Engineering, software, security, and advocacy
Go 1.21 has some awesome changes that improve the overall developer experience and enhance performance. There's also some great new packages and functions to streamline common operations, and even a new opt-in experiment to fix a common bug. This article highlights my favorite changes in Go 1.21.
Go is one of my favorite programming languages, but it is still far from perfect. Over the past 10 years, I have used Go to both build small side projects and large scale applications. While the language has evolved significantly from its original release in 2009, this post highlights some of the areas where I think Go still has room for improvement. Before we get started, I want to be absolutely…
Security engineering is an ever-evolving space. While prevention and planning are still very important, we also need to invest in detection and response. Audit logs (timestamped records that capture the entity that performed an action in a system) are very useful for retroactive analysis following a security incident, but what if they could also be used to proactively alert before a security…
I tried to cancel my Sirius XM Satellite radio that came included with my car purchase today. They automatically start billing after the trial ends. After muddling through their website, I found the only way to cancel the subscription is via chat or phone. I opted for chat, here's the transcript: Sam (17:45:38 GMT): Thank you for your patience! My name is Sam and I'm here tohelp you now. I see…
Google-managed SSL certificates are TLS certificates that Google Cloud obtains and manages for your domains, renewing them automatically. These are Domain Validation (DV) certificates which support multiple hostnames (via SNI) in each certificate. The process is conceptually similar to Let's Encrypt. Suppose I have a website like example.com that's using Google-managed SSL certificates on a Google…
Terraform is a popular tool for managing infrastructure configurations as code, but what if your infrastructure needs to create or delete secrets like API keys or credentials? Google Secret Manager is a Google Cloud service that stores API keys, passwords, certificates, and other sensitive data. It provides convenience while improving security. This post explores how to manage Secret Manager…
Terraform is a popular tool for managing infrastructure configurations as code, but what if your infrastructure needs secrets like API keys or credentials? Google Secret Manager is a Google Cloud service that stores API keys, passwords, certificates, and other sensitive data. It provides convenience while improving security. This post explores how to access Secret Manager secrets from Terraform.…
I have been doing some Java development recently, and my preferred editors of choice bounce between Visual Studio Code and Neovim. My vim setup is configured to format Java source files using google-java-format, but I was struggling to achieve the same behavior in Visual Studio Code. This post explores how to format Java source files using google-java-format in VS Code.
I was part of the GitHub Actions beta and have used GitHub Actions to run tests, close stale issues, and automate formerly-manual tasks in my repositories. Over the holiday break, I explored authoring GitHub Actions in languages other than Node.js. This post explores how to write and publish GitHub Actions written in Go, but the principles are largely applicable to any language since the…
Terraform is a popular tool for managing infrastructure configurations as code, but what if that infrastructure is serverless? Google's Cloud Run is a fully-managed serverless offering that leverages the power and flexibility of containers as a deployment primitive. This post explores how to setup and configure a Cloud Run service using Terraform. The full sample code for this post is available on…
Serverless applications and cloud functions often need to communicate with an upstream API or service. Perhaps they require a username and password to connect to a database, an API key to talk to an upstream service, or a certificate to authenticate to an API. This raises questions like: How do I manage secrets in serverless environments? How do I get credentials into my serverless lambda or cloud…
I travel a lot. I spend a lot of nights in hotel rooms, a lot of miles in rental cars, and, mostly importantly, a lot of time on airplanes. As I approach my millionth mile this year, it feels appropriate to compile my 10 commandments of air travel.
You would think less than a month after a very popular HackerNews article on how Dropbox Hacks Your Mac, the file sharing company would be careful about the activities they are performing in their software distribution. Nope, not Dropbox. Today they released an update that adds a hacky overlay UI element to finder that cannot be disabled! Like most security-conscious folks, I disabled the Dropbox…
Mac OS X is notorious for being beautiful. Every vertical and horizontal line is just perfect... until you have that one application's icon which sticks out like a sore thumb. Obviously everyone has different aesthetic preferences, and this is not meant to hurt anyone's feelings. It has always been possible to replace these icons by hand. The steps generally go like this:
Authoring a client library for an upstream service is often challenging, but testing and preventing regressions against upstream API changes is sometimes impossible. This post discusses using RSpec example metadata filtering as a way to test against different client libraries on Travis CI.
On Sunday, March 27, Elliot Glasgow was reported missing. Elliot was a first-year undergraduate at Carnegie Mellon University. There was a frantic push on social media by parents, professors, students, and alumni to try to find him. A graduate student, Rajat Patra, was also missing for some time. Sadly both individuals were later found dead. While these events appear to be unrelated, they have…
Vagrant is an excellent tool for Rails development - you do not need to worry about installing dependencies, damaging your local workstation, or disparity between different machines and operating systems. You can quickly scale the size and shape of the virtual machine on and as-needed basis, and in a worst-case scenario you can destroy everything and start from a blank slate. However, virtual…
Although not officially coined until 2009, DevOps ideals have been explicitly discussed since at least 2006. Recently, however, the term "DevOps" has gained increasing popularity across a variety of fields and industries. DevOps is not a development methodology or technology; DevOps is an ideology. It is a way to facilitate organizational prosperity and growth while increasing each individual…
I recently spent a few hours trying to get a perfect score on Qualy's SSL Labs Tester. While I was not able to achieve a "100" in every category, I feel I got pretty close:
If you recently upgraded to Apple's OSX Yosemite, you may notice Safari only shows the "root" URL portion of a web address:
I am leaving Chef.
I recently gave a talk at Philly.rb, the Ruby meetup in Philadelphia, PA entitled "The Cleanroom Pattern - More safely evaluating DSLs with Ruby". You can watch the full Cleanroom DSL video online, but I decided to also write the contents of the talk into a blog post.
If you work with a lot of open source projects, you may find a need to modify a GitHub Pull Request before merging to the master branch. This may be because you need to rebase, fix a failing test, or resolve a merge conflict caused by an upstream change. If you have used the hub gem before, you are probably familiar with the following code: $ hub checkout…
The other day I found a fantasitc keyboard shortcut that has increased my productivity ten-fold. Working primarily on the keyboard, I find switching context to the mouse (or trackpad) an added distraction. Not only do my fingers and wrist need to context switch, but my brian also needs to think visually instead of conceptually... Since I spend the majority of my day on the Internet, I am a heavy…
Chef has long supported Ruby 1.8.7 and REE, even beyond the announced EOL periods from the Ruby maintainers. The continued support for Ruby 1.8 has been a burden for cookbook developers who want to use the "new" Ruby 1.9 features, but must retain support for Ruby 1.8. Chef 12 has officially dropped support for Ruby 1.8! As of opscode/chef@cf6ac3, Chef no longer supports the Ruby 1.8. This is an…
If you have ever had a Chef Client run fail with a mysterious "Authentication Failed" error after a few minutes of execution, then this post is for you! Because of the way the Chef Client loads resources, it is possible for authentication headers to "timeout" in the middle of a run. Thankfully there is an easy solution!
If you have ever written a Ruby application that interacts with git, you are probably already aware of the pains of testing such behavior. As if checking if git is installed at the proper version and catching all the crazy typos was not enough, git's algorithm's for calculating commit SHAs make functional testing quite cumbersome!
I recently experienced one of my most negative interactions with the humans of StackOverflow. I try not to rant or rave on my blog as much as possible, but I simply cannot let this go. It all boils down to this:
There are only two fundamental assumptions for working with Berkshelf:
I recently delivered one of my favorite talks - Living with OCD at BACON 2014. This talk covers my OCD tendencies as well as how I cope with them. The slides can be found on SpeakerDeck.
I was invited by the Carnegie Mellon Information Systems Department to speak about "DevOps". These are the slides from that talk. I posed the following question to the students and asked them to keep it in the back of their minds as we discussed the creation and evolution of DevOps.
As you may have seen across the various repositories on GitHub, README badges are all the rage these days. Whether it is Travis CI, Code Climate, or GitTip, it seems like all developers ever do is badge!
Originally given at ChefConf 2014, this talk simply titled "Chef Sugar" covers the who, what, when, where, and why for Chef Sugar. The talk begins as a small history lesson, but ends by diving deep into the Ruby internals of Chef Sugar to see who everything is wired together. You do not want to miss it! The slides for "Chef Sugar" can be found on SpeakerDeck.
A few months ago, I blogged about a thing called Chef Sugar. To quickly refresh your memory, Chef Sugar is an extension of the Chef core, recipe DSL, and select resources designed to make life as a Chef engineer as awesome as possible. I first wrote Chef Sugar for incredibly selfish reasons - I was really sick of seeing the same patterns repeated across all of our cookbooks. It all started with…
The Vagrant Berkshelf plugin has been rewritten to shell out to the berks CLI packaged with the ChefDK. There seems to be some confusion about this post. We are deprecating vagrant-berkshelf, a plugin for integration Berkshelf with Vagrant. We are not depecating Berkshelf by any means. After some internal discussions and conversations with the community, we are now looking for a new maintainer for…
How do you do code coverage with Chef?
Installing gems with Chef is relatively painless. Most of the time, you can use the gem_package resource, which behaves very similarly to the native package resource: gem_package 'httparty' You can even specify the gem version to install: gem_package 'httparty' do version '0.12.0' end You may have also seen the chef_gem resource. What's the difference?
Faraday is a really nice, middleware-based HTTP client for Ruby. For simple libraries, I recommend HTTParty, but Faraday is a really awesome solution when you need full control over the complete stack. However, Faraday has one feature/flaw that I have found. If Faraday is unable to connect to a server, it throws a really nasty error. I whipped up a tiny middleware to handle this error: class…
As the cookbook wrapper pattern becomes more prevalent, you may find it necessary to alter a parameter of a Chef resource in the library cookbook. For example, you may need to update the cookbook from where a file should be found, execute an action before a service starts, or change the variables passed to a template. If you care not to dig into the Chef internals, I highly recommend Bryan Berry's…
The Berksfile is really one of the most magical compontents of Berkshelf - a cookbook dependency manager for Chef. As a core team member, I sometimes take for granted the extensibility of Berkshelf, so I decided to blog about some patterns! Because the Berksfile is evaluated as Ruby, you have the ability to write pure Ruby code that will be evaluated at runtime.
Amazon Opsworks supplies its users with a nice collection of starter cookbooks on GitHub. Berkshelf prefers users treat each cookbook as its own software project, but for Opsworks users, that is not an option. Let me demonstrate a few ways you can use Berkshelf in tandem with Amazon Opsworks. There are two common ways to force Berkshelf to use the "monolithic repo" mode. Please note: you should…
A few months ago, I was having a discussion with some colleagues internally and CHEF-494 came up. In short, the ticket was created by Seth Chisamore and proposed creating a core cookbook that included some useful primitives for common patterns:
Optimizing for the important things is one of my serious lightning talks. Originally given at Ignite Pittsburgh, this 5-minute motivational talk has been given in many cities including San Francisco and Portland.
Fletcher Nichol discusses what "infrastructure as code" means to a developer at DevOps Days: Portland.
Recently I was working on a Rails 4 project, and much to my surprise, my favorite authorization framework is not supported! CanCan had long been my "go-to" framework for its simplicty and readability. I started searching the Internet for alternative gems, but many of them were also "not-Rails-4-ready" or had not had activity in months. As a Ruby developer, I cannot believe I did not think of this…
Okay, now that I'm done ranting about how to Unit test, let's move onto Chef. I spoke at Chef Summit a few months ago and received a lot of questions about ChefSpec. It's very difficult to demonstrate the value in a Unit test when everyone is thinking at a higher level (acceptance testing). Let's say I have a simple cookbook that just installs apache: package value_for_platform( %w(centos redhat…
Let's talk about testing. Testing is fun, it's awesome, and if you want to be agile, it's a necessity. But chances are, you're doing it wrong. Before we dive into Chef, let's look at a small Ruby example. Consider a class writes a downloads an HTML page from a website and writes the contents to a file: require 'net/http'
With many popular websites providing two factor authentication, why shouldn't you add two-factor authentication to SSH? Public-key, Private-key encryption is generally considered to be very secure, but why not take an extra step? This tutorial will use the open source Google Authenticator project and PAM for setting up two-factor authentication.
Ruby 2.0 is no longer a work in progress! Ruby 2.0 Release Candidate 1 was released today! Here's how to get it: Install Homebrew: ruby -e "$(curl -fsSkL raw.github.com/mxcl/homebrew/go)" Make sure brew is up to date: brew update Install rbenv, ruby-build, and openssl: brew install rbenv ruby-build openssl Or, if you already have rbenv: brew upgrade rbenv Use rbenv to install Ruby 2.0 RC1 rbenv…
If you've been working with Chef in your organization for awhile, you've probably accumulated a bunch of cookbooks in a giant repository. With great tools like Berkshelf out there, it's become customary to rely on external community cookbooks, git repositories, and your own Chef Server for cookbooks. Essentially cookbooks have been extracted as a first-class object. With Berkshelf, you can manage…