Recent content on Tim Retout
When you pass an AWS certification exam, sometimes it can extend the life of related lesser AWS certifications. But I could not find an illustration of exactly which ones, so here’s an up-to-date diagram: Figure: Renewal relationships between AWS certifications. Each arrow is a ‘renews’ relation – there’s no obligation to pass lesser exams before the harder ones, but…
“You are what you eat” – but perhaps this is even more true of our information diet. It is hard to strike a balance between remaining a well-informed citizen versus spending hours ingesting unnecessary news about issues and events we can’t affect. But I’m increasingly convinced that my hours lost to doomscrolling are down to design choices by web publishers rather…
I am somewhat jet-lagged, having returned from Washington DC just before the 250th anniversary celebrations which will be happening today. I was part of a delegation sent by my employer to the AWS Summit there this week, partly to kindle interactions between PA Consulting and Jacobs who have recently taken a 100% share in PA . Much of our conference time was spent in meetings with AWS executives…
The seL4 organisation on GitHub uses git-repo to manage multiple source repositories, and so there are a large number of projects to get your head around when figuring out the ecosystem. As an experiment, I have taken the various manifest files across the org, and constructed a graph based on how frequently each pair of repositories is mentioned in a manifest together. See below: [This may render…
I have proposed the deletion of an obsolete script , but it makes me feel complicated feelings so I’m going to try and express those. This particular script was written in 2014, but the concept goes back much further – before git was invented. When I started university in 2003, I seem to remember the computing society used to run tutorials for first-year students on how to use Apache…
I have been looking at seL4 some more recently, and had a small patch merged today to remove a legacy Python module from a helper script. (I was trying to run the script on a system without that module installed, and it was almost easier to patch it out.) However, the more I think about this code and how it’s used, the more it seems wrong on at least five other levels. The patch itself is…
While watching the Vienna New Year’s Concert today, reading about its perhaps somewhat problematic origins , I was struck by the observation that the Strauss family’s polkas were seen as pop music during their lifetime, not as serious as proper classical composers, and so it took some time before the Vienna Philharmonic would actually play their work. (Perhaps the space-themed interval…
Recently I revisited my previous interest in seL4 - a fast, highly assured operating system microkernel for building secure systems. The seL4 Microkit tutorial uses a simple Wordle game example to teach the basics of seL4 Microkit (formerly known as the seL4 Core Platform), which is a framework for creating static embedded systems on top of the seL4 microkernel. Microkit is also at the core of…
It can be incredibly easy for a frontend developer to accidentally write a client-side cross-site-scripting (DOM-XSS) security issue, and yet these are hard for security teams to detect. Vulnerability scanners are slow, and suffer from false positives. Can smarter collaboration between development, operations and security teams provide a way to eliminate these problems altogether? Google claims…
This post was possibly inspired by my daughter’s homework assignment to interview an old person about technology change. Guess who’s old now? Sometimes I look back at how life used to be, and remember what it was like. There are two key nostalgia points for me: before internet, and before smartphones. Before the internet Before the internet, there were computers. There were always…
At ArgoCon today, Thomas Fricke gave a nice talk on Cloud Native Deployments in Air Gapped Environments describing container vulnerability scanning in the German energy sector… and since he didn’t mention data diodes, and since some of my colleagues at Oakdoor /PA Consulting make data diodes for a living, I thought this might be interesting to write about! It’s one thing to have…
At CentOS Connect yesterday, Jack Aboutboul and Javier Hernandez presented a talk about AlmaLinux and SBOMs [ video ], where they are exploring a novel supply-chain security effort in the RHEL ecosystem. Now, I have unfortunately ignored the Red Hat ecosystem for a long time, so if you are in a similar position to me: CentOS used to produce debranded rebuilds of RHEL; but Red Hat changed the…
LWN reminds us that Git still uses SHA-1 by default . Commit or tag signing is not a mitigation, and to understand why you need to know a little about Git’s internal structure. Git internally looks rather like a content-addressable filesystem, with four object types: tags, commits, trees and blobs. Content-addressable means changing the content of an object changes the way you address or…
At the end of March, the source code to StackRox was released , following the 2021 acquisition by Red Hat. StackRox is a Kubernetes security tool which is now badged as Red Hat Advanced Cluster Security (RHACS) , offering features such as vulnerability management, validating cluster configurations against CIS benchmarks, and some runtime behaviour analysis. In fact, it’s such a diverse range…
On Tuesday I attended the Open Source Strategy Forum in London, which is a meeting of the Fintech Open Source Foundation (FinOS), part of the Linux Foundation. (There is a New York version coming up in November for those across the pond.) The morning keynotes included Gabriele Columbro introducing the day , then Russell Green highlighting the progress FinOS has made; Liz Rice of CNCF fame with an…
Last month, Google Cloud published Planning for the Worst: Reliability, Resilience, Exit and Stressed Exit in Financial Services . This happens to be a topic I have previously worked on, so I was very interested to hear the perspective that GCP would bring. The wider industry context here is that regulators are very interested in potential risks to the financial system arising from the wholesale…
Maglev is the codename of Google’s Layer 4 network load balancer, which is referred to in GCP as External TCP/UDP Network Load Balancing . I read the 2016 Maglev paper to better understand various implementation details of Maglev with an emphasis on security (in particular as affects availability). Maglev uses a scale-out approach, implemented within clusters built from commodity hardware…
I recently had cause to remind myself of Google Workspace administrator account best practices . Briefly: Set up separate admin accounts, e.g. admin-alice@example.com to exist side-by-side with alice@example.com . Keep accounts individually identifiable, and ideally ensure there are multiple Super Admins in your organization. 1 Avoid using admin-alice@example.com for day-to-day use. One of these…
After writing a trie I wanted to better understand its performance, so I wrote some benchmarks against various other Go implementations for storing UK postcodes. At some point since the new year I entirely replaced the implementation from my last post with one that more closely matches the “pure” trie described at the start of TAOCP 6.3; i.e. a table of nodes, consisting of a list of…
A trie (pronounced either “tree” or “try”) is a data structure typically used to store a set of strings in a way that allows looking up by prefix efficiently - i.e. unlike a hashmap where the keys are randomly ordered - this makes it a reasonable choice for an autocompletion system. A possible advantage over binary trees is that the keys are not stored in full in each node…