CodeIsGo.com

Man-in-the-middle (or MitM) attacks can occur when an attacker has the ability to intercept communications over the network. This allows the attacker to read – and potentially modify – these communications. By Rob Behnke.

MitM attacks rely on an attacker’s ability to intercept, read, and modify network traffic. While a user has limited control over how their traffic flows over the Internet, they can take steps to make MitM attacks more difficult to perform. For example, the use of a virtual private network (VPN) when connected to public Wi-Fi networks helps to protect against traffic interception by a malicious wireless access point.

TLS is designed to help maintain the confidentiality and integrity of network traffic. However, the system has some weaknesses that can make it vulnerable to attack.

One of the biggest limitations of TLS is that it only proves that a user is connected to a legitimate web server for the URL that they are visiting. If the client is tricked into visiting a malicious URL via a phishing attack, then all TLS does is protect the user’s connection to the attacker’s server.

A MitM attack is mainly a threat when cybersecurity best practices aren’t followed. The use of TLS whenever possible and a VPN when connected to untrusted public networks dramatically reduces the risk of MitM attacks. Good read!

To succeed as a customer-centric team, building and honing digital optimization skills is crucial. Here are the skills to focus on.. By Will Watkinson. Digital optimization is critical for driving sustainable business growth with product data. But what does it mean to operate with digital optimization? By Mallory Busch.

A digitally optimized company empowers every customer-centric team to explore product data, gather technological insights, and take immediate action to drive toward business outcomes. Oftentimes, these identified outcomes are centered around driving long-term customer loyalty and value.

The article then delves on these skills:

• Customer-centric mindset
• Product-led mindset
• Data-driven mindset
• Agility
• Collaboration
• Change management

Digital optimization requires companies to be able to keep up with constantly changing demands and take quick action based on insights. Businesses will often use an ecosystem of integrated tools to provide access to product data across various functions. Tools such as Braze and Amplitude are good examples. Nice one!

Companies organize and automate their internal processes with a multitude of business systems. Since companies function as a whole, these systems need to be able to talk to one another. At Shopify, we took advantage of Ruby, Rails, and our scale with these technologies to build a business system integration solution. By Will Watkinson.

The article then walks you through:

• The modularization of business systems
• Organic integration
• Integration platform as a service
• Building on Shopify’s stack
• The design priorities
• Implementation

The transition from monolithic to modular architecture doesn’t remove the need for interaction between modules. Maintaining well-defined, versioned interfaces and integrating with other modules is one of the biggest costs of modularization. In the business systems space, however, it doesn’t always make sense for vendors to take responsibility for integration, or do it in the same way. Good read!

There is a major shortage of cybersecurity professionals, with the equivalent of a major city worth of workers missing from the workforce. (ISC)2, the world’s largest professional organization for cybersecurity workers, estimates in the paper linked above that the cybersecurity workforce will have to increase by 65% to meet demand. By Nils Gerhardt.

Furthermore, we have seen increased cybersecurity threats and reduced employee training due to the COVID-19 pandemic, reducing the ability of professionals and new entrants into the field to train. Most worrying, new technology threatens to make existing cybersecurity skills obsolete and renders many of the forms of protection they rely on null.

The article discusses following:

• A lack of cybersecurity skills
• Emerging threats
• Preparing for a post-quantum world

It is apparent that the cybersecurity workforce will need to increase. Therefore, a large-scale realignment aimed at getting more qualified workers into the industry, helping decision-makers understand the issues and preparing the current and future workforce for a quantum computing age. Good read!

The main misunderstanding, and source of the issues, is related to deciding on the stale data. It brings uncertainty and the need for workarounds. It’s a common mistake to use tools like Kafka and Pulsar for event stores, but they are not. You don’t have basic guarantees for optimistic concurrency checks. By Oskar Dudycz.

TLDR: We assume that conflict situations will be rare. A conflict arises when two people try to change the same record at the same time. When this happens, we will only allow the first person to update the state. All other updates will be rejected. For verification, we use a record version that changes with each save.

All of the event stores that I know support strong consistency on appends, and optimistic concurrency. Most guarantee global ordering. Some have a built-in idempotency handling. All of that helps to reduce those issues. In Event Sourcing, events are the state.

The events are the source of truth, only if you’re using them in the write model as a basis for the state rehydration. If you’re using a materialized view, even though it’s built based on events, then you outsourced the truth to other storage. If you’re using a pattern that means you’re just using events to build up the materialized view you use for the write model logic, that can lead to using Event Streaming tools like Kafka, Pulsar, etc. And, as stated in the article, this is a dead-end. Read more in How to get the current entity state from events?.

Event Sourcing by itself doesn’t directly relate to eventual consistency, type of storage, messaging, etc. Those are implementation details and tradeoffs we’re choosing. Each storage solution has its patterns and anti-patterns: relational databases have normalization, document databases are denormalized, key-value stores have strategies for key definition. Event stores also have their problems. Super interesting read with plenty links to further reading in the topic!

SwiftUI is Apple’s new declarative framework for building user interfaces for all Apple devices. This framework can be broken down into two essential components: views and state. By Amisha I.

State management is an integral part of SwiftUI development, and there are many different ways of working with the state. In which State represents the data associated with a view. In this article we are going to learn about a state holder to separate business logic from UI components. ViewModel has a longer lifecycle than the view so ViewModel can preserve its state across UI changes.

For simplicity, author divided this post into 3 sections:

• Add data layer – Responsible for fetching data from API
• Add ViewModel – Responsible for managing the state of the screen
• Add View – Actual UI representation that users will see

This is one of the ways to manage the state, however, you should explore other options as well once you are familiar with these basics. Good read!

Recently, I have been investigating NGINX Unit, our open source multi-language application server. As part of my investigation, I noticed that Unit supports both namespaces and cgroups, which enables process isolation. In this blog, we’ll look at these two major Linux technologies, which also underlie containers. By Scott van Kalken of F5.

Containers and associated tools like Docker and Kubernetes have been around for some time now. They have helped to change how software is developed and delivered in modern application environments. Containers make it possible to quickly deploy and run each piece of software in its own segregated environment, without the need to build individual virtual machines (VMs).

The article then focuses on:

• What are namespaces?
  • Types of namespaces
  • An example of parent and child PID namespaces
  • Creating a namespace
  • Looking at a namespace from the outside
• What are cgroups?
  • Cgroup versions
  • Creating a cgroup

Namespaces and cgroups are the building blocks for containers and modern applications. Having an understanding of how they work is important as we refactor applications to more modern architectures. Excellent read!

As a security architect and the technical leader for the Logging Made Easy project, I am often asked “what logs should I be collecting?” I absolutely hate the standard ‘it depends’ response. So, I’ve been answering with a question of my own: “For what?” This has led to a number of interesting discussions on the topic of who should be logging what, and when. By Adam B.

Before getting down to specifics, take some time to think about the logging practices, sources and tools available to you. Picking the right tool is part of the journey - you wouldn’t expect a chef to use a single knife, nor would you expect a developer to work with a single technology stack. You need to decide what are the ‘right tools for the job at hand’.

The article then discusses:

• Doing away with “one size” solutions
• Alternatives to ATT&CK framework
• MITRE ATT&CK
  • Reconnaissance
  • Resource development
  • Gaining initial access
  • Execution of attacker controlled code
  • Persistence
  • Privilege escalation
  • Defence evasion

… and much more. The cloud allows you to use resources as and when they are needed. However, depending on your provider, getting access to raw logs may be difficult or impossible. This is because of the division of “shared responsibility”. But what does shared responsibility mean for logging? Good read!

This is the 1st article of a series that explores the difference between OOP design, and parametric polymorphism with Type Classes, as both are possible in Scala. By Alexandru Nedelcu.

A black box is a device, system or object that can be viewed in terms of its inputs and outputs. This means that the input and output are well specified, such that we can form a useful mental model for how it works. Note that the mental model doesn’t have to be correct, it just has to be useful, such that we can operate the system without breaking it open and taking a look at the implementation.

The article is split into:

• Motivation
• Abstraction
  • Black Box Abstraction
• What is OOP?
  • Are OOP and FP orthogonal? Can they mix?
• What are Type Classes?
• Ideological clash
  • OOP values
  • Static FP values
  • Degenerate cases
  • What do you want? OOP is a paradigm based on the concept of “objects” and their interactions, objects that contain both data and the code for manipulating that data, objects that communicate via messages. Good read!

Time is an important aspect of life that each person relies on in order to function in society. Time can be measured in many ways, such as in calendars and clocks, and can be viewed at any moment of the day, at any place. By Ron Jefferson.

Despite the establishment of time and its presence throughout the history of humankind, some experts theorize that the measurement hangs as an open possibility, Space reports.

The scientific studies throughout the past centuries allowed us to observe and discover two crucial theories in the physical field, namely quantum mechanics and general relativity.

Loop quantum gravity is the most questionable among the past theories, as this guess relies on aspects that do not rely on time, and in fact, eliminate the presence of time entirely. In this theory, time only emerges along with how we exist on a physical level. This guess implies that, unless we have answers to how time emerges, then time is non-existent. How very interesting!