CodeIsGo.com

Privacy regulators in Europe last year imposed known fines totaling more than 1 billion euros ($1.2 billion) under the EU’s General Data Protection Regulation, bolstered in part by two record-breaking sanctions, according to the law firm DLA Piper. But sanctions approach varies widely across 31 countries complying with privacy law. By Mathew J. Schwartz.

The amount of fines levied in the 12 months since Jan. 28, 2021, marked a sharp increase from the 159 million euros ($181 million) in fines seen for the preceding 12 months, according to DLA Piper’s latest GDPR and data breach report. Not all of those GDPR violations involved data breaches.

Since GDPR came into full effect on May 25, 2018, organizations that handle Europeans’ personal data must comply with tough breach notification rules, which can include a requirement to notify authorities they have suffered a breach within 72 hours of its discovery. Failure to comply exposes organizations to fines of up to 4% of their annual global revenue or 20 million euros ($22.8 million) - whichever is greater. Organizations’ ability to process people’s personal data can also be revoked (see: Privacy Rights: GDPR Enforcement Celebrates Third Birthday).

In a repeat from 2020, in 2021, Germany and the Netherlands logged the most breach notifications, according to the report. Last year, they were followed by Poland, the U.K and Denmark. Per capita, the number of 2021 breach notifications per 100,000 residents was greatest in the Netherlands (151), followed by Liechtenstein (136) and Denmark (131), according to the report. “Croatia, the Czech Republic and Greece reported the fewest number of breach notifications per capita since Jan. 28, 2021,” it says. Interesting read!

At the turn of the 21st century, the identity management discipline within IT Security was born of necessity. Advancements in computer technology meant that every area, function, and discipline within organizations was turning to automation to gain a competitive advantage. A computer was placed on every desk, and servers, mini-computers, and mainframes were being deployed to automate every area of the business. By Chris Olive.

We are now seeing this pattern repeat with the mass proliferation of data to the cloud, catalyzed by the tsunami of Digital Transformation. The modern organization needs to adopt a Data-Centric Security approach to safely execute their digital transformation strategy.

The article then pays attention to:

• Digital transformation has radicalized the data security landscape
• Data security needs to grow up and mature
• Speed
• Scale
• Strategy

Transformation based on automation twenty years ago meant organizations simply couldn’t keep pace with identity lifecycle events or address growing compliance and reporting needs using previous methods. Keeping up with the Speed of business was a real issue. Twenty years ago, Identity management was born from a massive acceleration of technology enablement adopted by organizations as a transformative need. Today, digital transformation driven by massive amounts of data is transforming the business landscape at incredible speed and in ways that seem to dwarf the transformation of the past. Good read!

Understanding how Kubernetes handles containers gives you greater flexibility to create custom configurations for specific needs. Kubernetes enables you to do a lot of productive work without having to understand a lot about the underlying details. By Bob Reselman.

The article then explains:

• Understanding Kubernetes architecture and Kubelet
• Understanding the difference between a container manager and a container runtime
• Standardizing the container infrastructure with the OCI
• Understanding the Container Runtime Interface
• The benefit of understanding the details

Putting the CRI and the OCI specifications together makes it so that Kubernetes can support exactly the container manager and runtime you want to use in your Kubernetes cluster designs. Also, the CRI and the OCI make it so that you can run many different types of container managers and container runtimes across a single cluster.

When it comes to designing a Kubernetes infrastructure to support today’s modern applications, choice matters. Fortunately, choice exists due to the benefits provided by the OCI and CRI specifications. The tradeoff is the need to understand many details of Kubernetes and container technology to get it all to work for your benefit.

A few weeks ago, an interesting issue appeared on our GitHub tracker. It was reported that, despite our care in designing the driver to be efficient, it proved to be unpleasantly slower than one of the competing drivers, cassandra-cpp, which is a Rust wrapper of a C++ CQL driver. By Piotr Sarna.

Brendan Gregg’s flamegraphs are indispensable for performance investigations. What’s even better is that the Rust ecosystem already has fantastic support for generating flamegraphs integrated into the build system: cargo-flamegraph.

A flamegraph generated from one of the test runs shows that our driver indeed spends an unnerving amount of total CPU time on sending and receiving packets, with a fair part of it being spent on handling syscalls.

The article then describe how author was investigating reported issue with driver performance:

• Reproducing the problem
• Profiling
• Hint
• Root cause No1
• Root Cause No2: Pitfall in Async Rust
• Quadratic behavior?

You will find the solution in provided GitHub repository. The world of async programming in Rust is still young, but very actively developed. Investigating and getting rid of bottlenecks and pitfalls is a very useful skill, so don’t hesitate in joining in the effort — e.g. by becoming a contributor to our brand new, native Scylla driver!. Good read!

The role of software project managers is to see a project to fruition while software developers are expected to develop the product, but oftentimes, these roles are interchanged irresponsibly. By Andrew Burak.

You’ve been there: working with a software developer who you desperately want to focus on everything software but who finds themselves knee-deep in scheduling, budgeting, and meetings with stakeholders.

The article main parts are:

• Software project management is important in Software Development Life Cycle (SDLC)
• Project management and software development complement each other
• The future role of project managers in software development
• Interview with the founder of My Theory Test App by James May
  • The use of online software project management tools
  • Embracing a Systems Analyst/Project Manager hybrid role
  • Specializing in managing remote teams and projects

Project managers bring relationship management to software development in addition to overseeing all management-related tasks that could impede the progress of the software project.

Software project management and software development complement each other by working together in a way that allows both to fully immerse themselves in their respective job functions without any implications from the other’s role.

As part of Uber engineering’s wide efforts to reach profitability, recently our team was focused on reducing cost of compute capacity by improving efficiency. Some of the most impactful work was around GOGC optimization. In this blog we want to share our experience with a highly effective, low-risk, large-scale, semi-automated Go GC tuning mechanism. By Cristian Velazquez.

Uber’s tech stack is composed of thousands of microservices, backed by a cloud-native, scheduler-based infrastructure. Most of these services are written in Go. Our team, Maps Production Engineering, has previously played an instrumental role in significantly improving the efficiency of multiple Java services by tuning GC. At the beginning of 2021, we explored the possibilities of having a similar impact on Go-based services.

The article then explains:

• GOGC tuner
• Dynamic and diverse: One size does not fit all
• A case for automation
• Observability
• Implementation
• Impact

Garbage collection is one of the most elusive and underestimated performance influencers of an application. Go’s robust GC mechanism and simplified tuning, our diverse, large-scale Go services footprint, and a robust internal platform (Go, compute, observability) collectively allowed us to make such a large-scale impact. We expect to continue improving how we tune GC as the problem space itself is evolving, due to changes in the tech and our competency. Super interesting read!

We’ll talk through our design decisions in building the extension, and along the way we’ll touch on the Language Server Protocol and, more generally, how an IDE extension works. By osohq.com.

The article dives straight in:

• Why we chose VS Code
• Using the Language Server Protocol (LSP)
• Design
• Why we chose WebAssembly
• Deciding against a Rust LSP Library
• Implementation

With our sights set on Wasm, implementing the language server in Rust largely went off without a hitch, and we landed on a clean, three-part design consisting of a TypeScript entrypoint module, a second, tiny TypeScript module that delegates connection handling to Microsoft’s vscode-languageserver package, and the polar-language-server crate compiled to Wasm.

By splitting the language server into a thin TypeScript wrapper and a Rust core, we were able to build on top of some nice LSP scaffolding that exists in the JavaScript ecosystem while still implementing all of the new diagnostic-wrangling logic in Rust. Nice one!

Traditional API architectures like SOAP and REST have been powering the web for a long time. But over the past five years, a change towards a more flexible and frontend-driven approach to API protocols has started, using GraphQL. But moving from a traditional API architecture like REST towards GraphQL can be challenging. Not only does your team need to adapt to GraphQL, but it also means you could be losing your investment in your current API architecture. By Mark Smallcombe.

Luckily, you can create a clear migration path from REST to GraphQL using StepZen. You get the advantage of adding GraphQL to your stack, but you can still leverage all your current APIs. In this post, author will show how you can use your existing REST API endpoints while migrating to GraphQL.

The article covers:

• Mapping REST API endpoints to GraphQL
• Combining REST API endpoints
• Migration path with Authentication

You map REST API endpoints to GraphQL types and operations. These types and operations can combine the responses of multiple REST API endpoints at once. If you’ve already invested in your application’s authentication flow, you can leverage these investments by adding this flow to your GraphQL schema. Nice one!

When machines need to communicate with one another and exchange data, they require certain formatting for specific data types. That’s where SOAP API and REST API come into play. They allow for communication and transfer of data, but each is different in several ways. From implementation to their required resources, various attributes separate one from the other. By Mark Smallcombe.

The article then describes the following:

• What is REST API?
• What is SOAP API?
• Differences outlined
• How API services work

Compared to REST APIs, SOAP APIs are more specified in their use cases and are necessary for fewer instances. However, SOAP protocols are still required for some business processes, but for true flexibility, they aren’t as capable or nimble.

If you want ease and versatility, REST APIs are the best solution for businesses who want to connect to multiple platforms and websites without issues or complex specifics. They are widely used and easier to work with than SOAP APIs. Good read!

As with any Web Service, the microservices need to be protected from unauthorized access. So how do you protect each of your services? How does one share the token that is received from the Auth service?. By Anu Viswan.

Exposing your microservices directly to the client and allowing them to directly communicate with all your services would have its own problems, so in this example, we will also add a layer of API Gateway which would be the single point of contact for all your clients.

The Gateways, in addition to providing a single point of access, also adds a security layer over your microservices. It could also support load balancing and reducing round trips when the client requires calls to multiple microservices. With regard to authentication, the gateway could pass the authentication token to the downstream paths. In this example, we would be using Ocelot for building our gateway.

The article main parts:

• The working
• Auth service
• API gateway
• UserService
• Client

In this article, we addressed how to authenticate the different individual services in the microservice architecture. We also used the wonderful Ocelot library for building API Gateways. The services and the gateways are loosely coupled with each other, while the client is having a single point of contact in the gateway. Good read!