me Nothing’s Gonna Stop Us Now – Starship – No Protection Call On Me – Litany – Call On Me Roses - Imanbek Remix – SAINt JHN, Imanbek – Roses Say So – Doja Cat – Hot Pink Like That – Doja Cat, Gucce Mane – Hot Pink Secrets – Regard, RAYE – Secrets I’m Just Feelin’ (Du Du Du) – Imanbek, Martin Jensen – I’m Just Feelin’ (Du Du Du) Savage Love (Laxed - Siren Beat) – Jawsh 685, Jason Derulo – Savage Love Supalonely – BENEE, Gus Dapperton – STELLA & STEVE Break My Heart – Dua Lipa – Future Nostalgia Stunnin’ – Curtis Waters, Harm Franklin – Stunnin' In Your Eyes (Remix) – The Weeknd, Doja Cat – In Your Eyes Savage Remix – Megan Thee Stallion, Beyonce – Savage Remix Tinted Eyes – DVBBS, 24kGoldn, blackbear – Tinted Eyes Party All the Time – Eddie Murphy – How Could It Be Moonlight Desires – Gowan – Great Dirty World (You’re A) Strange Animal – Gowan – Stange Animal Even Grable – Treble Charger – Self Sick of Myself – Matthew Sweet – 100 % Fun All Over You – Live – Throwing Copper I Got A Girl – Tripping Daisy – I Am An Elastic Firecracker Galaxie / Hello, Goodbye – Blind Melon – Soup Levitating – Dua Lipa – Future Nostalgia Hallucinate – Dua Lipa – Future Nostalgia Malibu – Kim Petras – Malibu Summer Feelings – Lennon Stella, Charlie Puth – Summer Feelings Stunnin’ – Will Berger – Stunnin' Cool – Dua Lipa – Future Nostalgia No Smoke – LU KALA – Worthy My Fit – Mad Circuit – Airhead Experience – Victoria Monet, Khalid, SG Lewis – JAGUAR And that’s it for 2020! See you next year! ...

2020 has been quite a tough year for human relationships. I’m naturally inclined towards recharging my batteries alone, but even I have been feeling the effects of a lack of human relationships. One area that has surprisingly benefited from our physical distancing measures is during mentoring. I have been mentoring UBC Computer Science undergraduates for about 15 years now. My role in the relationship is to help students understand what the tech industry is like once they graduate, what types of jobs are available, and what life is really life. This year, 2020, was the first time it was brought online. ...

I love efficient meetings. I love meetings that were scheduled for 30 minutes but instead take 8 minutes. One of the tricks I use to hold efficient meetings is to put topic tags into each agenda. Oh, and the other trick I use is to always have a meeting agenda. Friends don’t let friends accept meeting invites without an agenda! An agenda topic tag consists of a bullet point about the topic, prefixed with who brought up the topic and a quick word on what can be expected. For instance, this is an agenda entry with a topic tag: ...

This is part 4 in a series of articles. To follow along via code, visit the Github repository. In the last article, I reviewed the template for operational and security risks. Let’s go fix some of them now. Making Unsafe Defaults Safe First, some guard rails are added to the template. Remove the Default attribute from both SSHLocation and HTTPLocation, ensuring that the caller specifies them in the CloudFormation template. That way, if the caller does use 0.0.0.0/0, it is a decision they have made, not the template. ...

This is part 3 in a series of articles. To follow along via code, visit the Github repository. The last article discussed some refactoring use new(-ish) CloudFormation features, which help improve the readability and reduce the template’s file size. This article temporarily moves away from template modifications and focuses on how someone can review a CloudFormation template for security and operational risks. Parameters Let’s start with the Parameters section, because that is going to tell us what dependencies we need to bring into this template from our AWS or organizational environment. ...

This is part 2 in a series of articles. To follow along via code, visit the Github repository. In the last article, I showed how we can improve the operational capabilities of the AlienVault sensor deployment in AWS, simply by adding some automation and formatting changes to the generic CloudFormation template supplied to customers. Let’s further improve the YAML template to make it more readable and less code-heavy by using the newest features of CloudFormation. ...

This is part 1 in a series of articles. To follow along via code, visit the Github repository. I recently needed to review the AlienVault Sensor deployment for AWS and, well, it left me wanting more. Many companies are smart to offer infrastructure-as-code for their appliances. It provides customers with a near one-click deployment model. It also provides customers with insight into what permissions, servers, and resources the appliance will require. The issue with vendor-supplied code is that it needs to apply to a generic customer base; a sort of lowest common denominator scenario where insecure defaults are needed to fit various environments and customers with various skill levels. ...

I have just started reading Tribe of Hackers by Marcus Carey (et al). I already love the format of the book. He takes 14 questions and asks them to prominent people in the field of computer security. Before I start reading the book, though, I want to provide my own answers to his questions and then see how they relate to the others in the book. If there is one myth that you could debunk in cybersecurity, what would it be? I find the biggest myth about computer security is that it is somehow so mysterious and technical that it is difficult to understand. It does often involve deep understanding of computers, but the fundamentals of computer security look very similar to that of traditional security. And with that knowledge, anyone can learn computer security easily by building up their skills from first principles. ...

In the previous article I showed how a model can be disabled. One of the things that you probably noticed is that I’m using a timestamp (DateTime) field instead of a Boolean field. This is a trick I learn years ago after working on a large database (>2B rows) for an Enterprise client. It has been useful in so many ways that I put it into every database design I do, yet I’ve never written about it before and only talked to developers in person about the purpose of the design. ...

When I first started using model concerns I struggled with how I could test the functionality of the concern, without having to replicate the tests across all models. Here I show you how I decided to test model concerns. It may be controversial, so buckle up. What are Model Concerns? Model concerns are an interesting concept that — if I recall correctly— debuted with Rails 4. They allow a developer to refactor common functionality out from various models and centralize it into a module, called a concern. A non-contrived example of this shows how several of my models can be deactivated at any time. ...