Recent content in Home on Charlton's Blog
Cymometer is a decaying counter for rate limiting using Redis. It provides a simple and efficient mechanism for counting events over a sliding time window, which is useful in applications such as rate limiting. Cymometer uses Redis sorted sets and Lua scripts to maintain atomic increment and decrement operations, ensuring accurate and thread-safe counting in distributed systems. Cymometer is…
Plover is a tiny, embeddable Ruby build system designed to provide “Just Enough to Be Comfortable”. Plover is not a Make/Rake clone. It’s intended to make it easier to write clean, organized build scripts in plain Ruby. To help you with that, Plover provides a lightweight DSL for defining build phases, managing configuration flags, and tracking build artifacts, making it easier…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: 1Q84 - Haruki Murakami. (978-0-307-59331-3) (fin.) ANSI Common Lisp - Paul…
Charlton & Rob. I’m excited to announce Packfiles, a company I’m co-founding with Robert Bremer. Rob and I worked closely together at our last company, where we helped found one of the premier GitHub Professional Services practices in the United States. What’s Packfiles? We’re the GitHub migration company, building products and tools that enable organizations of any size to…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Show Stopper!: The Breakneck Race to Create Windows NT and the Next Generation…
Happy Thanksgiving! Here’s an update on Tampa Devs Talent, the reverse job board service powering Tampa Devs’ charitable cause. Tampa Devs Talent homepage 📈 Financial Breakdown 5 months in, our recruiting play has started to deliver. I’m pleased to announce that this November, revenues reached $408 from a combination of subscription fees and two contract hires, making this our…
Note: Eric and I have both been working on this writeup for a while, and we both wanted to post it on our blogs. So, we decided to post it on both of our blogs! Check it out on his site over here. At DEFCON 31, two UCF alumni got together and overengineered the crap out of some Cloud Village CTF challenges. We started a day late but within 3 hours of starting we rocketed up to 11th place out of…
Check it out on the Xpirit blog.
At Tampa Devs, we have a Slack workspace for our members to chat and share ideas. This is generally intended as an online community space, but it’s also proven to be a valuable tool to support the safety of our members in the event of hurricanes or other natural disasters. As Hurricane Idalia approached Florida’s Gulf coast, I like many of our members was concerned about the incoming…
Migrating secrets between GitHub organizations is important for several reasons, yet GitHub lacks a built-in mechanism for doing so. As organizations evolve, migrate, or merge with others, the need to transfer sensitive configuration data, such as API keys, access tokens, or cryptographic credentials, becomes inevitable. Secrets are integral to various workflows: Without a dedicated migration…
I recently published a new gem (GitHub) that provides a drop-in replacement for the Devise framework’s built-in friendly token generator. If you’re using Devise in your Rails application, this makes simple to bring all the benefits of Sssecrets (a simple, secure, and easy-to-use method for generating secrets that are easy to detect when leaked) to your application in a snap. Check out…
Expanding further on the ideas presented in my Orlando Codecamp talk, Kevin and I decided to give a talk at Tampa Devs about our unique approach to game development with Godot Engine and DevOps. Kevin absolutely stole the show with his excellent demonstration of how Godot engine fundamentals, building into a full-scale example of how to create a fish AI from first principles. I followed up with a…
GitHub Advanced Security’s Code Scanning is great, but what if you’d like to add DAST scans to the mix? I’m pleased to announce my addition of SARIF support to PortSwigger’s Dastardly, their free, lightweight web application security scanner for CI/CD pipelines. With my Dastardly GitHub Action, it’s now easier than ever to find and triage scanning results right where…
Our friends over at Made in Tampa published an awesome profile of Vincent, myself, and Tampa Devs on their website. Check out their take on the rise of Tampa Devs, the Tampa Bay tech community, and the future of the Tampa Bay tech scene. Read The Unstoppable Rise of Tampa Devs at Made in Tampa, or at this mirror.
Hanging out with some friends from Legit Security at Blackhat 2023 I work with plenty of clients who want their GitHub environments tested for security. And with the OpenSSF’s new Source Code Management Platform Configuration Best Practices guide, tools like Legitify are more important pieces of this strategy than ever. But wouldn’t it be great to automate these security audit checks and…
At Tampa Devs, our mission is to support the local tech community by providing a space for people to learn, share ideas, and collaborate. We do this by hosting events, running a Slack workspace, and generally collecting and distributing resources for people to learn, grow, and succeed. We’re sometimes approached by outside sponsors who believe in our mission and want to help us achieve it.…
At Orlando Codecamp, I presented a deep dive into the CI/CD pipelines I developed for The Water Museum that build and deploy Ibis AM to Steam and Itch.io. This was my first time delivering this presentation, and I was very pleased with the turnout and audience engagement. I’m looking forward to giving this talk again, and potentially expanding it into a multi-part YouTube/blog series. You…
Tampa Devs 501c3 information I’m pleased to announce that Tampa Devs is celebrating a new milestone. As of 11/15/2022, the IRS has officially designated our organization as a registered 501(c)3 Nonprofit, with 509(a)2 Public Charity status. This means that we are now officially a tax-exempt organization, and donations to Tampa Devs are tax-deductible. From the IRS letter: We’re pleased…
Earlier this March, I hosted a webinar with GitHub on their Secret Scanning feature. We had great demos lined up, plus a technical deep-dive into Secret Scanning. Check it out: GitHub Secret Scanning Webinar, March 2023
I was invited onto the Codechefs podcast to discuss my work with Tampa Devs. We discussed how Vincent and I started collaborating, the challenges we’ve faced in building the organization, lessons we’ve learned along the way, and our future plans for the community. Listen on Apple Podcasts, the CodeChefs Website, or below:
Preening flamingo. Canon EOS M6 MKII. 2022 Flamingo sunning. Canon EOS M6 MKII. 2022 Bee at work. Canon EOS M6 MKII. 2022 Orchid. Canon EOS M6 MKII. 2022 Orchids. Canon EOS M6 MKII. 2022 Flowers. Canon EOS M6 MKII. 2022 Leaves. Canon EOS M6 MKII. 2022 Red. Canon EOS M6 MKII. 2022 Spider. Canon EOS M6 MKII. 2022 Eucalyptus. Canon EOS M6 MKII. 2022 Flamingoes. Canon EOS M6 MKII. 2022 Flamingo…
In collaboration with my friend at The Water Museum, we’ve developed and released our first game: Ibis AM. You can find it on Steam and Itch.io. Check out the trailer: Ibis AM trailer. My primary contribution to the game’s development were its build and release pipelines, which are built with GitHub Actions. To learn more about those, check out my talk at Orlando Codecamp 2023: Ship…
It’s not often that you get the chance to meet your heroes. I’ve been a fan of Steve Wozniak since I was a kid, and have always admired his work and philosophy. Even so, I never thought I’d get the chance to meet him in person. Because of our work in the community with Tampa Devs, Vincent and I were invited to speak at Civo Navigate 2023, hosted in our very own hometown of Tampa,…
Today, I published my first Ruby gem: Sssecrets (RubyGems, GitHub, RubyDoc), a library for generating secrets (like API tokens, etc) in line with best practices. Let me tell you all about it. Sssecrets stands for Simple Structured Secrets. It’s a reusable implementation of GitHub’s API token format (which is also used by NPM), and it’s designed to make it simple for developers to…
Recently, I was asked to weigh in on a recent TikTok controversy by WFLA Channel 8 News. I was interviewed by Nicole Rogers about the security risks of TikTok, and whether the political pressure to ban the app is warranted. It was a great opportunity to call out the larger political discussion around privacy and data governance in social media. The debate over Tiktok is a political one, calling…
A fistful of fresh Yubikeys I often notice some misunderstanding of the purpose and capabilities of Yubikeys in online discussions. In my experience, the conversation tends to focus on their use with FIDO/Webauthn and SSH authentication with PGP. While these are definitely useful applications for Yubikeys and other security keys of their ilk, they have a wider range of other advanced features as…
The time has finally come: With the advent of Twitter’s new “Promotion of Alternative Social Platforms Policy”, I have utterly lost my confidence in the governance of the platform. If you’re like me, Twitter filled a niche. Part notebook, part blog, I have tweets tied to memorable events and would like to preserve their sentimental value somewhere on the open Internet…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Practical Cloud Security: A Guide for Secure Design and Deployment - Chris…
At Tampa Devs, we rank our performance across two dimensions: the success of our members, and our contribution to their success. Our members inevitably seek to use the skills and knowledge they obtain to pursue successful careers in software development, and we want to help. That’s why we’re pleased to introduce the first of our member-focused career development and placement services,…
Recently, I was approached by a member of Tampa Devs who was facing a small sorting puzzle at work. They had been tasked with developing a user interface for an internal invoice management application. However, the schema for the API they had been provided to retrieve invoice data from was organized in a less than ideal way. The invoice data API was designed such that information related to every…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Where Have I Been??? I’ve taken a bit of a hitaus from updating these statuses! The past three…
It’s 2022. In other words: the historic year I finally took back my sovereign right to blogging. The Electric Sands of Time Generally speaking, I’m not very interested in waxing on with rose-colored nostalgia trips through my digital history. That said, it’s satisfying (and somewhat unnerving) to revisit nearly a decade of posting my thoughts and creations online. So how does one…
After much planning and investment, Tampa Devs have successfully ran our first hackathon, TADHack Tampa 2022, in October. This was a massive undertaking for Vincent and I: More than 120 people attended, and we distributed ~$1,500 worth of prizes to local winners. You can check out the full rundown of winners & participating teams, along with recordings of each team’s pitches and the awards…
I gave a talk on application security at the August Tampa Devs meeting: (mirror) Photos
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Build: An Unorthodox Guide to Making Things Worth Making - Tony Fadell.…
Drums. Canon EOS M6 MKII. 2022 Camel wreath. Canon EOS M6 MKII. 2022 Dylan with guitar 1. Canon EOS M6 MKII. 2022 Dylan with guitar 2. Canon EOS M6 MKII. 2022 Kevin. Canon EOS M6 MKII. 2022 Poet for hire. Canon EOS M6 MKII. 2022 Tune-up. Canon EOS M6 MKII. 2022
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Permanent Record - Edward Snowden. (9781250237231) (fin) Papers: I revisited a…
Cormorant. Canon EOS M6 MKII. 2022 Ibises. Canon EOS M6 MKII. 2022 Moorhen. Canon EOS M6 MKII. 2022 Grass. Canon EOS M6 MKII. 2022 Flower 1. Canon EOS M6 MKII. 2022 Flower 2. Canon EOS M6 MKII. 2022 Heron. Canon EOS M6 MKII. 2022 Mourning dove. Canon EOS M6 MKII. 2022 Ducks. Canon EOS M6 MKII. 2022
Welcome to Charlton’s blog. This post is intended to track new developments and acquaint you with some of the features and layout of this website. Sections This blog is divided into the following main sections. Blog Posts The highest-level and most general section containing all of my various writings, projects, etc. My Projects This section is a subset of Blog Posts, listing only posts…
Small alligator. Boyd Hill. Canon EOS M6 MKII. 2022 Kestrel. Boyd Hill. Canon EOS M6 MKII. 2022 Carolina anole. Canon EOS M6 MKII. 2022 Gull in flight 1. Canon EOS M6 MKII. 2022 Gulls in flight. Canon EOS M6 MKII. 2022 Gull in flight 2. Canon EOS M6 MKII. 2022 Squirrel. Canon EOS M6 MKII. 2022 Beehive. Canon EOS M6 MKII. 2022
I’m a subscriber to the oss-security mailing list. Occasionally, a particularly interesting post will catch my eye. In this case it was a portion of a larger disclosure of several CVEs in GRUB2. Apparently GRUB contains an HTTP client, albeit one with less-than-perfect bounds checking on its request data buffer: CVE-2022-28734 grub2: Out-of-bounds write when handling split HTTP headers…
One of my favorite pastimes involves modifying computing hardware, whether it’s just to keep things running or to unlock functionality that was never planned to be there. I recently decided to upgrade my “fat” PS2 with disk storage. To date, I’ve used the network adapter to load backups from a local network share via OPL. Performance is acceptable with this method (and much…
Hack@UCF Main Talk: Web Application Insecurity Previous Next / [pdf] View the PDF file here. Hack@UCF Tool Time: LXD Previous Next / [pdf] View the PDF file here. Hack@UCF Tool Time: Iodine Previous Next / [pdf] View the PDF file here. NCCDC Inject: NIST Cybersecurity Framework Previous Next / [pdf] View the PDF file here. CAP3104 Final Project: Sked Application Presentation Previous Next / [pdf]…
Background During my executive tenures at Hack@UCF, I was one of the club representatives responsible for supporting the Lockheed Martin Cyber Lab project. One of my goals for the project was to propose that some of the funding be reserved for a new, dedicated compute cluster. This cluster would benefit students as a playground for workshops, research, and training for cybersecurity competitions,…
In late 2018, I started building a new cybersecurity competition in collaboration with my cofounder, UCF’s Institute for Simulation and Training, and its Cognitive Sciences Laboratory. Our goal was to create a competition that would be accessible to students of all skill levels, and that would showcase the interdependent skillsets of designing, securing, attacking, defending, and…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Fundamentals of Software Architecture: An Engineering Approach - Mark Richards.…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Fundamentals of Software Architecture: An Engineering Approach - Mark Richards.…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: I Am A Cat - Natsume Sōseki. (9780804832656) (in p.) Glimpses of Unfamiliar…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Programming Ruby 1.9 & 2.0 - Dave Thomas & Chad Fowler, Andy Hunt.…
What This Is This section contains a number of subheadings where I can archive and organize the various things I’m studying/working on from a month-to-month basis. It’s essentially a long list of tersely formatted status updates that I collect and maintain along with some commentary. Reading… Books: Programming Ruby 1.9 & 2.0 - Dave Thomas & Chad Fowler, Andy Hunt.…