NDC Oslo 2015: Talk notes, recommended talks (security, FP, etc.)
To (perhaps) check later
Wednesday
- Practical CSS tips & tricks for backend developers - really useful tips! video
- No Estimates, Let's Explore the Possibilities video
- Form with Function: Adding Behavior with CSS - recommended by a friend (modal dialogs, tab switching, ...) video
- ? Anti-fragile and feedback. Trying to make up for the failures of "agile." video
- ? JavaScript Forensics - not sure what this is about but it might be interesting
- ? Designing and Programming Accessible Website and App UIs video
Thursday
- ? Declarative REST: State Machines for the Web video
- Continuous Delivery for Architects - Neal Ford video
- ? Desktop applications using JavaScript and Electron video
- ? High Performance in the Critical Rendering Path - how to make pages to load fast video
- This is Water - Neal Ford - an excursion into a strange, fantastical world with things like immutable database server, phoenix machines, and lambdas. video
- Securing Web APIs – Patterns & Anti-Patterns video
- ? Functional Data - event sourcing & FP video
- Authentication and authorization in modern JavaScript web applications – how hard can it be? video
- ? Taking other peoples money: A guide to online payments video
- ? Running Docker and Containers in Development and Production video
- Not Even Close: The State of Computer Security
Friday
- 595 billions income - untouched by human hands video
- Boosting security with HTTP headers video
- The rest of ReST - we'll look at the challenges of building usable real-world ReST APIs: Hypertext Application Language (HAL), HTTP Patch, ... video
- ? How do you scale a logging infrastructure to accept a billion messages a day? - DB -> ELK -> ELK + Kafka video
- ? Learning Client Hypermedia from the Ground Up - how to move specific knowledge of 1) addresses, 2) inputs, and 3) workflow out of the client app and place it into the message => a more robust, adaptable, and resilient client video
- ? Make it Faster - Lessons Learned from Benchmarking NoSQL on the AWS Cloud - best practices for performing database benchmarking on the AWS cloud & how to get more speed and efficiency in your production workloads video
- ? Crafting Evolvable Web API Representations - like structuring for evolution, sizing for optimum caching, the different ways to include metadata, ... video
- ? Mob Programming, A Whole Team Approach video
- ? Removing barriers - JetBrains's good and bad expericences with minimizing management video
Keynote Data and Goliath ☆☆☆☆
Continue reading →
NDC: Async and Streaming JavaScript, We're All Doing it Wrong! (Promises, Streams, Rx)
Events
Lot of work (setup, remove listeners ...), not composable.
Promises
No way to abort promise in progress. (Me: has to remember to check for errors:
then(onOk, onError).)No try-catch-finally; only try-catch.
Streams
Node: Stream 1 were terrible (pause/resume unusable, data sent before ready, ...).
Continue reading →
Why do companies fail at adopting Functional Programming?
Continue reading →
Example: Functional Reactive Programming decisively beats Imperative on simplicity, length
The game
Use the Up and Down keys to move the platforms and thus bounce the ball from left to right and back:
The imperative solution
Continue reading →
Notes from Troy Hunt's Hack Yourself First workshop
Troy Hunt (@troyhunt, blog) had a great, very hands-on 2-day workshop about webapp security at NDC Oslo. Here are my notes.
Highlights - resources
Personal security and privacy
- https://www.entropay.com/ - a Prepaid Virtual Visa Card
- mailinator.com - tmp email
- f-secure VPN
- https://www.netsparker.com/ - scan a site for issues (insecure cookies, framework disclosure, SQL injection, …) (lot of $k)
Site security
- https://report-uri.io/ - get reports when CSP rules violated; also displays CSP headers for a site in a human-friendly way
- https://securityheaders.io/ check quality of headers wrt security
- free SSL - http://www.startssl.com/, https://www.cloudflare.com/ (also provides web app firewall and other protections) ;
- SSL quality check: https://www.ssllabs.com/ssltest/
- https://letsencrypt.org/ - free, automated, open Certificate Authority (Linux Found., Mozilla)
- HSTS Preload - tell Chrome, FF that your site should only be ever loaded over HTTPS - https://hstspreload.appspot.com/
Breaches etc.
- http://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/
- https://twitter.com/jmgosney - one of ppl behind http://passwordscon.org . http://password-hashing.net experts panel. Team Hashcat.
- http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/
To follow
- ! http://krebsonsecurity.com/
- ! http://www.troyhunt.com/
- ! https://www.schneier.com/
- ! https://twitter.com/mikko (of F-Secure) also great [TED] talks
- kevin mitnick (jailed for hacking; twitter, books)
Continue reading →
AWS API: Proper syntax for filtering by tag name and value (e.g. describeInstances)
Continue reading →
Mounting an EBS volume to Docker on AWS Elastic Beanstal
I will describe how to automatically create and mount a new EBS volume (optionally based on a snapshot). If you would prefer to mount a specific, existing EBS volume, you should check out leg100's docker-ebs-attach (using AWS API to mount the volume) that you can use either in a multi-container setup or just include the relevant parts in your own Dockerfile.
The problem with EBS volumes is that, if I am correct, a volume can only be mounted to a single EC2 instance - and thus doesn't play well with EB's autoscaling. That is why EB supports only creating and mounting a fresh volume for each instance.
Continue reading →
All-in-one Docker with Grafana, InfluxDB, and cloudwatch-to-graphite for AWS/Beanstalk monitoring
Continue reading →
OS X: Using scutils to discover whether/what a web proxy is in use
networksetup -getwebproxy However that does not always work - for example when using "Auto Proxy Discovery" and/or "Automatic Proxy Configuration" with a proxy.pac file.
scutils --proxy seems to detect all these cases (though it cannot give you the proxy when using auto config, I suppose):
Continue reading →
Hack: Quickly Verify That All Your Mocha/Chai Tests Have Valid Assertions
Anyway, there is a neat quick way to verify that all your tests have at least one valid assertion - simply replace
expect with expect.not.
Continue reading →
iTerm coprocess reporting result of (Mocha) tests run via nodemon
Continue reading →
My Highlights from Continuous Delivery and DevOps Conference 2015
Continue reading →
Backup WD MyCloud to S3/Glacier with duplicity (build instructions included)
How does the backup work: duplicity does its job and uploads files to S3. The large data archives are recognized by S3 Lifecycle rules that we set up based on their prefix and moved to the Glacier storage class soon after upload. (It takes hours to restore something from Glacier but its cost is orders of magnitude lower than that of S3 itself). We leave metadata files in S3 so that duplicity can read them.
90% of this is based on http://www.x2q.net/2013/02/24/howto-backup-wd-mybook-live-to-amazon-s3-and-glacier/ and the WD build guide (http://community.wd.com/t5/WD-My-Cloud/GUIDE-Building-packages-for-the-new-firmware-someone-tried-it/m-p/770653#M18650 and the update at http://community.wd.com/t5/WD-My-Cloud/GUIDE-Building-packages-for-the-new-firmware-someone-tried-it/m-p/841385#M27799). Kudos to the authors!
You will need to:
- Build duplicity and its dependencies (since WD Debian v04 switched to page size of 64kB, all pre-built binaries are unusable)
- Configure S3 to move the data files to Glacier after 0 days
- Create your backup script - see
backup-pictures-to-s3.sh - Schedule to run incremental backups regularly via Cron
- Preferably test restore manually
Continue reading →
AWS CloudWatch Alarms Too Noisy Due To Ignoring Missing Data in Averages
Continue reading →
Git pre-commit hook that fails if "it.only" used (Jest/Jasmine)
Continue reading →