CodeIsGo.com

Web servers bring together many useful services in traditional web development. Developers use servers like Apache and NGINX for many common tasks. Linux, Apache, MySQL, and PHP formed the LAMP stack to power a large percentage of the world’s websites. Other variants, like the MEAN stack (MongoDB, Express.js, AngularJS, Node.js), have also been popular. By James Beswick.

In the migration to serverless, it’s important to understand where this functionality moves to. There are significant benefits in taking a serverless approach to developing web apps but there are differences in where developers spend their efforts. This blog post provides a guide to serverless development for traditional web developers to help with this transition.

To run a “Hello World” example in a highly available configuration, using a traditional webserver approach you need more than one server in more than one Availability Zone. This server contains an operating system, runtime, and web server software, together with your code. You might build an Amazon Machine Image (AMI) to help with creating more servers. The guide then deals with:

• Comparing a “Hello World” example
• Implementing authentication in serverless web apps
• Generating HTML, CSS and front-end templates
• Uploading, processing, and saving binary files
• Storing application state

Application state: For functions that need a durable store of user data that can be rehydrated between invocations, Amazon DynamoDB tables provide a low-latency, cost-effective solution. For example, this is ideal for recalling shopping cart contents or user profiles. Great guide!

DevSecOps is about introducing security earlier in the life cycle of application development, thus minimizing vulnerabilities and bringing security closer to IT and business objectives. By Lucian Constantin.

DevSecOps is a culture shift in the software industry that aims to bake security into the rapid-release cycles that are typical of modern application development and deployment, also known as the DevOps movement. Embracing this shift-left mentality requires organizations to bridge the gap that usually exists between development and security teams to the point where many of the security processes are automated and handled by the development team itself.

The article then reads:

• How does DevSecOps differ from traditional software development?
• Achieving true security/development integration
• DevSecOps testing and tools
• DevSecOps adoption

That said, even with DevSecOps, some tasks will still need to be performed by security professionals and manual testing still has its role to play. For example, it’s hard to find logic flaws or design flaws using completely automated scans. You will also get plenty of links to further resources. Nice one!

In the current tech world, Firebase is one of the most trending technologies that help you to make a super cool web app or mobile apps in a short span of time. Firebase is a BaSS (backend as a service) provided by Google. By Sm0ke.

Firebase provides all the tools and the stuff that you will need to make your web app or mobile Applications. Some of the services that usually need to develop or configure while making some app are to configure servers, manage hosting, manage user authentication, write the crud operation logic for our app, storage, push notifications and the list goes on.

Firebase provides you the backed SDK for managing the database. You can easily do the CRUD operation with the help of this SDK, but sometimes you have to write your own backend logic, this is where the Firebase cloud functions helps. Just write your backend code and deploy it as the cloud functions and call your code with the help of https service as you called the simple API.

The article then explains:

• Firebase Realtime - real time database
• Firestore Database
• Firebase Authentication
• Firebase Hosting Service
• Firebase Storage
• Cloud functions
• Firebase ML Kit

And on top of it all you will also get a little demo project with screen shots and example code and instructions how to connect it to Google Analytics. Good read!

In this article, we will learn how to implement Azure serverless with Blazor web assembly. And to do that, we will create an app that lists out some Frequently Asked Questions (FAQ) on Covid-19. By Ankit Sharma.

The tutorial covers how to:

• Create an Azure Cosmos DB which will act as our primary database to store questions and answers
• Use an Azure function app to fetch data from cosmos DB
• Deploy the function app to Azure to expose it globally via an API endpoint
• And lastly, how to consume the API in a Blazor web assembly app
• What is a serverless architecture?
• What is an Azure function?
• What is Blazor?

Blazor supports a wide array of features to make web development easier for us. Some of the prominent features of Blazor are: Component-based architecture: Blazor provides us with a component-based architecture to create rich and composable UI; Dependency injection: This allows us to use services by injecting them into components; Dependency injection: This allows us to use services by injecting them into components…

This is step by step tutorial with excellent explanation of each step, screen shots explaining how to publish Azure function and links to further resources. Great read!

Developing Python projects in local environments can get pretty challenging if more than one project is being developed at the same time. Bootstrapping a project may take time as we need to manage versions, set up dependencies and configurations for it. By Anca Iordache @docker.com.

A good way to do this is to create isolated development environments for each project. This can be easily done by using containers and Docker Compose to manage them. Author covered this in a series of blog posts, each one with a specific focus.

Content of this guide:

• Containerize a Python service
• Dockerfile
• Development Best Practices for Dockerfiles
• Multi-stage builds

Although multi-stage builds may not be really useful during development time, they covered it quickly as it is interesting for shipping the containerized Python application once development is done. Links to best practices and further reading also included. And definitely folow the link to part two of the article. Excellent read!

In mid-April 2019, Microsoft gently nudged a young framework from the “anything is possible” experimental phase to a “we’re committed to making this happen” preview. The framework, named Blazor because it runs in the browser and leverages a templating system or “view engine” called Razor, enables the scenario .NET developers almost gave up on. By Jeremy Likness, Cloud Advocate for Azure @Microsoft.

WebAssembly is a new client-side technology that enables near-native performance without plug-ins in all modern browsers, including mobile. WebAssembly, a binary instruction format for a stack-based virtual machine. WebAssembly provides a portable compile target (called Wasm, for short).

Many languages, including C, C#, Go, and Rust, can compile code that targets the stack-based WebAssembly virtual machine.

Blazor is a client-side library that uses .NET on WebAssembly to support Single Page Applications written in C# using Razor templates.

The article main sections:

• The Silverlight hope
• JavaScript as a platform
• WebAssembly: a new hope
• The Browser and Razor View Engine
• C# in the Browser (with dependency injection)
• Reusable components

… and more. You will fined detailed explanation how Blazor works in a browser. Also plenty of links to further reading. Very exciting!

The purpose of the blog is to introduce you to incorporating high assurance cryptographic security with hardware security modules (HSMs) into your Red Hat OpenShift projects. Since this might be new territory for some in the developer community, author will take a moment to explain what an HSM is. By Oli-Wade.

An HSM is a specialized hardware device that is designed for the purpose of protecting encryption keys and conducting cryptographic processes such as creating digital signatures. Keys are generated according to strict security standards and based on an internal high-quality entropy source. HSMs are robust, tamper-resistant devices that incorporate innovative security features to ensure the protection of sensitive key material.

Source: https://securityboulevard.com/2020/07/self-contained-ready-and-secured-enhancing-red-hat-openshift-with-hardware-cryptography/

The alternative to using an HSM is to store encryption keys in software – which can be risky since skilled attackers can identify critical key material based on its unique, random characteristics. High value keys should be protected to the best achievable standards, since their loss might cause considerable financial and reputational damage – as well as a compliance violation. HSMs provide this protection and many are certified to internationally-recognized standards like FIPS 140-2 and Common Criteria, while also being recognized by security auditors as an effective tool to mitigate cyber risk.

The article describes how to go about:

• Building container images
• Running containerised applications in OpenShift
• Increased application security

To learn more about nCipher nShield HSMs and the integration with Red Hat OpenShift, download their solution brief on the page. Good read!

Lots of organizations turn to service mesh because it solves tedious and complicated networking problems, especially in environments that make heavy use of microservices. It also allows them to manage application networking policies, like load balancing and traffic management policies, in a centralized place. By Stewart Reichling and Srini Polavarapu @Google.

But adopting a service mesh has traditionally meant (1) managing infrastructure (a control plane), and (2) running sidecar proxies (the data plane) that handle networking on behalf of your applications.

Source: https://cloud.google.com/blog/products/networking/traffic-director-supports-proxyless-grpc

Gooogle built Traffic Director, a Google Cloud-managed control plane, to solve that first barrier to service mesh adoption—you shouldn’t need to manage yet another piece of infrastructure (the control plane). With Traffic Director support for proxyless gRPC services, you can bring proxyless gRPC applications to your proxy-based service mesh or even have a fully proxyless service mesh.

gRPC handles connection management, bidirectional streaming, and other critical networking functions. In short, it’s a great framework for building microservices-based applications.

The article then describes:

• Traffic Director support for proxyless gRPC services
• gRPC + xDS
• Getting started with proxyless gRPC
• When to deploy Traffic Director with proxyless gRPC services

Enterprise networks are heterogeneous. Google built Traffic Director to be flexible so that we can support deployment options that meet your needs. Excellent read!

Singleton pattern is one of the most commonly used software design pattern. It comes under creational pattern. By Manoj Singh Saun.

The singleton pattern restricts the instantiation of a class to one “single” instance. It is useful when exactly one object is needed to coordinate actions across the system. e.g. database connection is a good example of singleton pattern.Creating database connection is a much heavier and more expensive job from a performance point of view.So It is better that a single connection is share by multiple objects.

The singleton pattern can be implemented in many ways. An implementation of the singleton pattern must follow the following points:

• It should ensure that only one instance of the singleton class ever exists
• It should provide global access to that instance

The article further describes and provides code examples for:

• The classic way to create Singleton pattern (not thread safe)
• Another example of Singleton using Eager Instantiation (thread safe)
• Example of Singleton using synchronized (thread safe)
• Example of Singleton using double checked locking (thread safe; the field needs to be volatile to provide consistency)

Straightforward with detailed code explanation for each method used. Great!

David Stewart put together this blog post about security threats to APIs. As mobile apps become increasingly paramount to operating successfully in today’s markets, a big question mark over API security is raised. Gartner has previously predicted that by 2022, “API abuses will be the most-frequent attack vector resulting in data breaches for enterprise web applications.” Since every mobile app out there is powered by APIs, securing them is clearly a top priority.

When it comes to APIs which service mobile apps, the trouble is that anyone – including attackers – can freely install an application on a device he/she controls to reverse engineer and study it for weaknesses.

The article the dives into:

• MITM (man in the middle) attacks
• Data scraping
• Credential stuffing
• App impersonation
• DoS and DDoS attacks

APIs are a critical part of mobile apps and, as such, are increasingly becoming a target for hackers. Great read.