CodeIsGo.com

Implicits are one of the most feared features of the Scala programming language and for good reasons! By Julien Truffaut.

First, the concept of implicits is fairly specific to Scala. No other mainstream programming language has a similar concept. This means that new Scala developers have no patterns to rely on to use implicits correctly.

Second, the keyword implicit is overused in Scala 2 (similar to _). Therefore, it requires a lots of time and practice to distinguish between the various usages of implicits. On that point, Scala 3 has made great improvements by introducing dedicated syntax for each implicit’s use case.

The article then goes over:

• Usages
• The environment pattern
• Bonus: Alternative implementations of the environment pattern
  • Class parameters
  • ThreadLocal
  • Reader
  • ZIO

The most important take away about implicit parameters is that values injected by the compiler should be obvious! If you need to check your imports or run a debugger to figure out which value was injected, then it is not obvious and you would be better off passing the values explicitly. Nice one!

A Swift binary doesn’t just run on AWS Lambda without some help. In comes the Swift AWS Lambda Runtime to abstract away all the complex interactions between the Lamba Runtime API and your code. By Kevin Hinkson.

Source: https://www.flew.cloud/blog/how-swift-code-runs-on-aws-lambda/

With AWS Lambda runtime API there is a clear separation of roles and responsibilities. Eg: where your Swift code runs is highlighted in red in the image above (Runtime + Function) and it just needs to know how to talk to the Runtime API as described in the diagram.

The article further briefly describes:

• AWS Lambda
• AWS Lambda runtime API
• Lambda Runtime + Swift Function
• Runtime API Calls

Once you read the article it should be not very difficult to understand how the Lambda service and the Runtime API work together. The simple and elegant API provides an interface for managing how Swift code can run on Lambdas . See AWS for more information and documentation details on Lambda runtime API. Nice one!

Intel TDX meets the Confidential Computing Consortium (CCC) standard for hardware-enforced memory protection not controlled by the cloud provider, all while delivering minimal performance impact with no code changes. By Mark Russinovich Chief Technology Officer and Technical Fellow, Microsoft Azure.

The CCC defines confidential computing as the protection of data in use by performing computations in a hardware-based Trusted Execution Environment (TEE).

The article then dives into:

• Azure and Intel enable innovative use cases
• Intel TDX extends Azure’s existing confidential computing offerings
• Removing trust in the hypervisor
• Establishing trust via attestation
• Confidential computing takes off
• Azure’s vision for the confidential cloud

Customers use confidential computing with Intel processors to achieve higher levels of data privacy and mitigate risks associated with unauthorized access to sensitive data or intellectual property. They are leveraging innovative solutions such as data clean rooms to accelerate the development of new healthcare therapies, and privacy-preserving digital asset management solutions for the financial industry. Interesting read!

Cloudflare has been using Kafka in production since 2014. We have come a long way since then, and currently run 14 distinct Kafka clusters, across multiple data centers, with roughly 330 nodes. Between them, over a trillion messages have been processed over the last eight years. By Matt Boyle.

Cloudflare uses Kafka to decouple microservices and communicate the creation, change or deletion of various resources via a common data format in a fault-tolerant manner. This decoupling is one of many factors that enables Cloudflare engineering teams to work on multiple features and products concurrently.

The article is further describing:

• Tooling
• Connectors
• Strict Schemas
• Observability
• A practical example
• What’s next?

Making it easy for teams to observe Kafka is essential for our decoupled engineering model to be successful. Company therefore have automated metrics and alert creation wherever we can to ensure that all the engineering teams have a wealth of information available to them to respond to any issues that arise in a timely manner. Good read!

In this post, we’ll go through the 5 most popular API styles and look at very common questions like “How to decide on the right API style and which technology to choose for a style” and provide practical scenarios where an API Gateway can supplement their weaknesses. By Bobur Umurzokov.

APIs are an essential design element in any software architecture that interconnects components digitally and allows various systems and devices to communicate easily with each other. When we built a new API, initially we think about the API design, and how the API interacts with the external world by using which style and technology.

The infromation contained in the article:

• No best API style​
• Resource style​
• Hypermedia style​
• Query style​
• Tunnel style​
• Event-based style​

As we reviewed, 5 styles were the foundation of popular approaches and technologies such as REST, OpenAPI, HTTP, gRPC, GraphQL, and Kafka. The most important lesson to learn about these 5 API styles is that there is no “best style”. When it comes to choosing an API style, it all boils down to the following 3 classes: a problem, consumers, and context. Nice one!

A webhook gateway is a webhook management tool that sits between a webhooks provider and webhooks consumer. It acts as a reverse and forward proxy for webhooks. It can be deployed by both the API provider that sends webhooks and the consumer that receives webhooks to handle webhook events multiplexing and de-multiplexing respectively. By Subomi Oluwalana.

In today’s world of ever changing user requirements, speed is a competitive advantage. Development teams are required to move fast and deliver user value. More teams are adopting a serverless, micro-service, and service-oriented architecture to move fast.

Source: https://getconvoy.io/blog/what-are-webhook-gateways/

The diagram above provides an high level view of how a webhook gateway operates. We used AWS specific elements but this can be any cloud environment - Azure, GCP, Digital Ocean, etc or even On-Prem. The arrows from the left show the flow of traffic from your backend services to client endpoints on the right, and the arrows from the right show the flow of traffic from third-party providers like (stripe, twilio, etc.) to your backend services for processing. You will also find a comparison between API Gateways and Webhook Gateways in the article. Nice one!

This post elaborates on building event-driven APIs by making use of Webhook and API Gateway, we understand the role of each in this solution. By Bobur Umurzokov.

The article explains:

• Need for a webhook
• What’s webhook?
• Webhook and API Gateway in event-driven architecture
• Subscription process
• Callback process

Webhook tries to decouple the concerns like a message acknowledgment and the processing messages in the API and no synchronous business logic is performed. However, the above architectural example we discussed can be a complicated pattern to implement given that it has many moving parts and the API are not aware of a consuming application endpoint is up and running but that can be improved. Interesting!

AWS Lambda comprises over 80 services working together to provide the serverless compute service that it offers to customers. Under the hood, many of these services are built on top of Amazon Elastic Compute Cloud (Amazon EC2) instances, provisioned within Availability Zones. However, AWS Lambda is a Regional service. By Adrian Hornsby (Principal System Dev Engineer) and Marcia Villalba (Principal Developer Advocate).

This means that customers use Lambda services from the Region level and its services are designed to be resilient to impairments that the underlying Availability Zones might have.

The articles discusses:

• The role of Availability Zones
• How to prepare for failures
• How Lambda tests its response to an Availability Zone impairment
• How AWS Lambda uses AWS FIS
• How to recover your applications rapidly from Availability Zones failures

This article discusses static stability, a mechanism that is used by AWS services such as Lambda to build resilient Regional services. It also discusses how AWS takes advantage of the same services and infrastructure as customers. It shows how Lambda uses multiple Availability Zones and services like AWS FIS to build highly available services and improve its recovery time from unexpected failures to only a few minutes without human intervention. Nice one!

In this article, we will learn how symmetric-key encryption works from a practical perspective. We will use OpenSSL to put into practice some concepts about symmetric-key encryption. By Sergio Prado.

To follow along with this article and run the commands on your machine, you just need a terminal with a recent version of OpenSSL. Further content discussed:

• Symmetric-key encryption
• Generating a symmetric key
• Encryption with AES-128
• Block cipher modes and ECB
• AES encryption in CBC mode

In a symmetric-key encryption algorithm, the same key is used for both encryption and decryption. This key is usually called a private key, and should stay private, or the security is broken! In this article, we learned some concepts about symmetric encryption, using AES in ECB and CBC modes to encrypt and decrypt data. In the next article, we will deep dive into asymmetric-key encryption and digital signatures. Good read!

What is now required is political acumen, managerial experience and personal gravitas, more than raw technology skills. By JC Gaillard.

In spite of being widely used, the role of the Chief Information Security Officer (CISO) has only had a few decades of existence and is still evolving. Research from the Security Transformation Research Foundation — based on the semantic analysis of the content of 17 annual global security reports from EY between 2002 and 2019 — points towards the role having already gone through 2 clear phases in its evolution, as it heads into its third decade of existence.

The first decade of the century was essentially a “Compliance Decade”: Security was seen as a balancing act between compliance requirements, risk appetite and costs; the CISO was mostly a risk manager. The last decade has been effectively a “Realisation Decade”, during which cyber security started to be seen as a necessary barrier against real threats, in a context of increasing cyber-attacks and data breaches (in number and scale), massive technological change and the aftermath of a historical financial crisis.

The role of the CISO is entering its third decade of existence and it is likely to be an “Execution Decade” with cyber security becoming an imperative, as the “when-not-if” paradigm around cyber-attacks takes root in the boardroom. Follow the link to the full article to learn more!