VSHN.timer

VSHN.timer #162: Mastodon Rising

14. Nov. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about how a relatively obscure distributed social network is teaching everyone a few lessons in resilience, availability, and freedom.

1. What is Mastodon? Why have a million users joined it recently? Why is the BBC talking about it? How does it work? Natasha Nox has written a fantastic quick guide for newcomers but she’s not the only one: our own Tobru wrote one, too. (Oh and by the way there are a few VSHNeers you can already follow on Mastodon: Tobru, Manuel, Daniel, and yours truly.)

https://blog.natanox.de/1932/mastodon-guide/

2. One of the key things to understand about Mastodon is that it’s not a centralized service like Twitter, but, being part of the Fediverse, it’s a distributed one, and everyone can run their own instance. But what does it take to run one? How do you cope with the costs and responsibilities of managing a community? Tobias and Leah are behind the chaos.social Mastodon instance, and they explain the good, the bad, and the ugly parts of running it.

https://rixx.de/blog/on-running-a-mastodon-instance/

3. These last few days Greta Thunberg and Stephen Fry have joined Mastodon, amassing thousands of followers in a few minutes, and this put lots of pressure on the community-run servers, and the whole network. Even Masto.host had to suspend signups due to the influx of new users and customers of their service! Aral Balkan explains how celebrities could have an effect akin to DDoS attacks on Mastodon, and how to solve this problem.

https://ar.al/2022/11/09/is-the-fediverse-about-to-get-fryed-or-why-every-toot-is-also-a-potential-denial-of-service-attack/

4. But what happened with Twitter? Well, after the takeover, the layoffs, and the overall cruel changes, many SREs have been fired and now the service is starting to show signs of a severe breakdown. Even worse, such a failure could potentially wipe out a substantial record of human history registered over the past 15 years. We’re witnessing a pivotal moment in social media history as we speak.

https://www.technologyreview.com/2022/11/08/1062886/heres-how-a-twitter-engineer-says-it-will-break-in-the-coming-weeks/

5. Meanwhile, the #TwitterMigration continues. People are learning how to verify their profiles using GitHub, how to archive the contents of their accounts, how to perform DNS queries over Mastodon, and how to use Debirdify, Fedifinder, or Twitodon to find their Twitter friends on the Fediverse.

Do you have a Mastodon account? Are you running your own instance? Would you like to share some Mastodon tips and tricks with our readers? Get in touch with us including your Mastodon username, and see you next week for another edition of VSHN.timer.

PS: check out our previous VSHN.timer editions about Quality Assurance, SLAs & SREs: #6, #34, #43, #66, #104, and #136.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #161: The Various Evolutions of Linux

7. Nov. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the latest news around Linux, the operating system of choice for most VSHNeers.

1. Kubernetes and Linux have many things in common; both are open source, both have distributions, and both include scheduling, security, and logging facilities. For that reason, the Aurae runtime has the bold goal of replacing the notorious systemd, while also making some improvements to the core components of Kubernetes. It’s all part of the natural evolution of things.

2. Maybe you’ve heard about Wine? It’s a compatibility layer for running Windows apps on operating systems such as Linux, macOS, or BSD. But do you know how it works? Hint: it’s not a virtual machine, and it’s not an emulator. It’s quite clever actually.

https://werat.dev/blog/how-wine-works-101/

3. Lots of news from the distributions front: KDE Plasma 5.26 is all about widgets; Zorin OS 16.2 brings plenty of improvements; we’ve played a bit with ravynOS (OK, OK, we know, it’s a BSD, but still, it shows it’s not dying); and we’ve discovered Wolfi, the first Linux (un)distro (that is, a distroless base to be used within containers) designed for securing the software supply chain. Looks like Alpine got some competition now.

https://www.chainguard.dev/unchained/introducing-wolfi-the-first-linux-un-distro

4. What about good hardware to run your favorite Linux distribution? We’ve discovered Minifree lately, offering laptops with coreboot, osboot, or libreboot preinstalled. But we’re even more excited about the Ox64 announcement by PINE64, a sub-$10 Linux-capable single-board computer.

https://www.pine64.org/2022/10/15/october-update-an-ox-no-bull/

5. Do you want to train or improve your Linux debugging skills? Would you like to practice for your next SRE or DevOps interview? Then you should try SadServers: get a full remote Linux server with a problem and fix it. Just take your time to do it well.

https://sadservers.com/

Which distribution of Linux are you running on your laptop? Did you know how Wine worked? Would you like to share some Linux tips and tricks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: check out our previous VSHN.timer editions about Linux: #45, #55, #72, #96, #105, and #125.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #160: Programming For (And On) The Cloud

31. Okt. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the IDEs, languages, and debuggers that Cloud Native developers use to build their apps.

1. Are you using Cloud IDEs? There are plenty of them: AWS Cloud9, Eclipse Che, GitLab, Coder, GitHub Codespaces, Gitpod… but then, most developers still clutch at their workstations and preferred code editors running locally. Why is that? Corey Quinn investigates.

https://www.lastweekinaws.com/blog/the-real-reason-cloud-ide-adoption-is-lagging/

2. Are you writing Python code? Then you should know that Python 3.11 was released last week. A notable release, not only for its new features (like including TOML parsing or the Self type) but also because it’s between 10-60% faster than Python 3.10.

https://discuss.python.org/t/python-3-11-0-final-is-now-available/20291

3. Are you debugging Kubernetes pods with stdout? Then you should try mirrord instead. The Metalbear team recently released version 3.0 of this open-source tool that makes your locally run process believe it’s running in the cloud.

https://metalbear.co/blog/mirrord-3.0-is-out/

4. Are you hosting a static website? Then you might find Cloudflare Pages interesting: it lets you host static websites with all the latest optimizations, and for free. Taras Glek thinks they are the best server tech since cgi-bin and tells you everything you need to know.

https://taras.glek.net/post/cloudflare-pages-kind-of-amazing/

5. Are you using GitHub Copilot? Then you might want to check out the investigation carried out by Matthew Butterick, writer, programmer, and lawyer, who’s investigating a poten­tial law­suit against GitHub Copi­lot for vio­lat­ing its legal duties to open-source authors and end users. Oops.

https://githubcopilotinvestigation.com/

Are you reading the questions at the end of each VSHN.timer? Are you programming some cool new Cloud Native app? Are you willing to share tips and tricks with the community? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about programming: #18, #30, #33, #47, #50, #60, #77, #88, #101, #103, #122, and #137.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #159: Always Sunny In The Rich Cloud’s World

24. Okt. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about businesses working all night, working all day, to pay the Cloud bills they have to pay, ain’t it sad? And still, there never seems to be a single penny left for them. That’s too bad.

1. David Heinemeier Hansson, of Basecamp, Hey, and Ruby on Rails fame, argues that renting computers on the Cloud is a bad deal for medium-sized companies with stable growth; in their case, it means over half a million dollars per year for services from Amazon just to run Hey!

https://world.hey.com/dhh/why-we-re-leaving-the-cloud-654b47e0

2. The world economy is heading into recession, and according to a new study, 81% of executives and directors have ordered to reduce or take on no additional cloud spending. Is this the end of an era?

https://www.infoworld.com/article/3676597/was-moving-to-cloud-a-mistake.html

3. Speaking about slowing cloud spending, Docker is increasing prices between 14% and 28% this week and is also restricting the size of Team accounts to 100 users, pushing affected organizations to upgrade. You might want to review your contract quickly.

https://devclass.com/2022/10/20/docker-quietly-raises-prices-limits-team-accounts/

4. Wanclouds commissioned a survey of more than 500 U.S. IT decision-makers in Q3 of 2022 and compiled the results into the 2022 Cloud Cost and Optimization Outlook. In a nutshell: Cloud spending is slowing down, and Kubernetes appears as a major driver of Cloud costs.

https://wanclouds.net/survey_report/Wanclouds_2022_Cloud_Cost_and_Optimization_Outlook_Report.html

5. The VSHN.timer tool of the week is the AWS Pricing Google Sheets add-on, adding the latest AWS pricing data in your spreadsheets, making it easy to perform cloud cost analysis directly without error-prone copy-and-paste from pricing websites. It even tracks the latest discounts from AWS!

https://github.com/mheffner/aws-pricing

How do you manage cloud costs in your organization? Do you think you must leave, you have to go, to Las Vegas or Monaco? Would you like to suggest some cost-saving tips to our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about business: #15, #26, #35, #41, #70, #112, and #141.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #158: The Rise of CockroachDB

17. Okt. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about CockroachDB, the world’s most evolved cloud SQL database.

If you’re interested in learning how CockroachDB and APPUiO enable Taurus to be the undisputed leader in the Crypto and Web3 digital asset management industry, join us in our free webinar on Wednesday, November 2nd, 2022 at 14:00 CET! Patrick Schulz, Sales Engineer at Cockroach Labs, and Sébastien Pasche, VP of Engineering at Taurus and Cyber Security Expert, will explain how to use CockroachDB in a sensible, secure, and massive production environment.

1. CockroachDB is a Cloud Native database that ticks lots of pretty checkboxes: scalable, hardened, multi-cloud enabled, developer-friendly, and compatible with PostgreSQL. Interested? Download the freely available O’Reilly book „CockroachDB: The Definitive Guide“, together with plenty more material on the Cockroach Labs website.

https://www.cockroachlabs.com/guides/oreilly-cockroachdb-the-definitive-guide/

2. One of the most distinctive features of CockroachDB is its compatibility with PostgreSQL: it supports the PostgreSQL wire protocol and the majority of PostgreSQL syntax, which means that existing applications built on PostgreSQL can often be migrated to CockroachDB without changing application code.

https://www.cockroachlabs.com/docs/stable/postgresql-compatibility.html

3. Developers are enthusiastic about Cloud Native technologies but appreciate being able to use a familiar SQL dialect within their apps. Ali Ibrahim explains how to use Ruby on Rails with CockroachDB, but it can also be used with Python, JavaScript, Go, Java, C#, Rust, and even Crystal.

https://blog.testdouble.com/posts/2021-03-26-using-cockroachdb-with-rails/

4. Join us in our upcoming free webinar on Wednesday, November 2nd at 14:00 CET to learn how CockroachDB enables Taurus to be the undisputed leader in the Crypto and Web3 digital asset management industry.

https://www.vshn.ch/en/events/webinar-how-taurus-runs-a-digital-asset-platform-on-cockroachdb-and-appuio/

5. How does CockroachDB compare to others? Their most well-known competitor is YugabyteDB, which also features PostgreSQL compatibility and other capabilities. After YugabyteDB published a comparison on their website, the CockroachDB team published a rebuttal of their own, backed with solid data. Competition is tough!

https://www.cockroachlabs.com/blog/unpacking-competitive-benchmarks/

Are you using CockroachDB in production? What programming languages are you using with it? Do you have any CockroachDB tips and tricks to share with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about databases and storage: #111, #115, #138, and #155.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #157: The Brand New OpenShift 4.11

10. Okt. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the latest version of Red Hat OpenShift: 4.11, released in August.

But before we start, did you know that APPUiO Cloud gives you instant access to a pay-per-use project in an OpenShift 4 cluster, enjoying all of the know-how and 24/7 support that only VSHN can provide? Create an account now and deploy your app right away!

1. Red Hat OpenShift 4.11 is loaded with lots of new features: based on Kubernetes 1.24, it includes 43 requests for enhancements (RFEs) from customers, among which the possibility of running multiple routers on the same node on different ports.

https://cloud.redhat.com/blog/a-wrap-up-of-openshift-4.11s-new-features

https://content.cloud.redhat.com/hubfs/Google%20Drive%20Integration/OpenShift%204.11%20Release%20Blog-1.png

2. Red Hat OpenShift 4.11 includes Kubernetes Native Disaster Recovery, helping you remedy outages ranging from the regional to the metropolitan to the local. And instead of reprovisioning every node from a traditional recovery cluster, OpenShift Disaster Recovery also stores information about all the services and Kubernetes APIs that were in place before the outage.

https://cloud.redhat.com/blog/kubernetes-native-disaster-recovery-comes-to-openshift-4.11

3. OpenShift 4.11 includes a pre-release version of the new agent-based installer for OpenShift. With this new agent subcommand, installing clusters on-premise has never been easier.

https://cloud.redhat.com/blog/meet-the-new-agent-based-openshift-installer-1

4. Working with databases in OpenShift? Red Hat OpenShift Database Access improves the self-service of managed databases by allowing developers to import Database-as-a-Service Provider Accounts directly into their application namespace, without any administrative intervention.

https://cloud.redhat.com/blog/a-guide-to-namespace-access-to-managed-databases-from-openshift

5. IBM announced last week that the Red Hat and IBM Storage businesses are coming together as a single group within IBM. This group will be responsible for the development and delivery of Red Hat OpenShift Data Foundation, Ceph Storage, and Gluster Storage.

https://access.redhat.com/announcements/6978646

Have you already updated your clusters to OpenShift 4.11? Do you need some guidance and would like us to help you? Do you have any OpenShift tips and tricks to share with the community? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Red Hat OpenShift: #9, #28, #53, #95, and #129.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #156: AWStruck!

3. Okt. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

Before the thrill of the AWS Swiss Cloud Day thaws, we’re going to talk about how companies build jigsaws on AWS.

1. Seesaws: we had the chance to attend the AWS Swiss Cloud Day last Thursday, gathering more than 3000 attendees in one of the biggest Swiss IT events in years. But it’s not over yet! This week we have AWS Innovate, an online conference to learn more about compute, storage, networking, and edge infrastructure. It includes the AWSome Day session for those wishing to start in this field.

https://aws.amazon.com/events/innovate-online-conference/emea/for-every-app/

2. Chainsaws! Pierce Freeman has been benchmarking GPU offerings among cloud providers and found insane differences! TL;DR: AWS beats GCP in GPU launch time by 66% and has 84 times fewer errors.

https://freeman.vc/notes/aws-vs-gcp-reliability-is-wildly-different

3. Flaws… because unfortunately, not everyone is entirely happy with AWS. Take for example Prerender, which moved its infrastructure away from AWS and made quite a few economies. Egress charges can be wild.

https://levelup.gitconnected.com/how-we-reduced-our-annual-server-costs-by-80-from-1m-to-200k-by-moving-away-from-aws-2b98cbd21b46

4. Paws? Here go some step-by-step instructions to deploy and run Red Hat OpenShift on AWS, either provided by Red Hat themselves, or by the community.

https://www.redhat.com/sysadmin/run-openshift-aws

5. Jaws: the VSHN.timer tool of the week is jsii, allowing code in any language to naturally interact with JavaScript classes. It’s the technology that enables the AWS Cloud Development Kit to deliver polyglot libraries from a single codebase!

https://github.com/aws/jsii

Are you clutching at straws? Have you ever ridden rickshaws? Do you know of any other strategy that redraws and outlaws your competition? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about AWS: #61, #87, and #132.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #155: There’s Something About SQLite

26. Sep. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about this wonderful thing in the public domain called SQLite, and its various uses.

1. We have already published a VSHN.timer issue dedicated to SQLite (that was #138) but clearly we’re not the only ones in awe. Nikos Vaggalis published a nice summary of the best things in SQLite, and there’s a lot to like: SQLite is cross-platform, supports lots of programming languages, is portable, and is backward-compatible. Oh, and it’s in the public domain, too.

https://i-programmer.info/news/84-database/15609-in-praise-of-sqlite.html

2. SQLite uses its own built-in virtual machine, to process queries and access data in a uniform way, no matter which operating system or programming language we’re using. Ben Johnson of Fly.io explains how the SQLite virtual machine works with an easily understandable article that doesn’t require you to have a Ph.D. in computer science. Oh, and Fly.io has also recently introduced LiteFS, an open-source distributed file system for SQLite. Check it out!

https://fly.io/blog/sqlite-virtual-machine/

3. You might be surprised by reading this, but no, the SQLite project is not stored in a Git repository. The SQLite team has built (and open-sourced) its own version control system, called Fossil, and it has quite a few differences from Git; for example, Fossil stores changesets in a… SQLite database! The always interesting Matt Rickard explains Fossil in his blog.

https://matt-rickard.com/sqlite-doesnt-use-git

4. Do you store SQLite files in S3 buckets? Would you like to be able to run SELECT queries against those databases? Wish no more, for s3sqlite is here to help you do exactly that.

https://github.com/litements/s3sqlite

5. Marmot is a distributed SQLite replicator that uses NATS, providing robust recovery and replication of your database files, and enabling your website to handle lots of traffic without issues.

https://github.com/maxpert/marmot

Have you tried replacing Git with Fossil? Are you replicating your SQLite databases in production? Would you like to share some SQLite tips and tricks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about databases and storage: #111, #115, and #138.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #154: Modern Times, Modern Work

19. Sep. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about how the world of work is evolving in this post-pandemic, crisis-laden world of ours.

1. Remote Work? Downturn? Great Resignation? How are we adapting at this crucial moment? A.Team and MassChallenge partnered on their first Tech Work Report, surveying 581 tech founders and executives (C-Suite or department leaders) based in the USA. The results are stunning.

https://www.a.team/mission/2022-tech-work-report

2. Did you know that many people working „from home“… are literally in a different country than their employers? (And no, we’re not talking about the VSHNeers currently in Canada!) As far as we understand, such practice is illegal in Switzerland, but hey, who knows? Maybe some of you are reading this from a beach in Bali? If that’s the case, let us know *wink wink*.

https://www.vice.com/en/article/4ax4gw/some-wfh-employees-have-a-secret-they-now-live-in-another-country

3. Netflix used to be famous for its participatory culture, where everyone was expected to ask (and receive answers to) tough questions. Well, apparently that’s all history now. Even Google is moving away from its traditional 20% working time projects! But do you know who has a great company culture? VSHN! Here’s our message to disgruntled Netflix and Google staff members: we’re hiring in Zürich and in Vancouver; how about working with us?

https://www.vulture.com/2022/07/netflix-to-its-techies-shut-up.html

4. Unless your technology business consists of selling 3.5“ diskettes, you might be interested in getting the attention of venture capitalists. But how to follow-up with them in an age of eternally full inboxes? Alina Gegamova from Sifted proposes a simple rule.

https://sifted.eu/articles/vc-follow-up-email/

5. Adobe’s purchase of Figma caught the design world off-guard. How about choosing an open-source tool instead? The VSHN.timer tool of the week is Penpot, an open-source design and prototyping tool for teams.

https://penpot.app/

How often do you send follow-up emails to potential investors? Are you really working from another country than your employer’s? Would you like to suggest co-working spaces in Bali to our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about PeopleOps: #7, #13, #15, #26, #35, #41, #52, #63, #85, #92, #116, and #131.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #153: When Dev and Ops Collide

12. Sep. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the various ways in which DevOps can collapse under its own weight, and what teams can do to avoid those traps.

1. Is DevOps really a good idea? This is the question many teams around the world are asking themselves. They realize that developers didn’t want to deal with operations and infrastructure, to begin with. Scott Carey argues that the time has come to rethink how to do DevOps… if at all. (German translation by Computerwoche.de)

https://www.infoworld.com/article/3669477/devs-don-t-want-to-do-ops.html

2. The Harvard Business Review published its first article openly advocating for empathy and understanding between team members and across hierarchies… in 1952. 70. Years. Ago. Are we there yet? This groundbreaking classic deserves to be read (or re-read) by all engineers and managers, Dev and Ops alike.

https://hbr.org/1991/11/barriers-and-gateways-to-communication

3. Too many meetings? Too many back-to-back meetings? You’re not alone. And you’re also in trouble, even if you don’t realize it. Teams all over the world are in charge of sensitive systems but not of their own schedules or quality processes. Such a situation is a time bomb waiting to explode, as explained by Tom Lingham.

https://tomlingham.com/articles/why-are-you-so-busy/

4. In the past decade, businesses of all sizes increased their cloud usage dramatically; in many cases, exponentially. But where are the cost reductions promised at the dawn of the Cloud era? Why aren’t companies monitoring their spending with FinOps? David Linthicum, Cloud Strategy Officer at Deloitte, explains the three main reasons why.

https://www.infoworld.com/article/3670851/3-reasons-cloud-computing-doesnt-save-money.html

5. What happened to sysadmins? How do new engineers learn the nuts and bolts of Linux system administration in these days of serverless and DevOps and microservices? Matt Rickard asks the right questions, as usual.

https://matt-rickard.com/the-lost-art-of-systems-administration

Do you do FinOps? Have you adopted DevOps in your organization, or have you found that it doesn’t really work? Would you like to tell us more about how you organize your development and operation teams? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about DevOps: #5, #13, #29, #31, #42, #110, and #133.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #152: The Challenges of Open Source

5. Sep. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about how to run Open Source projects (and also how not to!)

1. The Open Source software community has provided the world with amazing software available for literally no cost. André Staltz has analyzed the mean time between the release of a commercial software package and its Free and Open Source (FOSS) equivalent and sees that it’s getting smaller and smaller. We do not totally agree with the conclusions, though; organizations are going to keep making money with software in spite of the final observations of this article, and in various different ways. The analysis also considers both FOSS and commercial alternatives to be fully comparable in quality and features, which is not always the case.

https://staltz.com/time-till-open-source-alternative.html

2. Managing Free and Open Source projects is very complicated; there’s interpersonal conflict between team members, and also dealing with abuse from outsiders. And to top it off, there’s licensing: MIT or GPL? Apache or Public Domain? artemis everfree has published a widely shared rant about how the same binary is distributed with different licenses across various Linux distributions.

https://artemis.sh/2022/08/21/this-program-is-illegally-packaged-in-14-distributions.html

3. In the age of package distribution platforms, software vulnerabilities, and Software Bill of Materials (SBOMs), build reproducibility is becoming a major concern. Christian Rebischke, currently Arch Linux Trusted User, gives a glimpse at a day in the life of an Arch Linux package maintainer.

https://shibumi.dev/posts/day-in-the-life-of-a-package-maintainer-reproducible-go-packages/

4. Companies are building very strong businesses around Open Source software; take for example AdGuard and their DNS product, or NGINX, the makers of the fastest and most lightweight Open Source web server, leader of its segment for over 18 years.

https://www.nginx.com/blog/future-of-nginx-getting-back-to-our-open-source-roots/

5. Creating and managing Free and Open Source projects is no small feat. We recently found out that in 2020 Karl Fogel updated his landmark 2007 O’Reilly book „Producing Open Source Software“. A very useful resource for everyone dealing with the intricacies of FOSS projects, and even better, it’s completely free (as in beer) to download.

https://producingoss.com/

Have you open-sourced your code? How do you manage your FOSS projects? Would you like to share some tips and tricks with the our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #151: Something about Containers

29. Aug. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about containers, the essential building block of modern Cloud Native applications.

1. Ephemeral containers is an upcoming stable feature of Kubernetes 1.25 letting you run a container next to a running Pod. This comes in handy when troubleshooting distroless images, where kubectl exec won’t work. MetalBear explains everything you need to know about them.

https://metalbear.co/blog/getting-started-with-ephemeral-containers/

2. Matt Rickard explains some non-trivial uses of Docker, beyond the usual docker build and docker run commands: as a compiler, as a task runner, as an alternative to make, as a cross-platform compatibility layer, and more.

https://matt-rickard.com/non-obvious-docker-uses

3. Bitnami has been offering great base container images for a long time. Now they’ve reorganized them using a monorepo approach, so that users can navigate through all Bitnami containers in a single repository.

https://blog.bitnami.com/2022/07/new-source-of-truth-bitnami-containers.html

4. Great news for all of us who build container images with GitLab: Podman 4.2.0 now supports the GitLab Runner, which means that we can use it to create container images directly in our CI/CD pipelines. Oh, and there’s Podman Desktop now, too, have you tried it?

https://github.com/containers/podman/releases/tag/v4.2.0

5. Don’t miss ContainerDays 2022 next week in Hamburg! The agenda promises a great learning experience on various container-related subjects, like Kubernetes, Cloud Native, DevOps, GitOps, Edge Computing, and much more, in the Kampnagel international culture factory.

https://www.containerdays.io/

Are you attending ContainerDays next week? Are you more of a Docker or a Podman kind of DevOps engineer? Would you like to share some container tips and tricks with the community? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Containers: #12, #17, #40, #51, #54, #71, #81, #108, #124, and #144.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #150: Managing your Git Projects

22. Aug. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to enumerate some Git-specific project management tips and tricks.

1. Have you heard about „Stacked Pull Requests“? It’s the practice of breaking up a large PR into smaller, individually reviewable ones which can depend on each other, forming a directed acyclic graph. We’ve started using this approach at VSHN recently, and it’s been a major boost to our productivity and collaboration.

https://benjamincongdon.me/blog/2022/07/17/In-Praise-of-Stacked-PRs/

2. Have you ever said „no“ to a GitHub issue feature request? How could you do it? Should you do it at all? It turns out that yes, you probably should, and this Hacker News thread contains useful tips to help you get started.

https://news.ycombinator.com/item?id=32366248

3. Git can be conceptually a very complex tool, particularly for beginners. Sara Ford wrote down her preferred three git tips, demystifying some of its quirks, explaining why there’s no git undo, and showing us how to find the first occurrence of a bug without looking at the code.

https://github.com/saraford/three-git-tips

4. Software Bill of Materials (or SBOM for short) is a key ally in security and supply chain risk management. SBOMs are nested inventories with the full list of ingredients that make up a software component. GitBOM helps you in the creation and automation of your SBOM, enabling forensics, detecting vulnerabilities, and more.

https://gitbom.dev/

5. Want to enhance and have nicer-looking commit messages? Why not use emojis then? Since an image is worth a thousand words, here’s gitmoji, an emoji guide for your commit messages.

https://gitmoji.dev/

Do you use emojis in your commit messages? How do you manage your SBOMs? Do you have any Pull Request or Merge Request tips and tricks to share with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Git, GitOps, GitHub and GitLab: #10, #48, #68, #83, #98, #119, and #139.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #149: UDP, TTY, SEL, and AMD

15. Aug. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about hardware such as oscilloscopes, teletype terminals, cars, laptops, and more.

1. Can you read digital UDP packets with an analog oscilloscope? Matt Keeter says yes and shows us how, including the Rust code to translate from signals to actual packets being sent. Because science.

https://www.mattkeeter.com/blog/2022-08-11-udp/

2. All Unix geeks have seen the acronym „TTY“ appear in front of their eyes one day or another. But what is it? The SoByte team explains the history, going from teletypes, to ssh, and SIGINT signals.

https://www.sobyte.net/post/2022-05/tty/

3. Are you a Linux hacker? Have you bought a Hyundai Ioniq SEL recently? If you replied affirmatively to both questions, greenluigi1 teaches you how to build your own apps to run in its infotainment system.

https://programmingwithstyle.com/posts/howihackedmycar/

4. How does the Apple MacBook Air M2 running Asahi Linux compare against other recent laptops? Phoronix has benchmarked it against the AMD Ryzen 7 PRO 6850U „Rembrandt“ Zen 3+, the Intel Core i7 1280P „Alder Lake P“, and the AMD Ryzen 9 5900HX „Cezanne H“.

https://www.phoronix.com/review/apple-m2-linux

5. Building Kubernetes clusters with Raspberry Pis is one of the most popular hobbies among DevOps developers; we’ve talked about that last year, remember? Here’s another example, this time by Ricardo Sanchez.

https://github.com/ricsanfre/pi-cluster

Have you reverse-engineered your car’s infotainment system? Are you an oscilloscope aficionado? Would you like to share your passion for hardware hacks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about hardware: #80, #113, and #135.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #148: Kubernetes Observability

8. Aug. 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about tools helping us keep an eye over our Kubernetes clusters.

1. Pixie is an open-source observability tool for Kubernetes applications, used to view the high-level state of clusters and also drill down into more detailed views.

https://px.dev/

2. Sosivio eliminates ambiguities in Kubernetes with a tightly coupled data collection and AI tool, used to predict and prevent performance issues with your applications and orchestration issues with your environments.

https://sosiv.io/

3. Datree is an E2E policy enforcement solution that can be used on the command line, a webhook, or even as a kubectl plugin, automatically validating Kubernetes objects for rule violations, ensuring no misconfigurations reach production.

https://datree.io/

4. In March 2022, Grafana Labs released Grafana Mimir, the most scalable, most performant open source time series database in the world; now they’ve open sourced proxies to natively ingest metrics from Graphite, Datadog, and InfluxDB, and store these metrics in Mimir.

https://grafana.com/blog/2022/07/25/new-in-grafana-mimir-ingest-graphite-datadog-influx-and-prometheus-metrics-into-a-single-storage-backend/

5. The VSHN.timer tool of the week is Kubedog, a library to watch and follow Kubernetes resources in CI/CD deploy pipelines. This library is used in the werf CI/CD tool to track resources during the deploy process.

https://github.com/werf/kubedog

What tools do you use to observe your clusters? What metrics are the most important to you and your team? Would you like to share some observability tricks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about incidents and operations: #32, #41, #49, #66, #75, #89, #107, and #121.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #147: Thinking Differently

25. Juli 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to open our minds to different perspectives on common subjects.

1. Thinking differently about Docker… Matt Rickard proposes interesting use cases around it that go beyond the usual containers we run on our Kubernetes clusters: as a compiler, as a replacement to make, as a cross-platform compatibility layer, and more.

https://matt-rickard.com/non-obvious-docker-uses/

2. Thinking differently about Git… Jonathan E. Magen thinks it’s time to look past Git and evaluate alternatives to it, such as Jujutsu, Pijul, Fossil, Gitless, and others.

https://dev.to/yonkeltron/is-it-time-to-look-past-git-ah4

3. Thinking differently about your Apple Silicon Mac… the Asahi Linux team is happy to announce that their distribution supports the new Mac Studio, the new M2 chip, Bluetooth, and also that Asahi Lina got the M1 GPU to work!

https://asahilinux.org/2022/07/july-2022-release/

4. Thinking differently about DNS… Terence Eden explains why you can’t dig Switzerland, and (spoiler alert) it has to do with a thing called Chaosnet. That’s too bad. Terence, if you ever come to Zürich, drop by to have coffee with us! We totally dig our coffee machine.

https://shkspr.mobi/blog/2022/07/dns-esoterica-why-you-cant-dig-switzerland/

5. Thinking differently about your business… Allen Pike proposes the no-nonsense idea of GaSaaS: Giving a Shit as a Service as the fundamental value proposition for small boutiques. Not only do we wholeheartedly agree, but hey, Allen, we’ve just opened shop in Vancouver!

https://allenpike.com/2022/giving-a-shit

Do you think differently about your business and your activities? What other innovative ideas have you come across? Would you like to share them with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about random stuff: #24, #36, #69, #73, #86, #94, #100, and #123.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #146: The Case Against Kubernetes

18. Juli 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about valid critics raised against Kubernetes and its complexity.

1. We love Kubernetes but, let’s be honest: sometimes we just need something less complicated. Charles Humble of The New Stack asks the question whether we can live without Kubernetes, and the answer is yes, there are plenty of options out there: Nomad, PaaS, Serverless… and more.

https://thenewstack.io/can-you-live-without-kubernetes

2. Kubernetes can be a potentially very expensive choice. Denilson N. answers the question of whether we are spending too much on Kubernetes and outlines some strategies for teams, to make sure their OPEX doesn’t go through the roof. We also learnt that Mercedes-Benz has 900 clusters; we hope they have optimized their cost structure.

https://betterprogramming.pub/are-you-spending-too-much-on-kubernetes-179d703ec5c5

3. Kubernetes might still be the best container orchestration option for many businesses. Dave Blakey of Snapt answers the question whether we need Kubernetes or not, enumerating positive arguments compared to other alternatives. Actually, if you pay attention, Kubernetes is so simple, you can explore it with curl!

4. Maybe, just maybe, you shouldn’t be using Kubernetes at all. That’s the opinion of Jeremy Brown, for whom Kubernetes is a red flag signaling premature optimization and other evils. Oops!

https://www.jeremybrown.tech/8-kubernetes-is-a-red-flag-signalling-premature-optimisation/

5. Do you work with Kubernetes all day long, and are close to throwing your laptop through the window? Don’t lose your cool; Marcus Noble has a few tips for you. Breathe deeply, you’re not alone.

Do you use other container orchestrators than Kubernetes? Do you think Kubernetes is an antipattern? Would you like to share some Kubernetes tips and tricks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Kubernetes: #4, #8, #11, #14, #16, #19, #23, #37, #46, #49, #59, #64, #74, #82, #97, #99, #102, #109, #118, #126, and #142.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #145: Attacks, Vulnerabilities, and Threats

11. Juli 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the latest attacks, vulnerabilities and threats discovered in the last few months.

1. Have you heard about „Dirty Pipe“? Also known as CVE-2022-0847, it’s a vulnerability in the Linux kernel, used in many ways: to add SSH keys to the root user account; to start a cron job that runs as a backdoor; to hijack an SUID binary to create a root shell; to allow untrusted users to overwrite data in read-only files; and more. Dirty Pipe is particularly severe in the context of Android devices. This vulnerability appeared in version 5.8 and was fixed in versions 5.16.11, 5.15.25, and 5.10.102 of the Linux kernel.

https://arstechnica.com/information-technology/2022/03/linux-has-been-bitten-by-its-most-high-severity-vulnerability-in-years/

2. Have you heard about „Symbiote“? It’s a relatively new kind of malware: instead of being a standalone executable, it is a library loaded into all running processes using LD_PRELOAD. It also uses a relatively novel vector of attack: Berkeley Packet Filters, or BPF, previously used by other malware such as BPFDoor (revealed in May) and Bvp47 (last year).

https://www.intezer.com/blog/research/new-linux-threat-symbiote/

3. Have you heard about „PwnKit“? Also known as CVE-2021-4034, it allows attackers to execute commands as another user, potentially granting them administrative rights on the target machine. And yes, there exists evidence of active exploitation of this vulnerability in the wild.

https://thehackernews.com/2022/06/cisa-warns-of-active-exploitation-of.html

4. Have you heard about „PACMAN“? No, not the game, but the hardware attack on the Apple M1 CPU. This vulnerability, discovered by researchers at MIT, does not require physical access to the machine. Don’t worry, though; on its own, it can’t be used to compromise a system. Sadly, being a hardware issue, it cannot be patched through software, although its effects can be foreseen and mitigated via software patches.

https://pacmanattack.com/

5. Have you heard about „Hertzbleed“? Also known as CVE-2022-23823, it affects AMD and Intel processors via a feature called frequency scaling, and may allow authenticated attackers to execute a timing attack, and to potentially enable information disclosure. The full source code of the experiments is available on GitHub.

https://www.hertzbleed.com/

Have your systems been a victim of any of these vulnerabilities? Have you set up any protection measures lately? Would you like to share any other attack vector with the community? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Security: #8, #17, #22, #27, #32, #44, #54, #62, #76, #84, #93, #106, #117, #128, and #142.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #144: Build, Scan, and Share Containers

4. Juli 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the latest trends in container workflows for DevOps teams.

1. CI/CD pipelines take care of the most critical parts of the software development lifecycle. These days, developers also build container images within pipelines, and deploy them right away. This article in the Red Hat Hybrid Cloud Blog explains how to use Buildah and Kaniko to build container images directly in OpenShift.

https://cloud.redhat.com/blog/how-to-build-container-images-in-isolated-environments-using-red-hat-openshift-sandboxed-container

2. Once you’ve built your container images, you might want to use one of the various mechanisms available for automatic vulnerability scanning. Clair is an open source vulnerability scanner by Red Hat, used in Quay.io for example, and this blog post describes how it works and why you should use it.

https://www.redhat.com/en/blog/scanning-container-image-vulnerabilities-clair

3. The Chainguard team has just published a new whitepaper explaining the nature, causes, and effects of vulnerabilities in container images. They pinpoint a root cause for headaches: the base images you refer to in the FROM statement of your Dockerfile. Be careful out there.

https://blog.chainguard.dev/zero-security-debt-for-container-images-is-possible/

4. We have all heard that running privileged containers is a bad idea (and guess what: it is) but have you ever seen the code required to escape a container and access its host? Jordy Zomer wrote a fantastic blog post with detailed instructions. Remember: don’t run privileged containers. You’ve been warned.

https://pwning.systems/posts/escaping-containers-for-fun/

5. Podman is a great tool. Not only you can use it to build containers images, you can also inspect containers at runtime with it, and even better, you can use it to share container images with teammates without using a registry.

https://www.redhat.com/sysadmin/podman-transfer-container-images-without-registry

What workflow do you use to build and share your container images? Do you scan your container images for vulnerabilities? Would you like to share some tips and tricks with our readers? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Containers: #12, #17, #40, #51, #54, #71, #81, #108, and #124.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt
VSHN.timer

VSHN.timer #143: Architectural Trends

27. Juni 2022

Welcome to another VSHN.timer! Every Monday, 5 links related to Kubernetes, OpenShift, CI / CD, and DevOps; all stuff coming out of our own chat system, making us think, laugh, or simply work better.

This week we’re going to talk about the current trends in software architecture for Cloud Native applications.

1. How much do the Agile and DevOps principles align with the idea of software architecture? It turns out that „following a plan“ and „comprehensive documentation“ are „items on the right“, which, according to the Agile Manifesto, are always valuable. Isaac Sacolick from InfoWorld explains the principles behind the Continuous Architecture Manifesto.

https://www.infoworld.com/article/3662290/3-ways-devops-can-support-continuous-architecture.html

2. How to define software architecture? What does a System Architect actually do? How do you integrate software architecture in modern software design processes? This fantastic presentation from 2019 by Dylan Beattie provides answers to these questions, and more.

https://www.youtube.com/watch?v=3LtQWxhqjqI

3. „Early-stage startups shouldn’t run on Kubernetes yet“ says Matt Rickard, suggesting instead an architectural four-stage process for them to grow through: containers, serverless, managed Kubernetes, and finally self-hosted Kubernetes.

https://matt-rickard.com/dont-use-kubernetes-yet/

4. The team behind the de facto standard for corporate Git hosting, GitLab, is very happy to work on a monolithic application built with Ruby on Rails. Sid Sijbrandij, founder and CEO of GitLab, explains on The New Stack why they aren’t moving to microservices anytime soon.

https://thenewstack.io/why-were-sticking-with-ruby-on-rails-at-gitlab/

5. O’Reilly has recently compiled a free collection of stand-alone chapters from several of its published and forthcoming books about Cloud Native architecture patterns into a freely downloadable volume; an absolute must-read for all architects out there.

https://get.oreilly.com/ind_next-architecture.html

BONUS ITEM 6. We know that ORMs are getting a bit of backlash lately, but they are certainly useful in some contexts, for example to get MVPs up and running quickly. Bun by Uptrace is a SQL-first Go ORM for PostgreSQL, MySQL, MSSQL, and SQLite.

https://bun.uptrace.dev/

Are you a monolith or a microservices type of person? How does your team or organization deal with architectural issues and processes? Would you like to share your own experience around Cloud Native architecture with the community? Get in touch with us, and see you next week for another edition of VSHN.timer.

PS: would you like to receive VSHN.timer every Monday in your inbox? Sign up for our weekly VSHN.timer newsletter.

PS2: do you prefer reading VSHN.timer in your favorite RSS reader? Subscribe to this feed.

PS3: check out our previous VSHN.timer editions about Architecture: #25, #34, #60, and #79.

Adrian Kosmaczewski

Adrian Kosmaczewski ist bei VSHN für den Bereich Developer Relations zuständig. Er ist seit 1996 Software-Entwickler, Trainer und veröffentlichter Autor. Adrian hat einen Master in Informationstechnologie von der Universität Liverpool.

Kontaktiere uns

Unser Expertenteam steht für dich bereit. Im Notfall auch 24/7.

Kontakt