Recent content on typicalrunt.me
I was recently invited to participate in a leadership panel and was asked a question about being the person who would “jump on a grenade” for the team by owning the implementation of a solution. I understand the spirit of the question. It was about accountability, ownership, and leadership under pressure. But I disagree with the metaphor. The downside of a being on a panel is that I could only…
I was recently asked to be part of a focus group for a new performance management framework. One of the things I noticed is that the framework fell into the same trap as what I’ve seen at other companies I’ve worked that had the same framework. I’m not sure where these HR teams get the ideas for these frameworks, but they all suffer from the same flaws. Regardless, I wanted to…
A common refrain from people nowadays is the obviousness that AI is being used to create their content. There are often the usual tells: emdashes, if-then bridges, emojis. Oh gosh, so many emojis. It’s a tell, but what’s more interesting to me is that AI is not wrong in that regard. It’s just that the content published by people contains the AI’s writing voice. Everyone has…
Cyber is useful as an executive umbrella term, but dangerous when practitioners adopt it as precise language. Security is an engineering discipline. Engineering requires specificity. You secure assets, systems, identities, data, processes, and trust boundaries. You do not secure “cyber”. This article was prompted by conversations I had around BSides Calgary 2026 , but it is not about…
The Problem If you run database migrations with Flyway inside Docker containers, you’ve probably noticed the steady stream of CVE findings from your vulnerability scanner. AWS ECR image scanning, Trivy, Grype — they all flag the same thing: dozens of OS-level vulnerabilities in the base image that have nothing to do with your migrations. The official Flyway Docker image is built on Debian…
When your organization runs Zscaler Private Access (ZPA) for zero trust network access, you inevitably need visibility into what’s happening: who’s connecting, what they’re accessing, and whether your app connectors are healthy. ZPA’s Log Streaming Service (LSS) gets those logs out of Zscaler’s cloud — but getting them into your SIEM reliably and cheaply is a design…
These are the songs I was listening to this year. edamame – bbno$, Rich Brian AAAHH MEN! – Doja Cat Pretty Girls (feat. OBanga) – Will Smith, OBanga Woman – Doja Cat Jealous Type – Doja Cat Sugar On My Tongue – Tyler, The Creator 1-800 – bbno$, Ironmouse Mystical Magical – Benson Boone gigolo – bbno$ And that’s it for 2025! See you next year!
I’ve been doing a lot of thinking lately on a particular topic and I have come to the conclusion that I have a confession to make. I withdrew late from my MATH 153 course in first-year university. There, I said it. It doesn’t seem so bad once I write it here, it’s almost laughable, but I have hidden this information as a deep, dark secret my entire adult life. I even allowed it…
AWS Identity Centre makes access sane, but the config file still ends up full of manual work. Every account, every permission set, every profile name. Setlist removes the tedium by building a full .aws/config from the permission sets you actually have provisioned. It walks AWS Organizations, pulls the permission sets per account, and writes clean profiles for each combination. If you want friendly…
I keep a lot of repositories spread across organizations. When I need a local copy of everything (backup, audit, offline work, whatever), I end up writing one-off scripts that are boring, fragile, and always missing the one repo I forgot about. So I wrote a tool to make this boring task repeatable: gitgrab . https://github.com/scottbrown/gitgrab gitgrab does one thing: it grabs every repository…
Most risk matrices fall apart because the numbers are vibes. One team calls an impact a 5, another calls it a 2, and nobody can agree why. This tool forces the hard part first: define what each impact level and likelihood level actually means. That could be dollars, headlines, or hours of downtime. Once the definitions are set, the matrix shows the severity bands and a summary of the quantitative…
Most meetings fail before they start. Not because people are lazy, but because nobody wrote down the basics: what we are doing, who is needed, and what decisions are on the table. The Meeting Prep Checklist is a small tool that keeps that list tight. Set the objective, capture the agenda, list attendees and pre-reads, and track a few prep checks. When you are done, it copies a clean summary you…
I keep a risk register for the same reason I keep a TODO list: memory is not a system. So I built a small, browser-only tool to keep the register clean and boring. Risk Register Lite lets you add a risk, set likelihood and impact, and capture mitigation notes. It scores each item, stays local in your browser, and can export to CSV when you need to move the data elsewhere.
If you’ve been running AWS ECS for any length of time, you’ve likely noticed something annoying: task definition revisions accumulate. Every deployment creates a new revision, and AWS never cleans up the old ones. Over years of active development, this adds up. I recently inherited an AWS account that had been running ECS workloads for about 6 years. When I looked at the task…
Over the years, GitHub organizations tend to accumulate repositories. Some are actively maintained, others slowly fade into obscurity, and a few become completely forgotten. Without a systematic way to assess repository health across an entire organization, it’s easy to lose track of what’s actively maintained and what’s collecting digital dust. I built Patina to solve this…
If you’ve ever worked with AWS Security Hub, you know the feeling: thousands of security findings scattered across multiple accounts, buried in the AWS console, and no easy way to share them with your team. Sure, the data is there, but getting actionable insights? That’s a different story. That’s why I built Prism . What is Prism? Prism is a CLI tool that transforms AWS Security…
When I migrated this blog from Middleman to Hugo, I made a deliberate choice that might seem unusual: I use UUIDv7 identifiers as the URL slugs for all my blog posts. Instead of URLs like /why-i-use-uuidv7/ or /2025/12/why-i-use-uuidv7/ , my posts live at addresses like /019a5150-2c00-79db-af2a-8c2a0bf021a7 . The Problem with Traditional URL Schemes In my experience, most blogs use one of two URL…
This week I was tasked with discovering what my core values are. The context around this was that I needed to understand what my core values are so that I can understand how they are being violated, in the hopes that I can understand how a disagreement was created with someone else. That got me thinking: what are core values? It’s nothing I’ve ever really thought about before. Sure, I…
In a recent article, I added a code block for MermaidJS and found that neither Hugo nor my theme (PaperMod) would support MermaidJS. It rendered the code block as-is in raw form without converting it into a pretty diagram. I was able to add support for MermaidJS by making a very small change to how Hugo renders the page. Create a new file called layouts/partials/extend_head.html if it…
I’ve been designing VPC architectures in AWS, conventional wisdom tells us to avoid overlapping CIDR blocks. Heck, every single company I’ve worked at has an infrastructure or network team beholden to this idea. The reasoning is straightforward: non-overlapping CIDRs allow you to connect VPCs via peering, Transit Gateway, or other networking constructs if needed later. But what if…
Alternate title: So You’ve Found Yourself in a Security Incident I’ve attended, commanded and, yes, caused, many security incidents in my career. This is not an appeal to authority but, rather, an appeal to experience. Often we don’t have time to talk or teach about security incidents, so this document collects various tips and tricks I’ve encountered throughout the years.…
Jira is such a lovely tool. Its search functionality requires you to understand JQL (Jira Query Language), which is a famously powerful and opaque language to help you find literally anything in its database of tickets. So you might have a need to find the tickets owned by someone who has left the company. That should be easy, right? Right? At first you’d think so, but then you don’t know Jira…
This article is adapted from an internal company blog post. Identifiers and costs have been anonymized/changed. Infrastructure as Code (IaC) has become the backbone of modern cloud operations, but migrating existing cloud configurations to Terraform can be a time-consuming and error-prone process. This analysis examines a real-world project where I used an agentic coding assistant (specifically…
ChatGPT has the concept of “traits”, which is one of the ways that you can customize ChatGPT’s responses to you. As soon as this feature became available last year, I added my own custom trait. Here it goes: Never apologize. always assume the user has already consulted with competent authorities and other sources. Do not give advice not directly asked for. Be succinct and do not…
These are the songs I was listening to this year. If We Ever Broke Up – Mae Stephens Another Night – Real McCoy Talking In Your Sleep – The Romantics CUFF IT – Beyonce Padam Padam – Kylie Minogue Houdini – Eminem Espresso – Sabrina Carpenter Not Like Us – Kendrick Lamar I’ll Always Be There – Roch Voisine Somebody That I Used To Know – Gotye, Kimbra And that’s it for 2024! See you next…
This article is adapted from a corporate newsletter article I wrote. I have only changed the parts that would leak corporate information. I speak often about my stance on traditional security teams at many companies. Often they are the Department of No , they act like they are the police, and they aren’t very technical. As a result, employees in other departments speak to them only as a last…
These are the songs I was listening to this year. Is There Someone Else? – The Weeknd Shoop — Salt ’n’ Peppa Every Little Step – Bobby Brown The Lovecats – The Cure The Promise – When in Rome Wobble – Crankdat, Tisoki 2 Be Loved (Am I Ready) – Lizzo Sweet Dreams – La Bouche Die for You - Remix – The Weeknd, Ariana Grande Calm Down (with Selena Gomez) – Rema, Selana Gomez A Real Hero –…
An overweight man comes into the doctor’s office. He says to the doctor, “hey, I’m looking to get in shape, lose weight, and get healthy. But I don’t know what to do. What is your advice on what I should do?” The doctor replies, “that a great ideal. well we can certainly do a checkup and make sure there are no biological or genetic issues that will hinder your…
I was helping out IT this week with an automation task they had: they want to sync the data in UKG (an HRIS platform) with the data in the IdP. The problem was, nobody’s documentation was very good and left out important details, and Google was almost no help either. Hopefully someone else can stumble their way onto this page and get going quickly. curl -H 'Accept: application/json' \ -H…
One of the common patterns in my life is to surround myself with people with whom I allow to abuse me. And one of the popular refrains of these people is to tell me this phrase: You need to stop taking things so personally. And I find that phrase interesting because it is really difficult not to take things personally when they are targeting me with their abusive words. But, as I said, this is a…
I routinely come up with what I think are million dollar ideas. And I get euphoric about how successful it will be be, I’ll make so much money, and people will be happy. And then as the euphoria dies down, typically as I start designing it, I have some sober thoughts. Would I use my own product? Maybe. Would I pay for my product? Probably not. And the reason why this is invariably boils down…
A person dear to me, who is new to the tech world, asked me a simple question: “What is a static website?” It was asked in response to me saaying that I have a static website– this website you are reading. Tech Jargon and Shibboleths Once again it dawns on me how often jargon slips into normal conversation and acts like a shibboleth. It’s hard to place one’s self squarely…
A long time ago I wrote about my method of book-keeping using Ledger CLI . Nearly 10 years later, I’m still using it track my finances down to the penny. It’s an amazing tool, and has helped me identify problematic spending habits. But it does have one achilles heel, it’s not very friendly to non-technical people. I share my finances with my family because I want to teach…
I recently had to go through the mandatory annual training around ethics, security, and handling sensitive data. Like many companies, this training comes in the form of pre-built SCORM courses. I received the following question from KnowBe4 , specifically in handling sensitive data. I was going to answer this question by choosing “Find a location with greater privacy and communicate using…
The previous part in this series introduced ChatGPT and explained my motivations for testing it out. One of the coolest features of the tool is that it will remember previous topics in the conversation and apply them in future prompts. So you don’t need to get it right the first try, you can rephrase and try again. Since I learn best when the knowledge is applied, I asked ChatGPT to help me…
I love computer technology. All aspects of it. That’s why it has been my career choice my entire adult life, even though my jobs have changed over time (software developer, operations, systems administration, security, etc.). To an outsider, computer technology is akin to magic. But for those of us in the industry, it is our job to understand how that magic works. It is not a stretch to say…
As we kick off 2023, the technology industry is grappling with an unprecedented wave of layoffs, leading to a phenomenon that I am coining the “2022 Tech Bust.” This crisis has sparked comparisons to the Dotcom bubble burst of the early 2000s, reminding us of the importance of learning from the past to navigate a sustainable path forward. I want to examine the factors contributing to…
As I see it, there are 3 ways for a company to increase its profits. Get more customers. Reduce expenses. Squeeze more money from existing customers. The first is the most obvious, but some companies have either terrible marketing departments, ineffective sales departments, or unproductive engineering departments (these are the three major profit centres). The second is always useful to be doing,…
These are the songs I was listening to this year. Hello Good Morning - Remix – Diddy - Dirty Money, Nicki Minaj, Rick Ross – Hello Good Morning (Remix) Love Is Gone – David Guetta, Chris Willis, Fred Riester, Joachim Garraud – Pop Life Dance Off – Macklemore & Ryan Lewis – This Unruly Mess I’ve Made Todo De Ti – Rauw Alejandro – Todo De Ti Danza Kuduro – Don Omar, Lucenzo – Meet The Orphans…
These are the songs I was listening to this year. Major Tom - Coming Home – Peter Schilling – The Different Story Take Me Home – Phil Collins – No Jacket Required Teenage Dirtbag – Wheatus – Wheatus Like Gold – Loud Luxury, Frank Walker, Stephen Puth – Like Gold Stressed Out – Twenty One Pilots – Blurryface Save Your Tears – The Weeknd – After Hours Just as Much – Delaney Jane, Virginia To Vegas –…
These are the songs I was listening to this year. Run – Joji – Run You Can Call Me Al – Paul Simon – Graceland Total Eclipse of the Heart – Bonnie Tyler – The Very Best of Bonnie Tyler Touch Me – Samantha Fox – Touch Me Nothing’s Gonna Stop Us Now – Starship – No Protection Call On Me – Litany – Call On Me Roses - Imanbek Remix – SAINt JHN, Imanbek – Roses Say So – Doja Cat – Hot Pink Like…
2020 has been quite a tough year for human relationships. I’m naturally inclined towards recharging my batteries alone, but even I have been feeling the effects of a lack of human relationships. One area that has surprisingly benefited from our physical distancing measures is during mentoring. I have been mentoring UBC Computer Science undergraduates for about 15 years now. My role in the…
I love efficient meetings. I love meetings that were scheduled for 30 minutes but instead take 8 minutes. One of the tricks I use to hold efficient meetings is to put topic tags into each agenda. Oh, and the other trick I use is to always have a meeting agenda. Friends don’t let friends accept meeting invites without an agenda! An agenda topic tag consists of a bullet point about the topic,…
This is part 4 in a series of articles. To follow along via code, visit the Github repository . In the last article , I reviewed the template for operational and security risks. Let’s go fix some of them now. Making Unsafe Defaults Safe First, some guard rails are added to the template. Remove the Default attribute from both SSHLocation and HTTPLocation , ensuring that the caller specifies…
This is part 3 in a series of articles. To follow along via code, visit the Github repository . The last article discussed some refactoring use new(-ish) CloudFormation features, which help improve the readability and reduce the template’s file size. This article temporarily moves away from template modifications and focuses on how someone can review a CloudFormation template for security…
This is part 2 in a series of articles. To follow along via code, visit the Github repository . In the last article , I showed how we can improve the operational capabilities of the AlienVault sensor deployment in AWS, simply by adding some automation and formatting changes to the generic CloudFormation template supplied to customers. Let’s further improve the YAML template to make it more…
This is part 1 in a series of articles. To follow along via code, visit the Github repository . I recently needed to review the AlienVault Sensor deployment for AWS and, well, it left me wanting more. Many companies are smart to offer infrastructure-as-code for their appliances. It provides customers with a near one-click deployment model. It also provides customers with insight into what…
I have just started reading Tribe of Hackers by Marcus Carey (et al). I already love the format of the book. He takes 14 questions and asks them to prominent people in the field of computer security. Before I start reading the book, though, I want to provide my own answers to his questions and then see how they relate to the others in the book. If there is one myth that you could debunk in…
In the previous article I showed how a model can be disabled. One of the things that you probably noticed is that I’m using a timestamp (DateTime) field instead of a Boolean field. This is a trick I learn years ago after working on a large database (>2B rows) for an Enterprise client. It has been useful in so many ways that I put it into every database design I do, yet I’ve never…
When I first started using model concerns I struggled with how I could test the functionality of the concern, without having to replicate the tests across all models. Here I show you how I decided to test model concerns. It may be controversial, so buckle up. What are Model Concerns? Model concerns are an interesting concept that — if I recall correctly— debuted with Rails 4. They allow a…