Spotify Live (formerly Spotify Greenroom) is a platform that democratizes live audio streams. Creators are able to create rooms and stream live directly to fans who join the room.  In this post, you’ll be walked through how a recording starts, processes, and distributes to the room creator. (28/04/2022)

2- Continuous Load Testing

At SLACK we realized that the solution to many of our problems was simple: load test all the time. (29/04/2022)

3- The Demise of the Mildly Dynamic Website

The mildly dynamic website. PHP enabled dynamic web applications for the masses. But an interesting and particular effect of the rise of PHP was that it enabled and led to the rise of what I'm going to call “mildly dynamic” websites. (02/05/2022)

4- Soft(easy to change)ware

One of the more important characteristics about software vs hardware is the idea that is easy to change. Why do we forget this? (02/05/2022)

5- The Niche Programmer

For the vast majority of my programming career, I've been a mainstream developer. But then one day in 2018 I got a job where I had to learn Clojure. (01/05/2022)

6- Why Train When You Can Optimize? 

Problems with many interacting variables that are unmanageable with traditional programming approaches become straightforward when using optimization. (01/05/2022)

7- Don't Write Your Own Kubernetes YAML Generator

In the place of watching OS upgrades has come the endless tedium of writing configuration files. We're going to try and avoid having to write too much internal tools and keep our process simple. (03/05/2022)

8- Why I don't miss React: a story about using the platform

I've ended up finding the transition easier than expected and have come to really relish working closer to the platform’s primitives and maintaining more control over the software I write and in this blog post I’d like to share why that is. (03/05/2022)

9- How the Cinder JIT’s function inliner helps us optimize Instagram

Meta has recently open-sourced Cinder, a Python runtime that is a fork of CPython. Cinder includes optimizations like immortal objects, shadowcode (our term for inline caching and quickening), Static Python, and Strict Modules. But this blog focuses on the just-in-time (JIT) compiler and its recently released function inliner.

10- How To Build an Absurdly Backwards Compatible Website

Let's face it: the internet is broken. It feels like so much of the web is composed of clickbait, ads, popups, and a toxic amount of JavaScript that you need a modern computer just to get any value out of it. Remember when low-power computers were created for people who were "just browsing the internet?"

CPUs in Apple Silicon chips are different, as they contain two different core types, one designed for high performance (Performance, P or Firestorm cores), the other for energy efficiency (Efficiency, E or Icestorm cores) (25/04/2022)

2- Why LSP?

LSP (language server protocol) is fairly popular today. There’s a standard explanation of why that is the case. (25/04/2022)

3- Empathy for the Dev: Avoiding common pitfalls when communicating with developers

All too often, developers go deep on the wrong things, when writing documentation. A little bit of empathy can get your docs back on track. (25/04/2022)

4 - The Opportunity of Designing Within Technical Constraints 

Constraints often feel like obstacles to what we are working on but often are where we get to show off our creativity and where the joy and the challenge of software engineering can be found. (25/04/2022)

5- Announcing the Hare programming language 

Hare is a systems programming language designed to be simple, stable, and robust. Hare uses a static type system, manual memory management, and minimal runtime. It is well-suited to writing operating systems, system tools, compilers, networking software, and other low-level, high-performance tasks. (25/04/2022)

6- Evolution of ML Fact Store

Focus on the large volume of high-quality data stored in Axion — Netflix fact store that is leveraged to compute ML features offline - how its design has evolved over the years and the lessons learned while building it. (26/04/2022)

7- SQL Notebooks: Combining the power of Jupyter and SQL editors for data analytics

It allows SQL-based analytics to be done in a more scalable and secure way than traditional notebooks while still providing features from notebooks and basic SQL editings, such as multiple interdependent cells and Python post-processing. (26/04/2022)

8- Four Eras of JavaScript Frameworks 

Looking back at the last few decades of JavaScript development and at how far we’ve come. (25/04/2022)

9- The friend zone: friendly forks 101

This is the first post in a two-part series describing friendly forks and alternative strategies for managing them. (25/04/2022)

10 - Slack’s Incident on 2-22-22

Slack experienced a major incident on February 22 this year, during which time many users were unable to connect to Slack. This incident was a textbook example of complex systems failure: it had a number of contributing factors and part of the incident involved a cascading failure scenario. (28/04/2022)

Special coding skills are not the only thing to probe for in interviews. Domain knowledge and cultural fit are important, however, reading does a great job weeding out candidates who do not fit where it counts the most. (15/04/2022)

2- How we lost 54k GitHub stars

The sad story of losing 54k GitHub stars by making a repository private. (14/04/2022)

3- Inside the making of the Azure SDK management libraries

How is the Azure SDK generated? What’s the difference between a cloud SDK and a traditional SDK? Let’s start our journey! (15/04/2022)

4- Google Natural Language API — Google NLP Project with Python

Google offers a powerful cloud-based API to extract insights from unstructured data. Analyze syntactic and semantic components of the text. Extract information about people, places, events, and more (17/04/2022).

5- Top 6 JavaScript ES12 Features You Should Use 

Every JavaScript developer eager to perform at their best should learn the latest features of ES12. In this blog, we’ll look into the top six features with examples. (18/04/2022)

6- A Message Queue in Shell

Explore the common pitfall while implementing the well-known Queue pattern in Shell script (17/04/2022)

7- Nobody Wants your Fancy Algorithm

The satellite imagery industry still has no idea what customers actually want (18/04/2022)

8- Monitoring My Garage Door With a Raspberry Pi, Rust, and a 13Mb Linux System

Let’s build a monitor that sends an alert via Mattermost when the door has been left open for more than 5 minutes. Monitoring application implemented in Rust, with a stripped-down Linux image to run it.

9- The absurd complexity of server-side rendering

It was decided that the applications first forged for the browser would also run on the server. We would render our HTML using the same logic on the server and the browser and reap the advantages of both worlds. In a confusing series of events, a name for this approach was agreed upon: Server-side rendering. What could go wrong? (19/04/2022)

10- Practising Programming

In programming, we have only a haphazard notion of how one should go about obtaining sufficient technique to become good enough to write good software; and we have almost no notion of continued practice to maintain or expand that technique. (20/04/2022)

Apply ‘degrowth’ principles to computing – i.e. sketching out ways to de-couple digital technology from the growth-focused imperatives of capitalist societies. (08/04/2022)

2- You should know: rand() may call malloc()

A hard-to-find bug turned out to be something we did not expect. We now want everyone to avoid doing the mistake we did. (07/04/2022)

3- Maybe Passwords are the Future

It seems to me that we are trying to get rid of passwords with solutions that miss some basic UX, flexibility, decentralization, and security properties. I find myself often wondering if it would be better to stick with passwords as the user-visible authentication method but improve the underlying protocol to provide better security. (07/04/2022) 

4- The Essential Concepts of High-Speed Distributed Database Cassandra

Cassandra database is renowned for its excellent performance. While conventional databases respond to data queries within milliseconds, the Cassandra database could achieve the performance of microseconds, it is around 10x or even 100x times faster. A practical guide on Cassandra partition key, cluster key, query design. (10/04/2022)

5- Russia’s certificate authority for sanctioned organizations

After Russia’s invasion of Ukraine, several countries and blocs have imposed sweeping sanctions on Russian companies, banks, and individuals. Anticipating these sanctions, we have seen the Russian government taking steps to reduce its dependence on foreign internet infrastructure. (08/04/2022)

6- Takeaways From 3 Years Working In Machine Learning

A piece of outsider art, takeaways from someone that took an unusually deep dive into the zeitgeist without becoming part of “the community”. (08/04/2022)

7- Evolving Software: SOLID principles as a continuum

A great software engineering article about how all the SOLID principles are interlinked (09/04/2022)

8- You should be reading academic computer science papers

You read documentation and tutorials to become a better programmer, but if you really want to be cutting-edge, academic research is where it's at. (07/04/2022) 

9- Supercharge your Git experience in VS

A relatively new Git feature called the commit-graph which leads to improving the performance of your Git operations and significantly improving performance in Visual Studio. (13/04/2022)

10- I stopped using environment variables for config

Environment variables were the standards for passing configurations, keys, and deployment assets in the system for a long time. It's even recommended by the twelve-factor apps guide. But the problem is once your configuration starts getting too complex, it's very tough to manage them. (10/04/2022)

Percona Monitoring and Management is an open-source tool to monitor your MySQL, MongoDB, or PostgreSQL instances. 01/04/2022 

2- How GitHub does take home technical interviews

This blog post talks about how candidates at GitHub do the “take-home” portion of their interview—a technical challenge done independently—and how that process has been improved. 31/03/2022

3- Why Rust mutexes look like they do

Walk through a typical C mutex API, compare it with a typical Rust mutex API and look at what happens if we change the Rust API to resemble C in various ways. 31/03/2022

4- Exploring Neural Networks Visually in the Browser

A fully-fledged neural network implementation running in your browser. You can add, remove, and configure the layers to change the activation function, neuron count, and initialization parameters. 04/04/2022

5- 6 Little Things That Can Make You Seem Like Less of a Jerk When Reviewing Someone’s Code

Being a helpful and constructive code reviewer is all about striking the right balance, and these tips should help you get there. 02/04/2022

6- Comparing Go vs. C in embedded applications

Impossibly tight deadlines, unrealistic schedules, and constant pressure to develop and release applications on time, while at the same time achieving excellent quality. Sound familiar? (04/04/2022) 

7- How Go Mitigates Supply Chain Attacks

Despite any process or technical measure, every dependency is unavoidably a trust relationship. However, the Go tooling and design help mitigate risk at various stages. (31/03/2022) 

8- Emerging Architectures for Modern Data Infrastructure

Updated set of data infrastructure architectures, with current best-in-class stack across both analytic and operational systems. (01/04/2022)

9- Use Git tactically

How you can use micro-commits to effectively apply the Strangler Fig pattern. (06/04/2022)

10- Simple AI Face and emotion Recognition With React

Today you are going to be using Artificial Intelligence and face recognition to determine your emotions through your webcam in real-time. (06/03/2022)

Using the properties of the Poisson bootstrap algorithm and quantile estimators to reduce the computational complexity of Poisson bootstrap difference-in-quantiles confidence intervals enough to unlock bootstrap inference for almost arbitrary large samples.

2- Google Issues Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability

Google on Friday shipped an out-of-band security update to address a high severity vulnerability in its Chrome browser that it said is being actively exploited in the wild.

3- Let me tell you about CURL 

How it started, grew, where it is today, how we make it and where it perhaps might go in the future.

4- How to Communicate Effectively as a Web Developer: The Importance of Strong Communication Skills 

Communication skills are just as important for web developers as they are for any other profession.

5- Abstraction: Not What You Think It Is 

Of all the concepts debated in software engineering, abstraction is at the top.

6- Remix – Web Standards Are Cool Again

Focused on web fundamentals and modern UX, you’re simply going to build better websites. 

7- Contextualizing Clojure in the small and the large 

How a simple job change can bring a huge paradigm shift in the application of the same programming language.

8- Identify Military Vehicles in Satellite Imagery with TensorFlow 

Using convolution neural networks to track fighting in conflict zones.

9- What to Expect from Python 3.11? 

Here are the most important updates on our favorite programming language. 

10- The Top 5 Hacks of 2021

How the Hack happened and how the Hack wreaked havoc. 

Coding interviews have never been popular in the programming community because people find them too hard, too unfair, too unrepresentative of reality, and so on. In this post, the author wants to make the case that coding interviews aren't all that bad. (19/03/2022)

2- Introducing the Google Forms API

The Forms API provides programmatic access for managing forms, acting on responses, and empowering developers to build powerful integrations on top of Forms. (17/03/2022)

3- The opportunity will find you 

knowledge changes how we see the world. It’s like when you travel, come back home and start seeing things a bit differently. (21/03/2022) 

4- Detecting silent errors in the wild 

Silent data corruptions (SDCs), data errors that go undetected by the larger system, are a widespread problem for large-scale infrastructure systems. Left undetected, these types of corruptions can cause data loss and propagate across the stack, and manifest as application-level problems. (17/03/2022) 

5- Penny Wise and Cloud Foolish

Google adding data transfer charges to match AWS and breaking architectural promises they’ve made to their customers in the process. This is an incredibly short-sighted move and will damage customer trust in Google Cloud for many years. (21/03/2022) 

6- Graph machine learning with missing node features

This post aims to show that feature propagation is an efficient and scalable approach for handling missing features in graph machine learning applications and that it works surprisingly well despite its simplicity. (17/03/2022)

7- How the Metaverse Will Transform the IT Industry?

Do you want to know in which areas or in which technology or in which industry, most of the jobs are going to get created in the next 5 to 10 years from the I.T. perspective, then here’s the answer? (23/03/2022)

8- Please stop writing shell scripts

Bash, and shell scripting languages in general, are mostly broken by default. (22/03/2022)

9- Introducing Natural Language Search for Podcast Episodes

For the query “electric cars climate impact”, our Elasticsearch cluster did not actually retrieve anything for it… but does this mean that we don’t have any relevant content to show to the user for this query? Enter Natural Language Search. (17/03/2022) 

10- An Introduction to Generics

The Go 1.18 release adds support for generics. Generics are the biggest change we’ve made to Go since the first open-source release. In this article, we’ll introduce the new language features. We won’t try to cover all the details, but we will hit all the important points. (22/03/2022) 

The difference between inspiration and deep inspiration is the passion to act consistently for the greater good. (11/03/2022)

2- A Sketch of the Biggest Idea in Software Architecture

An elaboration of the previous article on narrow waists: an idea in software architecture that relates to networking, operating systems, language design, compilers, and distributed systems. (12/03/2022) 

3- Celebrate tiny learning milestones

It’s much more healthy to be flexible about your goals and to celebrate the milestones you do end up getting to instead of feeling bad about goals that you “failed” at. (13/03/2022) 

4- When to “address” “technical debt”?

It’s not old code that’s technical debt, it’s lightly-designed code. That thing that seemed like the solution when you first thought of it. Yes, ship it, by all means, but be ready to very quickly rewrite it when you learn more. The question is when, how often, how much? (13/03/2022) 

5- C Isn't A Programming Language Anymore

C is the lingua franca of programming. We must all speak C, and therefore C is not just a programming language anymore – it’s a protocol that every general-purpose programming language needs to speak. (16/03/2022)

6- How to be interruptible?

One of the biggest problems to solve when a developer has lead responsibilities is to find time to develop (if you want to develop). Time management is critical, for sure, but you need to find a way to be interruptible. (12/03/2022) 

7- Contributing to Complex Projects 

A step by step guide at approaching a new complex project with the goal of making meaningful changes (13/03/2022)

8- SQL Injection at Spotify

Eslam Akl writes about one of his SQL Injection finding at Spotify discovered on 9th May 2021. (14/03/2022)

9- Scrum Velocity: 5 Things that Go Wrong

Velocity is a core metric for tracking the progress of Scrum teams. If velocity is stable, everything is on track. But what happens when it isn’t? What can cause velocity to slow or become erratic, making agile estimation more difficult? (16/03/2022) 

10- Introduction to Apple Silicon

This document attempts to explain the Apple Silicon (i.e. M1 and later) Mac boot ecosystem as it pertains to how open-OSes interoperate with the platform. (16/03/2022)

Enhancing performance of GO Json encoder working with fat objects. Source code provided with reproducible benchmarking. (03/03/2022)

2- CockroachDB: The Resilient Geo-Distributed SQL Database

This article presents CockroachDB and its novel geo-distributed transaction model. CockroachDB replicates and distributes data to achieve fault tolerance and high performance. It automatically scales with the size of the database cluster while providing the standard SQL interface that users expect. (04/03/2022)

3- Gravity in software

Physic has some fundamental laws that we use to create things and fight against the stronger/more common forces, for example, gravity. This is what engineers try to do, and this is what we should do in software. (05/03/2022) 

4- Windows Package Manager 1.2

The “winget” gets a great update. ARM64 support was added to the list of automatically handled hardware architectures. Human-comprehensible error handling. New settings to test the installation from a local package file. (04/03/2022)

5- Circular.io is putting a referral spin on tech recruitment

Demand for talent continues to make tech recruitment a hotbed of startup activity. Circular supports tech talent to nail down its next role through a team of what it bills as “talent advocates” who provide assistance to candidates on locating suitable roles (07/03/2022)

6- Retrieving your browsing history through a CAPTCHA

Visitors are told to select all the black squares to prove their humanity when in reality they are telling whether they have visited certain websites. (05/03/2022) 

7- Measuring React performance with OpenTelemetry and Honeycomb 

POC to frontend performance observability (08/03/2022) 

8- Bottlenecks of Scaleups #01 - Accumulation of tech debt

A series of articles starts on bottlenecks starts by looking at technical debt: how the tools and practices that facilitate rapid experimentation of the product/market fit need to change once growth kicks in. (08/03/2022) 

9- What's new in ES2022? 🤔

ES2022 will become a standard in a few months (probably in June 2022). Let's take a glimpse at the features that will be part of it. (05/03/2022) 

10- I Can Probably Hack Your Password in MINUTES!

An experienced software developer can probably hack most passwords in use on the planet in minutes. Read how the current password strategy is fundamentally flawed. (06/03/2022)

A narrow waist is a concept, interface, or protocol that solves an interoperability problem, It avoids O(M × N) code explosions, letting us write O(M + N) amounts of code instead. For the Internet, it’s the IP layer. For future evolution of software, we should move toward explicit engineering of new narrow waists, rather than letting them evolve haphazardly. (26/02/2022)

2- NestJS and its Advantages for Backend Developers

NestJS is an open-source, extensible, versatile, progressive Node.js framework for creating compelling and demanding backend systems. Are you wondering why choose NestJS as your backend framework? (26/02/2022)

3- 5 Deadly Sins of Software Development

Not Testing The Code, Naming A Variable/Function Improperly, Not Using The Source Control Management, Not Comprehending The WHY Of Software, Overloading The Software With Excessive Features. (27/02/2022)

4- A general troubleshooting idea

When facing a difficult problem, it should be useful to follow an emergency plan. Read about the experience of Dwen that brought him to develop general bits of advice and point of attention to consider if we want to enhance the process of fault recovery and discovery. (01/03/2022)

5- A Good Way to Handle Errors Is To Prevent Them from Happening in the First Place

Sometimes asking the question “how can we prevent the error from happening in the first place?” can avoid the need for error handling altogether. An insight on using the right pattern with the C++ language that can easily be adapted to any other framework. (25/02/2022)

6- Russia-Ukraine War: Phishing, Malware and Hacker Groups Taking Sides

Various hacking groups and ransomware syndicates are capitalizing on the chaos to take sides and further their activities. News about the anonymous group and other fealty to Ukraine. (25/02/2022)

7- Search Journey Towards Better Experimentation Practices 

Read how Spotify built an experimentation platform that allows running experiments at scale and generate accurate results and a product development culture with evidence-based hypothesis testing at its core. (28/02/2022)

8- How the tech industry is responding to Russia’s invasion of Ukraine

The impacts of the invasion are also, undoubtedly, being felt across Ukraine’s wider tech ecosystem, which includes not only hundreds of startups and larger tech firms but also research and development offices for some of the world’s biggest technology brands. (24/02/2022)

9- Who’s lying?

Computing the same data twice and deriving pieces of information in different ways it’s one of the best ways to grant data correctness. (26/02/2022)

10- I Don’t Want To Do Your Stinking Coding Test

Coding tests are the de-facto standard way to evaluate candidates in a software development assessment. A good test is probably NOT a brain teaser or general knowledge quiz. 

Brian D Foy strikes doubt about the usages of IDEs in our day-to-day job. (17/02/2022).

https://briandfoy.github.io/ide-driven-development/

TL;DR:

Brian compares IDEs suggestions to local minimum points of a graph. If you are positioned at a local minimum, moving to the left or the right will not bring any advantages. But if you try to go over the next hill, you may find that there is a lower minimum, a better solution. 

IDEs are just blocking the expansion and making developers choose the easy path. If IDEs make a particular thing easy to do, there is no reason why a programmer should spend his time searching for a better solution. He will see no reason to move from the local minimum, to walk away from the path of least resistance. 

These programs hide the complexity of code, but that's how things get increasingly complex.

GitHub copilot is somehow an evolution of a standard IDE. Instead of suggesting names, the copilot suggests entire structures. The problem is that suggestions are based on what we typed before and what programmers usually type. 

There are no grants that the GitHub copilot proposed solution is the best solution. But as in the case of IDEs suggestion, developers will fall victim to the seduction of the easy path, coding in a sub-optimal way. Besides, developers will not gain any experience in making better software.

2- Rapid Event Notification System at Netflix

Lessons learned from the trustworthy Netflix technology blog regarding fast and scalable communication with billions of devices. (18/02/2022) 

https://netflixtechblog.com/rapid-event-notification-system-at-netflix-6deb1d2b57d1

TL;DR:

To transfer information in near real-time from server to devices, Netflix relies on a component named "Rapid Event Notification System" (RENO). There are several use cases of this kind of communication in the Netflix experience. For example, when a member begins to watch a show, it's mandatory to update as soon as possible the "continue watching" list on every device he uses.

Netflix made a series of choices to increase scalability, throughput, and versatility that brought the architecture of RENO to be as it is now. First of all, RENO serves before events with a high priority. Secondly, the communication is both pull-based and push-based (the server sends push when devices are available, and clients request information in various steps of the application lifecycle). In addition, reno targets push events only on target that can effectively read those notifications.

To decrease even more the possibility of a traumatic event as a thundering herd problem, Netflix also:

• Deletes queued events that are old and no longer serve their purpose

• Sends events only to online devices, registered onto a Zuul registry

• Configures scale-up policies more aggressively than scale-down policies

• Handles event duplication by merging duplicate events
  

To get more insight on the RENO architecture, consider checking out the complete article.

3- Leveraging machine learning to find security vulnerabilities

A behind-the-scenes peek into the new GitHub ML framework used to alert developers to potential security vulnerabilities in their code.  By Tiferet Gazit (17/02/2022)

https://github.blog/2022-02-17-leveraging-machine-learning-find-security-vulnerabilities/

TL;DR:

GitHub’s code scanning capabilities leverage the CodeQL analysis engine to find security vulnerabilities in source code and surface alerts in pull requests executing code checks. 

GitHub engineers continually expand and improve these checks to model additional common libraries and known patterns. Manual modeling, however, is not sufficient as there will always be a long tail of less-common libraries and private code impossible to model.

To enhance this process, GitHub trains ML models with supervised Learning. Labels required by this training are extracted from the CodeQL manual examples. Modeling Noise is automatically suppressed by the huge volume of data (millions of repositories), and the model is validated with a retroactive check.  

When ML-generated alerts are enabled by repository owners, users can see the ML-generated alerts along with the alerts surfaced by the manual queries, with the “Experimental” label allowing them to filter ML-generated alerts in or out. This model has a precision of approximately 60% and 80% recall, but it’s going to improve over time. Give it a try.

4- Breaking the Rules With Stateful Services

Nicholas Tietz-Sokolsky on a practical example about the importance of breaking the standard rules of web application development to fulfill specific needs (21/02/2022) 

https://medium.com/remesh/breaking-the-rules-with-stateful-services-8eb361734d86

TL;DR:

Ramesh is a web application that relies on Machine Learning. Every user iteration has to be evaluated synchronously to provide the user with an updated experience. 

The main difference with a standard web application is that here the writes to reads ratio is close to 1:1, while usually, it’s approximately 1:10. With high concurrency, it’s challenging to scale up a write-intensive application.

The standard solution approach would be to scale elements physically, increasing cluster nodes or physical resources. This solution is not viable in the long term and is not cheap. 

The breaking solution was to bring statefulness into user transactions. Users of this application need two kinds of resources: data submitted by themselves and data submitted by other users. It's only the first kind that has to be updated as soon as possible.

By keeping a session active, it’s possible to keep the single participant's submissions in memory, while in the background an asynchronous process will refresh a local cache of all the submissions for communal use across all connections, and the ML service will poll this cache to retrieve data they care about processing. 

“Know when to break rules. The dogma is that stateless services are the ideal, the platonic form of a microservice. This is great and all, but it’s not a universal truth: Sometimes a stateful service is just what you need.”

5- The Romantic Lie of Software Developers

Ben "The Hosk" Hosking on the implicit lie in software development, that we have control of our careers. (20/02/20)

https://blog.devgenius.io/the-romantic-lie-of-software-developers-441a1e1484ee

TL;DR:

Firstly, It’s worth considering where our career desires come from as developers. We have to make sure that the desire of making progress in our career is not a "mimetic desire", which is desiring what other people desire. 

Starting from that, the reality for most developers is their career is directed by the software projects they work on, which they don’t decide. Skills, knowledge, and experience come from the projects where developers are placed. That's why trying to get put to work on an interesting project is a vital part of a developer's career.

Ask for better projects and if your role isn’t helping your career progression then you should quit and search for another job.

"The romantic lie is your career will progress with you just turning up to work. It won’t and you have to drive your career forward by pushing it forward and learning new skills."

6- Microsoft Warns of 'Ice Phishing' Threat on Web3 and Decentralized Networks

Again a vulnerability and thread found exploiting web3 transactions, emphasizing the need to build security into the decentralized web while it's still in its early stages. (18/02/2022) 

https://thehackernews.com/2022/02/microsoft-warns-of-ice-phishing-threat.html 

TL;DR:

There are multiple types of phishing attacks in the web3 world. Ice Phishing entails tricking a user into signing a transaction that delegates approval of the user’s tokens to the attacker. The attacker can accumulate approvals over some time and then drain all victim’s wallets quickly. 

One such instance of ice phishing was exposed in December 2021, on the Badger DAO which is a platform based on a DeFi protocol that allows one to earn interest on Bitcoin deposits. Thanks to a compromised API key, created without any authorization of the Badger engineers, the attacker was able to drain 121 million US dollars from almost 200 accounts within 10 hours.

“To mitigate threats affecting the blockchain technology, Microsoft is recommending users to review and audit the smart contracts for adequate incident response or emergency capabilities and periodically reassess and revoke token allowances.”

7- 2022 Prediction: The Influence Of Web3 On The Future Of Work

Rebekah Bastian predicts the influence of Web3 is going to make on our day-to-day job. (22/12/2022)

https://www.forbes.com/sites/rebekahbastian/2021/12/22/2022-prediction-the-influence-of-web3-on-the-future-of-work/?sh=7e98f5bf4ce4

TL;DR:

First of all, as the Great Resignation has taught us, people are looking for more inclusion and collaboration in the workspace. Those are values upon which the web3 is built. This means that a great number of employees will find their place there.

From an economic point of view, in DAOs–Distributed, Autonomous Organizations, people can do work that they choose to do for multiple DAOs, and receive multiple sources of income on their terms. In Web3, earning is non-linear because freelancers will own part of the marketplace.

Regarding the professional development of workers, the traditional model has a huge limit that comes from the investment of time and money that learning requires. With the learn-to-earn model, people are incentivized to learn Web3 by earning tokens. 

"While Web3 is still a very new space, and there is a lot of noise and speculation encompassing it, the core philosophical elements have the potential to improve several existing systems".

It’s incredible how Unix became portable and reliable thanks to the work of millions of developers in the world. This article talks about how Unix became a Berkeley Software Distribution (BSD). (10/02/2022)

https://klarasystems.com/articles/unix-on-the-path-to-bsd/

TL;DR:

The long path of Unix started in a room, on the sixth floor of Building Two at Bell Labs, where many important names of the programming world like K. Thompson and D. Ritchie spent a lot of time working on the first version of the operating system.

The first edition of Unix (1971), was rewritten from PDP-7 for PDP-11, adding features such as a hierarchical file system. Migrating Unix to a new architecture was a really hard job at that time because there was a lot of assembly code with just the Fortran compiler. For this reason, Ken Thompson decided that a new more feasible language was needed in the Unix system. Shortly after, the C language saw the light. 

The first time that Unix was exposed to the outside world was in a paper written by Thompson and Ritchie. From that moment Unix improved until it reached the seventh edition. 

Ken Thompson worked as a visiting professor at the University of California at Berkeley. While there, he introduced Unix and worked together with students to create new tools for the OS. In the end, BSD would grow on its own and overshadow its progenitor.

Check out the complete article if you want to read much more about the history of Unix and the birth of the BSD.

2- Modernizing the Netflix TV UI Deployment Process

Netflix had a revamp of the UI delivery process to help them achieve the best experience for the users. (11/02/2022) 

https://netflixtechblog.medium.com/modernizing-the-netflix-tv-ui-deployment-process-28e022edaaef

TL;DR: 

Netflix assigns a different Electronic Serial Number (ESN) for each device that uses the TV UI. The Canary build deployment process was set up based on this number. This process had several problems. 

First of all, if a customer turned on their TV when the canary deployment is in progress, they might get served the canary build on one device and the baseline or regular build on another. 

In addition, as the ESN is always the same, always the same devices received the canary build. In this way, together with having a poor user experience, Netflix tested his canary deployment always on the same devices, reducing the variance of the test environments and decreasing the quality of the user experience.

The great solution adopted by Netflix was to rely on AB-Test-Based canaries and differentiate USERS accounts instead of devices. This means that the same user will receive on different devices the same build.

In addition, as A-B groups are populated using a random assignment, it will be assured that the two groups are similar in terms of their device representation.

3- Code that Doesn’t Rot

Maxime Chevalier-Boisvert writes about how is possible to write code that it's more resilient to change and works for longer (11/02/2022).

https://pointersgonewild.com/2022/02/11/code-that-doesnt-rot/

TL;DR: 

Breaking changes into codebases is often caused by third-party dependencies, some of which are easy to fix, others are not. For example, the strict dependency between PyTorch and a specific Nvidia GPU driver causes lots of problems. In addition, installing specific Nvidia Drivers is a long and tedious process. 

Code rot is a problem that we ought to try to fix or at least alleviate. One of the ways we could avoid it is to statistically link libraries used. In the Python world, this is possible by specifying the exact number of the dependency. This fix comes with a cost: it's impossible with Pip to have two different versions of the same library in the same application. In addition, the FFI (foreign function interface) is a trap door not controlled by the package manager at all. 

The root cause of code rot is change. One of the ways we can minimize it in the software world is by building it on more stable foundations. The idea of virtual machines, firstly brought to life by Java, aimed initially at providing a not-changing infrastructure to run the software.

Generally speaking, the correct approach and the most practical solution is to take a conservative stance. Minimize dependencies where possible. Pick only dependencies that have a long history of being stable and well-maintained.

4- Thousands of npm accounts use email addresses with expired domains

In the world of third-party software and the progressive healing from the Not Invented Here syndrome, thousands of NPM packages have been found vulnerable once again. (11/02/2022)

https://therecord.media/thousands-of-npm-accounts-use-email-addresses-with-expired-domains/

TL;DR: 

Academic research analyzed the metadata of 1,630,101 libraries and found that 2818 NPM accounts were related to emails with expired domains, leaving projects exposed to easy hijacks.

The hijacks could be easy. An attacker could buy these domains, re-create the mail, and have full access to the NPM packages once resetting the maintainer's account password.

Teorycally, these attacks could be spotted by account owners. The problem is that 44.3% of NPM packages are left abandoned and 58,7% are unmaintained. This means that no one could spot any attack going on.

This attack has been feasible because the npm portal does not use two-factor authentication (2FA) for packages owners. However, npm announced plans to start enforcing 2FA, starting from the top 100 maintainer accounts of the platform.

Additional details on the study are available in the “What are Weak Links in the npm Supply Chain?” research paper.

5- Devs Use Closed Software

An insightful article uncovering the real issue when choosing open or closed source software development. By Kyle E. Mitchell (12/02/2022)

https://writing.kemitchell.com/2022/02/12/Devs-Use-Closed-Software.html

TL;DR: 

Developers use software in various shades of "closed" very often. It's not hard to find proprietary tools, libraries, and frameworks for sales on Google. College students, hobbyists, and startups who don't spend any money on proprietary software represent a small portion of the population.

As there is too much stuff to consider for complete vertical integration, the Not Invented Here syndrome is not viable even for companies in the top tier.

In addition, the existence of open-source software does not mean there can’t be any other kind. Usually, it's a closed source software that feeds open, by giving it something to clone. When the advantage of sharing maintenance outweighs the competitive edge of closed source, open source will prevail, fostered by companies themselves.

No one the author knows with broad experience in the industry thinks making an impactful activist project racking up GitHub stars. 

In conclusion, what is the point of providing open-source software? The problem is considering open-source as the main focus. The main focus should instead be serving other people. Open-source is just a tool. 

6- When I do TDD and when I don’t

In this article, Jason Swett presents his reasoning on TDD. In which cases driving code with tests is going to be purposeful? (14/02/2022)

TL;DR: 

When developing a new feature, Jason (and many other developers like him) relies on a "feedback loop" by manually testing the behavior of his code and then editing it if something does not work.

TDD it's just the automated version of the manual testing he was going to do anyway. TDD works better when the requirements are known and specified. 

Comparing coding to playing the piano, sometimes we have pieces of music already written in our heads. Other times we mess around to find new music worth recording.

Developers also do not work always with clearly defined requisites. For example, they could be programming under the "spike" incentive. A "spike" it's a time slot used to gain technical or functional knowledge for projects development. 

In this sense, code it's not only used to create a work product. It could be used as a medium for thinking also. The benefits of TDD in this case do not apply.

7- The True Way to Software Mastery

An insightful article by Justin Coulston about what it takes to gain mastery over software. This reading is necessary to acquire the necessary wisdom to follow the path of the best. (14/02/2020)

https://blog.devgenius.io/the-true-way-to-software-mastery-64dc0bf8a2f8

TL;DR: 

Programming is not truly a skill. You can master a specific programming language through formal training and practice. However, we need a lot more to master programming than language mastery. 

Programming mastery requires a lot of other skills; Skills that some programmers may balk at having to learn. For example, it requires a deeper understanding of the hardware, operating systems, and overall philosophy of software.

Furthermore, mastery is a form of subjectiveness that is bestowed upon yourself from others. Taking as examples Linus Torvalds or Robert C. Martin, what did they to do become considered "masters" in their craft? They experimented, never accepted rules, studied hard, challenged each other, never considered impossibilities, built wisdom with humility.

The fundamental takeover of this article is simple enough: never stop learning. To be considered a master, never stop at the surface of what you are studying neither. 

"The point is, the more you understand at the fundamental levels, the more chances of your ability to innovate in the field of computer science. You’ll realize that assumptions are made in lower-level frameworks; Decisions that, if recalculated, may produce a unique result. It’s this type of innovation that the masters perform."

Precision is a fundamental characteristic of a fruitful technical discussion. In this article, Raphael enucleates how to achieve this goal. (04/02/2022)

https://rtpg.co/2022/02/04/precision-in-technical-discussions.html

TL;DR: 

When working on the same domain, it's common for people to take shortcuts when describing something. Ambiguous statements can bring a fast switch of focus, from the subject of the discussion itself to a game of linguistic forensics. To achieve precision in technical discussions, it's insufficient to rely on the generic advice "imagine you are in the other person's shoes." We can instead rely on the following bits of advice.

Firstly we can make sure that the "WHO" and the "WHAT" are clear. If context and details are missing, it's mandatory to guide the reader towards collecting more information. 

Secondly, by providing the evidence of the issue or behavior described, it's possible to turn conjectures into ironclad statements.

In addition, it's better to avoid analogies. Analogies work when things are the same, up until the point that things are different.

In conclusion, we should state facts first and leave opinions until later. We must fight the urge to provide the conclusion upfront without furnishing the evidence first. If the objective is to convince someone of an idea, you should first present the truth. The opinion should follow, and not anticipate facts.

2- The right thing for the wrong reasons: FLOSS doesn't imply security

Rohan Kumar dismantles an automated assumption. Free, Libre and Open-Source Software (FLOSS) isn't inherently more secure than costly, closed-source software. (04/02/2022)

https://seirdy.one/2022/02/02/floss-security.html

TL;DR: 

The stance of the author is clear enough. It’s preferable to perform security analysis on binaries, without necessarily reading and analyzing the code. 

First of all, vulnerability discovery doesn’t typically rely on source code analysis. Reading code is not enough to know how a program operates. The only way is actually to run the program. And that is the reason why most already employ techniques to analyze run-time behavior that doesn’t depend on source code.

It's way easier to treat the code under analysis as a black box. By mixing dynamic analysis with tools such as "Wireshark" or "Strace" and Binary analysis, together with memory dumps, it's possible to have a clear understanding of how a program operates - without accessing its source code. They make up the workings of most modern malware analysis.

To make the analysis more accurate, it's possible to use also Fuzzing, which is a technique that automates the process of causing a program to fail by generating random or malformed data to feed it.

There are of course some counter-arguments to this thesis. For example, Fuzzing could be implemented faster with access to the source code. In general, it's still possible (even if improbable) to spot a vulnerability reading source code.

3- What makes a great developer — It’s more than just good code!

Nicky Christensen, an experienced Team and Technical Lead, writes about peculiar characteristics, apart from technical abilities, that are needed to make a Great Developer. (03/02/2022)

https://blog.devgenius.io/what-makes-a-great-developer-its-more-than-just-good-code-b0da43278d79

TL;DR: 

A great developer:

• has to be humble, having the willingness to take responsibility for mistakes as well as to learn from mistakes. 

• needs to be a team player, empowering and caring about other team members. 

• Is capable of seeing the “big picture”. He doesn’t only focus on the task at hand but takes in good measure the complete path that the team is taking. 

• has to understand the value of planning, grooming, retrospectives, and all the various processes surrounding software development. 

• never stops learning.

• has business acumen, he can see what and which features give business value for the company/product they are working on.

• sees opportunities rather than limitations.

4- Microsoft Uncovers New Details of Russian Hacking Campaign Targeting Ukraine

Some appetizing details on the tactics and procedures adopted by the Russian hacking group named Gamaredon. (04/02/2022)

https://thehackernews.com/2022/02/microsoft-uncovers-new-details-of.html

TL;DR: 

The cyberattacks aim at huge ranges of targets: government and military, law enforcement, and non-profit organizations. Those attacks compromised accounts at organizations critical to emergency response and ensuring the security of Ukrainian territory. 

Primarily, those attacks leverage spear-phishing emails as an initial access vector, carrying attachments with malicious code. This code triggers a multi-stage process that culminates in the deployment of several binaries: 

• PowerPunch: a PowerShell-based downloader used to retrieve other executables remotely

• QuietSieve: a .NET binary obfuscated with the main aim of data-exfiltration that can also receive and execute a remote payload from the operator and take screenshots of the compromised host every five minutes

• Pterodo: a feature-rich backdoor that also includes a range of capabilities that makes analysis more difficult

5- Why I Quit Shopify After Five Months

Josh Simmons writes about leaving one of the most important companies in the modern world. Another story that belongs to the movement of the Great Resignation. (04/02/2022)

https://www.joshcsimmons.com/posts/why-i-quit-shopify

TL;DR: 

Josh entered Shopify in a critical period when the company scaled its engineering department pretty aggressively. Shopify now is continuing to grow in the number of employees, and only six months in the company are needed to become an interviewer. It’s probably for this reason that the interview process wasn’t that good for Josh. 

What is different from Faang companies, is that the interview process is more focused on the story of the developer rather than the capacity of solving code problems efficiently. Josh received and accepted an offer, despite that he had to downgrade his role to senior developer to mid, and he had to cut off his salary.

During his work at the company, even if he was hired as a front-end developer, he spent most of his time coding in Ruby. To maintain his skill up to date, he worked on some front-end projects in his spare time. 

He quickly realized that his work at Shopify was not making him a better front-end developer. And that is the main reason he did quit. Although working at Shopify had several good aspects:

• optimal work-life balance

• great people

• great codebase

6- Security Risks Facing Web3 Developers

New security challenges may surface in Web3 as more decentralized applications (dApps) emerge. (09/02/2022)

https://thenewstack.io/?p=21271935

TL;DR: 

The first challenge the WEB3 has to face is the FOMO [fear of missing out]. This is bringing developers rushing in development, leaving not so much time up for security assessments. In addition, there is a great monetary value as an incentive for cyber attacks, and as there are lots of applications available, a lot of attack surface area.

Blockchains have already seen some significant security breaches. In the near past, a malicious actor was able to mint 120,000 ETH (approximately $360 million) in exploiting a bridge to the Solana blockchain. This loss was bailed out by investors to maintain the echo system active. 

If investors need to routinely bail out Web3 projects to the tune of hundreds of millions of dollars, they may be willing to trade a slower development cycle to achieve fewer exploits. 

To secure a web3 Application efficiently, we, as developers should treat our initial plunge as an exploratory journey. Review vulnerability write-ups and deconstructions of previous attacks. Projects affected by a compromise will typically post detailed write-ups. 

7- Nitpicky Code Reviews Are a Drag

Steve Barnegren writes about the downsides of executing too obsessive code reviews. (09/02/2022)

https://www.steveonstuff.com/2022/02/09/nitpicky-code-reviews-are-are-drag.html 

TL;DR: 

When a developer who did stringent code reviews left the company, nothing happened to the quality of the code. Instead, it brought less noise in the code reviews and more focus on the critical things.

We should be aware of raising issues that, once addressed, don't change the behavior of the code in any way. Neither makes the code more maintainable or more scalable. 

Our energies as humans are limited we should not waste our time on minor issues, just to make code more aesthetically pleasing. What makes code good is scaleable architecture, useful abstractions, good design.

We should, as developers, adopt the right mindset and focus just on what the code does, without being irked by minor issues. 

"So my advice is: when you’re about to make a nitpicky suggestion, take a deep breath, and just… let it go."

Joel Spolsky proposes a high-level protocol to standardize the creation of blocks inside WEB-based content editors. (27/01/2022)

https://www.joelonsoftware.com/2022/01/27/making-the-web-better-with-blocks/ 

TL;DR: 

Web editors around the web make great use of blocks. A block could be a Calendar, a Code Snippet, a Table, or an Image. In practice, it could be something that is not strictly text.

The UI concept that we can summarize as “Insert Block” is non-standard and proprietary. Every blog or content creation platform has to implement its way to include Blocks into its editor. Non-standardization brings a hard time to the end-user. Editors have to adapt to pretty different tools that do the same thing. 

The author proposes a new high-level, open, free, and non-proprietary Block Protocol. The noble purpose is to make life much easier for app developers to support many Block types. And for users to have always the same experience.

In addition, Blocks can have types. It will be possible to specify a schema that a Bock object should follow. In this way, Blocks will become machine-readable.

The implementation of the Block Protocol is in progress, and a very early draft of the block protocol is already accessible.

2- There’s No Such Thing as Clean Code

Steve Barnegren embarks on a crusade against incorrect terminology. (27/01/2022)

https://www.steveonstuff.com/2022/01/27/no-such-thing-as-clean-code

TL;DR: 

Clean does not describe any particular characteristic of the code. This word can be related to several aspects without binding with any one of them. For example, a code that is easily readable and understandable could be defined as clean. But clean could also mean elegant or performant; scalable and consistent.

Most of the traits inherently acquired by the clean word are at odds with each other. The most performant code is probably not the most readable. 

The point is that the word "clean" often means "good" when related to code. If a developer defines what he just wrote as clean, he doesn't know why it is good. It's fundamental to have a technical discussion about why a solution is better than another. The Clean word is just a shortcut for lazy developers. 

In the author's words: "Terms like "clean" allow us to cop-out, rather than working to improve our ability to articulate our ideas."

Furthermore, we need to use precise terms when working in a team. "Clean code" does not have a standardized meaning. It's overwhelmingly better to define code as "encapsulated" or "testable"; "mockable" and "reusable"; "performant" or "simple". Those terms have a precise semantic denotation for everyone.

3- Learn From Google’s Data Engineers: Don’t Optimize Your SQL

During his time in Google's division, Galen B. realized that SQL written by the smartest Data Engineers in the world is inefficient. (27/01/2022) 

https://blog.devgenius.io/learn-from-googles-data-engineers-don-t-optimize-your-sql-43f0da30701

TL;DR: 

Snapshotting massive tables without caring about the size of data created or using JOIN and EXIST on SCD (Slowly changing dimension) instead of MERGE is the default behavior of Google Data Engineers.

Why do they not care at all about computing optimization or the size of data created? 

First of all, modern databases have great real-time optimizations built-in. If the database itself cares about optimization, it's useless to waste time enhancing queries. Data Engineers leave the query optimization to the developers of the data engines they leverage. 

Secondly, compared to the salary of a data engineer, the cost of cloud computing is negligible. It's better to invest in a proficient data engineer that can bring new data assets and anticipate the needs of the business instead of wasting time optimizing queries.

Thirdly, the cost of storage nowadays is nearly free. For the same reason, it's better to allocate the time of data engineers to create business value.

4- Reasons Why Every Business is a Target of DDoS Attacks

In this article, we will discover why any Business on the web could be DDoSed successfully. (31/01/2022)

https://thehackernews.com/2022/01/reasons-why-every-business-is-target-of.html

TL;DR: 

There is a constant increase in the latest trends of DDoS attacks. In the year 2021, their quantity is increased by 24%. In addition, 74% of them have been multi-vector attacks.

In the past, the danger of being the victim of this kind of cyberattack wasn’t so high. Right now, even Small and Medium Enterprises (SMEs) should worry enough. Even if circa 40% of DDoS are aimed at Banks and Financial platforms, they could be aimed also at other businesses. 

The principal reasons why Every Business could be a Target of DDoS Attacks are:

• Many companies use old and Traditional technology that doesn’t suffice anymore. Legacy Firewalls are now pretty useless. Lots of SMEs use a lay-back approach. They wait until the worst happens. 

• Pandemic increased digitalization of organizations all around the world. This has brought a widening of the attack surface. 

• Technology advancements made DDoS attacks easy to do and cost-effective.

• Bringing a website down will decrease ranking in Search Engines. For this reason, It’s a great tool for gaining a competitive advantage. Website availability, together with customer feedback, are resources with really high value.

5- Software Deployment, Speed, and Safety

Marc Brooker an engineer at Amazon Web Services (AWS) compares speed and safety for production changes. (31/01/2022)

https://brooker.co.za/blog/2022/01/31/deployments.html

TL;DR: 

We could define “deployment” as all production modification of software or configuration. The great challenge that shows up is the definition of Goals and Tradeoffs between having FAST deployments or SAFE deployments.

The advantages of FAST deployments are the following:

• Developers usually want fast releases in production of the code they are working on

• Smaller increments of code-base mean arguably minor bug introduction

• Fast fixing of security alerts and bugs

• Fast development and shipment is better for any customer

The cons are all about RISK and SAFETY. Any new deployment and change in production will contain new flaws. Automated and manual Tests could only help partially to overcome this issue. 

An Incremental Deploy reduces greatly the RISKs introduced by those changes, but only if between deployments is passed enough time. That's because flaws need time to show up. Time is not measured with clocks. It's "work" time, better measured by the number of requests that the system has to serve.

The RISK of a bad deployment is also correlated to the size of the system under analysis. If we want high availability, we could rely on Distributed Systems. With a linear investment of resources, we can get an Exponential Availability increase. 

6- Building Infrastructure Platforms 

Poppy Rowse and Chris Shepherd identify 7 key principles to build Infrastructure Platform teams correctly (01/02/2022)

https://martinfowler.com/articles/building-infrastructure-platform.html

TL;DR: 

In the past, adding a simple API for your business was pretty complicated. Nowadays, a developer can build and deploy an APP in production in a few moments. The problem is that every developer could use a peculiar platform and configurations to host and deploy software. By building a Platform is possible to save time, reduce cloud spending, and increase the security and rigor of the infrastructure. 

Having a strategy with a measurable goal is the first thing you should consider when thinking about an Infrastructure Platform. To define a strategy you need the right people that will identify a specific problem. For example: "We have had outages of our products totaling 160 hours and over $2 million lost revenue in the past 18 months". Is easy to translate this problem into a GOAL: "Have less than 3 hours of outages in the next 18 months" and finally define a strategy to tackle the problem.

A strategy could be designed using POST MORTEM and FUTURE BACKWARDS sessions. Wich means using both a past and future lens. 

The purpose of the POST MORTEM session is to identify the root cause of the problems. The purpose of the FUTURE BACKWARDS session is to identify what would need to be true to meet goals.

At the end of these sessions, hopefully, you will have a wonderfully practical list of things you need to do to meet your goal. Otherwise, you will reach the awareness that spinning up a team to build an infrastructure platform isn't part of your strategy.

7- How to keep up with web development without falling into despair

Baldur Bjarnason lifts the burden of staying up to date with simple tips. (31/01/2022) 

https://www.baldurbjarnason.com/2022/i-cant-keep-up-with-web-dev/

TL;DR: 

Web development is not unique in the task of keeping up with change. Instead, it is arguably much lower compared to other fields. For example, medicine or biotech.

There are two main reasons that other fields do not have the same problems at keeping up that we do:

1.  They have collective/institutional filters to help you keep up with what is fundamental.

2. They specialize, without isolating, keeping up only with the knowledge that is a core part of their job.

To filter out this overwhelming flow of information, we can check out news relevant to your work questions ONLY. 

To choose our WORK questions correctly is the tricky part. You can start with general-purpose topics, and as you do your research, you rephrase them to become more specific. The questions change with the job. They could range from high to low level, from implementation details to abstraction. 

The last tip is to set aside about an hour or two a day for research. 

"And that’s how keeping up stops being a chore and becomes an interest-driven research activity that feeds your enthusiasm instead of draining it." 

In this article of the series: “Pattern of Legacy Displacement” in Martin Fowler’s blog is presented the “Divert the Flow” strategy, applied for decoupling upstream systems from critical Business Services. (20/01/2022)

https://martinfowler.com/articles/patterns-legacy-displacement/divert-the-flow.html

TL;DR:

A Critical Aggregator is a software component that aggregates data from various parts of the system to provide fundamental business information in a comprehensible form. It becomes an Invasive Critical Aggregator when strictly coupled with upstream systems, which are therefore unable to evolve independently.

The alternative at freezing upstream components until the Critical Aggregator is working is to apply a “Divert The Flow” strategy. The aim is simply to create a new implementation of the Critical Aggregator, decoupled from the upstream systems. 

The first action for substituting this software component is to understand how it works. Data sources aggregation, together with user requirements should be well known and analyzed.
In this phase, it is common to discover unknown issues of existing business logic. The suggestion is to fix those issues right away otherwise the same workaround could be placed into the new component.

Once functionality has been re-established, a parallel run of the old and the new system could provide easier testing and a better go-live experience. Selective use of reconciliation tools could also generate alerts if old and new implementations start to diverge too far. 

2- On Leaving Facebook 

Alex Kotliarskyi writes about leaving one of the most important companies in the modern world. A story belonging to the movement of the Great Resignation. (21/01/2022)

https://frantic.im/leaving-facebook/

TL;DR:

The Motivations that brought him to leave Facebook, as one can imagine, are beyond salary, benefits, or social status.

Alex started working there in October 2012 in the golden era of the company. Exciting engaging projects one after the other. As the days went by, the initial magic was gone. Quality, craft, and focus weren’t as important as scale, metrics, and PSC. As the big corporation brought more politics, leadership changes, and reorgs into play, the motivation to leave grew stronger. 

The journey to leave Facebook took Alex 3 months. He took this time to evaluate, analyze, and rethink his career. He deepened his knowledge about the IT market, IT companies, and himself.

After several applications and lots of time preparing for interviews, he ended up accepting an offer with roughly 70% of the money that he was making at Facebook. Work-life balance was not even in his parameter of choices as in Facebook he could get by barely working a few hours a day. Doing fulfilling work is more important than salary or work-life balance. 

3- Tech Debt Explained to Everyone

Javier Lopez, Software Consultant Lead at Thoughtworks, writes about Tech Debt and how he categorizes it in four main types. (22/01/2022)

https://blog.devgenius.io/tech-debt-explained-for-everyone-2920fff97416

TL;DR:

Technical Debt it’s a metaphor explaining the generated complexity for system evolution introduced by defective software implementations.

It’s possible to categorize Technical Debt (TD) into four main categories:

• Prudent deliberate TD: introduced by conscious decisions, taken to fasten implementations. It’s a good way to prioritize the development of critical business areas. 

• Reckless Deliberate TD: as in the previous case, it’s a conscious decision, but taken without a deep analysis of the consequences.

• Prudent Inadvertent TD: introduced trying to discover the correct way of solving the problem during development.

• Reckless Inadvertent TD: the result of pure uncertainty. 

As it is very hard to measure, tasks that address the solutions of TD could not compete in importance with the development of new functionality. It’s possible to solve TD while working on other tasks, but usually, that's not enough. 

It’s impossible to not introduce TD with new implementations. That’s why continuous refactoring and a specific developer’s focus are needed to maintain a healthy codebase. 

4- Fixing Performance Regressions Before they Happen

This article presents the journey and the challenges that brought Netflix to the adoption of a very peculiar performance testing strategy. (24/01/2022) 

https://netflixtechblog.com/fixing-performance-regressions-before-they-happen-eab2602b86fe

TL;DR:

Netflix needs to measure two main values: Memory (maximum used value) and Responsiveness (median value). Tests need to be executed pre and post-merge onto the main branch of the codebase. 

Givin for granted that a real case scenario will always be different from a simulated one, the main challenge that Netflix has to overcome is the difficulty of defining the “failure” of a performance evaluation. Defining a static threshold does not suffice.

Netflix breaks the analysis of test results identifying two main singularities:

• Anomalies (values major than a dynamic value: N multiplied for the standard deviation of the latest M tests, with N and M configurable values). An anomaly identifies a failure of the performance test.

• Changing Points (values that identify a behavioral change in the series of tests). One changing point identifies implementation that can be further analyzed to check for regressions.

To decrease false positives and reduce noise, each test is executed three times, and the minimum value of the three is selected.

5- Gemini is a Little Gem

Gemini is a protocol of hypertext distribution. In this article, Andre Garzia addresses some criticism about it. (25/01/2022)

https://andregarzia.com/2022/01/gemini-is-a-little-gem.html 

TL;DR:

Gemini is more than a protocol: it’s composed of many vibrant communities. Do not focus on protocol alone. 

Gemtext (the syntax used to serve a Gemini resource) is just another Markdown: it’s easy for writers to use and for a computer to parse. Is biased towards textual content.

You can hold Gemini in your head: In comparison with the huge number of specifications of the Web, Gemini is really simple to implement and understand.

Constraints shine a spotlight on features: Gemini does not provide cookies or scripting. Simple markup it’s enough to provide users with documents. While it’s true that his privacy is not completely granted, its default configuration is still more private than the Web.

The replacement rhetoric is boring: users of Gemini do not want the Web to die. They just like to use this protocol. 

Gemini is old-school-ish: old technology doesn’t mean that is bad. Old-school paradigms have their place. It’s boring, it fades into the background so that you can focus on what matters: the content.

Gemini is an exclusivist community: it enables those with older machines, retro computer enthusiasts, and many others to take part in a web-like experience.

6- In defense of complicated programming languages

The simplicity of a programming language is not always a plus. Jakob expresses his idea on the abstraction and complexities introduced by complex programming languages. (23/01/2022)

https://viralinstruction.com/posts/defense/

TL;DR:

When Jacob was learning for the first time about Classes in Python, he didn't grasp the concept. It's still possible to bypass classes and obtain the same results. That was because Classes or other constructs solve a peculiar problem: managing the complexity of code. If the project is simple enough, there is no need to introduce Classes. 

A python with no classes will be simple! Consider anyway that if the project grows in complexity sufficiently, it's pretty sure that structure "classes-like" will emerge in the code. 

The trend of using simple programming languages such as Zig is increasing lately. The point is that if we remove complexity from the programming languages themselves, we will end up moving the complexity elsewhere.

In the end, the choice is between introducing complexities yourself or using a specific functionality already provided by a complex programming language.

7- Does the software industry learn

Can we truly learn without considering the past? Tom Renner (24/01/2022)

https://www.tomrenner.com/blog/2022-01-24/does-the-software-industry-learn

TL;DR:

Institutional Knowledge is the information that a company collectively retains. It’s protected and valued. Institutional learning instead is the process of getting to know all the information needed to work in a company.

Many companies, especially smaller ones, try to optimize the process of acquiring institutional knowledge. What is difficult to track and optimize instead, is Industrial Knowledge.

Software developers thrive to learn new things. Industrial Learning is a huge part of our job, as we very often learn new frameworks or languages. But is this learning related to a more general-purpose Knowledge?

Usually, the new technology point-blank replaces the old. As new trends emerge, we thrive to remain on top without considering the past. 

The problem is that learning should be built on top of a previous experience. It’s not common to find articles and comparisons looking back at past languages.

“We need more historians and librarians in our ecosystem and fewer blue-sky thinkers” for true knowledge could have a strong foundation only if it truly founders into the past.

In this article Gunnar Morling (Red Hat open-source developer) talks about what sets apart a good error message from a bad one. (13/01/2022)

https://www.morling.dev/blog/whats-in-a-good-error-message/

TL;DR: 

Firstly we need to clarify that the readers of those well-formatted error messages are the developers. Those presented are not guidelines for end-user client messages, but for library or framework errors, which are going to be logged or thrown as exceptions.

Those kinds of errors should provide three pieces of information:

1. Context (what is causing the error)

2. The error (what is failing) 

3. Mitigation (how to overcome the error)

1 - The Context should give the reader pieces of information about what the code was trying to do when it failed. Another good practice is to use structured log statements for information about the context. In this way, consumers of the log files could easily filter relevant information with simple queries.

 2- The error message should precisely and with fewer words possible describe what is failing. It’s possible to provide two different messages for the same error, one more detailed than the other. The longer version of the error should be provided only if “verbosity” is increased.

3- The mitigation of the error should always be provided in the message, if available. There are several ways to detail messages with mitigation actions. The key concept is: never leave the user in front of a closed-door without giving him a bunch of keys to try.

Additional best practices when it comes to error messages:

• Uniform voice and style (be style consistent)

• One concept, one term (be semantically consistent)

• Don’t localize error messages (use only English)

• Don’t make error messages an API contract (do not rely on error messages to implement business logic)

• Be cautious about exposing sensitive data (take in good care who have access to those logs)

• Either raise an exception OR log an error, but not both (double the log, double the confusion)

• Fail early (the earlier, the better)

2- Open-Source Alternatives for Google Analytics

Alex Ivanovs, experienced web project manager, confronts various open-source analytics software with the well-known google analytics. (14/01/2022)

https://stackdiary.com/open-source-analytics/

TL;DR:

Google website analytics is in the top list when searching google for “free website analytics” and that’s no surprise. The main advice is to go past the first three results and consider some alternatives. Let’s see why.

The first point to consider when confronting Google with other free analytic software is that it uses its data to show targeted ads, and for this reason, you have to use an extensive Privacy Policy to meet the requirements of the GDPR. With an open-source solution, you could track website analytics without collecting any personal data, and you can completely avoid the boring “cookie notice”.

Other disadvantages of the GA, includes the fact that it’s a huge script (~45kb) and some browser like Firefox directly block those scripts. And lastly, the GA dashboard it’s painfully slow. 

Now regarding open-source analytics software, the author goes straight to the point: does open-source mean free? Simply said, no. And the reason is that you need to host and manage the solution, which involves also paying for the server cost together with keeping it updated to the latest version. Another solution would be to pay a small subscription fee to use the SaaS provided by the various software houses.

Lastly, the article contains an extensive comparison with the strengths and weaknesses of various open-source tracking solutions like Plausible, Matomo, PostHog, and others.

3- Exploiting IndexedDB API information leaks in Safari 15

An IndexedDB API made any website capable of tracking your internet activity and revealing your identity. By Martin Bajanik, Software Engineer. (14/01/2022)

https://fingerprintjs.com/blog/indexeddb-api-browser-vulnerability-safari-15/

TL;DR:

IndexedDB is a browser API to store data on web clients. Each major browsers have its implementation and great amounts of popular websites rely on this protocol to store user information (among the others: youtube, google calendar, google keep). Each website uses a specific IndexedDB database identified by its name.

The problem with Safari 15 is that every time a website interacts with this API, a new database with the same name is created in all frames tabs and windows within the same browser session. This means that a malicious website can learn what website the user visits in different tabs or windows. It should be enough to poll the indexedDB.databases() API to check for changes.

Fingerprint.js created a demo page that demonstrates how a website can learn the Google account identity of any visitor by exploiting this vulnerability. You can test it out at: https://safarileaks.com

The only action the user can take to protect himself from this leak is not to use Safari until the issue is resolved. (It seems that the bug is fixed, but the malfunction will continue to exist until the new Safari release)

4- How Bad Is QWERTY, Really? A Review of the Literature, such as It Is

Confronting QUERTY keyboard layout with other standards. Have you have considered a transaction to be something better? A well evidenced, complete, and accurate comparison of ergonomics and productivity differences, by Erich Grunewald. (15/01/2022)

https://www.erichgrunewald.com/posts/how-bad-is-qwerty-really-a-review-of-the-literature-such-as-it-is/

TL;DR:

Due to a bad case of RSI (Repetitive Strain Injury), the author switched from typing on QUERTY to Colemak. In this article, he analyzes the theory and scientific evidence about better ergonomics and productivity in different keyboard layouts, with a specific look at what keyboard layout may cause more injuries when used.

Generally speaking, starting from defining quantitative models when measuring the typing effort of a key layout, Carpalx’s project states that, QWERTY is bad, though better than the average random key layout. Dvorak does better, and Colemak is better still.

Regarding ergonomics and risk of injury, the evidence is weak: there are no scientific studies that state that Bad key layouts could be a major part of the RSI cause.

Talking about productivity, two different studies (Liebowitz, S. J., & Margolis, S. E. (1990). The fable of the keys / Cho, H. (2014). Comparing QWERTY and Dvorak Keyboard Speed: a Pilot Study) state that there is a 5% typing speed advantage for Dvorak over Querty. However, considering also the cost of the familiarization with a different keyboard layout, which may be high (2 to 24 days), the choice to switch is not so trivial. 

5- Enforcing the Pyramid of Open Source

Daniel Stenberg describes the world of software and open source as a pyramid. (17/01/2022)

https://daniel.haxx.se/blog/2022/01/17/enforcing-the-pyramid-of-open-source/

TL;DR:

Upper layers are built using lower layers. The more we go up in the scheme, the more software usually uses open source components. Is there any interest, for large companies on the extreme top (which usually makes lots of money) to support open-source software of the lower layers? 

Top layers should always support the open-source components that they are using. Morality is not important in this case. Supporting open source does have a positive impact. For example, a company could decide to prevent vulnerabilities instead of waiting for the next log4j flaws, through caring about lower layers. It’s impossible to build a skyscraper without considering how to improve bricks.

6- There is no such thing as a static website

Does the division between static and dynamic websites still make any sense? An interesting article by Wesley Aptekar-Cassels. (13/01/2022)

https://blog.wesleyac.com/posts/no-static-websites

TL;DR:

We use static and dynamic keywords when referring to a website for several reasons. 

First of all for simplicity of maintenance. HTTP server software is very robust and easy to maintain, whereas application servers tend to break more frequently. In addition, it’s very easy to outsource the maintenance of static websites for free (see GitHub Pages for example).

Another reason which makes this taxonomy someway relevant is the operational complexity. But consider, as an example, that static websites have to handle the HTTPS certificate, or an HTTP Basic Authentication, which makes them in some ways dynamic. Furthermore, when the static/dynamic divide was created, working isolation primitives didn't exist. Right now it’s way too easy to rely on stable dynamic computation, for example with serverless programming.

The more those dynamic computations become solid and stable (like the file system API which serves static files) the more the distinction between dynamic and static should be irrelevant. Our aim as developers should be to make it easy to deploy dynamic applications as it is for static websites. To build “software is stable and simple” … “which fades into the background and becomes infrastructure”

7- Tired of the Modern Web? Discover some ‘Retro’ protocols you still can use today

It could be tiring to follow all kinds of new standards and protocols when it comes to web development. In this article, Dimitrii Eliuseev (Python and IoT Developer) brings us back in history. With a slight touch of nostalgia. (15/01/2022)

https://blog.devgenius.io/tired-of-the-modern-web-discover-some-retro-protocols-you-still-can-use-today-30bbca48d3f2

TL;DR:

The first specification of FTP was published on 16 April 1971, that’s 51 years ago. It’s surprising how it is still in use to the current day. https://www.mmnt.net/ contains a list of public FTP clients still maintained and available, some of which with very interesting content. 

BBS (Bulletin Board System) was the first rudimentary way of connecting two hosts to exchange data. First modems accomplished this using audio frequencies with a standard phone handset! Also in this case there are still some BSS operating today, mostly maintained by tech enthusiasts. 

Gopher was a protocol ahead of his times. Born for the need to search and read data in specific ways (which was not possible with simple FTP). Even if Gopher had a short lifespan, due to his license (not free) and some technical issues, there are still passionate hobbyists maintaining active gopher-based servers.

Check out the complete article if you want to deepen your knowledge or read about other ancient protocols like IRC or Usenet.

Subscribe now