devopsy.kinsta.cloud

Category: IT as Code

Low-Code SaaS Solutions Need Security at Their Core
Faster integrations. Accelerated software delivery. Elevated user experiences. These are only three of the benefits organizations gain by incorporating low-code platforms, apps and solutions into software development and business process management.

Low-code platforms aren’t new, but demand for the technology soared in the last two years as companies were challenged to meet stakeholder demand for more digital transformation. With low-code tools, companies find they can expand digital transformation efforts through faster business application delivery. In addition, the time it takes to innovate is dramatically reduced with low-code tools.

Low-code solutions are no passing trend. In their recent report on global cloud revenue, Gartner predicted that by 2025, the use of low-code and no-code will “nearly triple,” adding that “70% of new applications developed by organizations will use low-code or no-code technologies, up from less than 25% in 2020.”

Low-code solutions give organizations the ability to produce working solutions and integrations with more speed and agility than more traditional on-premises development. Integration used to be a labor-intensive IT process requiring custom development on both sides of the integration. As more organizations adopt a “buy versus build” approach to software development, they are turning to self-service and other solutions with “out of the box” functionality to increase speed and efficiency. In addition, the vendor-developed components of low-code tools also offer a better user experience.

Rising Demand for Low-Code, Platform-based Solutions

As organizations expand their product and service offerings, the demand for low-code, platform-based solutions will increase. SaaS and PaaS solutions with a low-code focus can be effective for organizations looking for accelerated functionality. Often these tools include pre-built models and templates that businesses can quickly implement and easily duplicate for flexibility and versatility.

The ability to create seamless integrations with other applications is a must. Best-of-breed low-code platforms enable intelligent integration between multiple applications using graphical user interfaces (GUI) as well as industry-standard interfaces such as JSON and APIs within vendor-supplied environments. Intuitive visual user interfaces and drag-and-drop features allow businesses to customize the solution to meet their needs and preferences.

But along with ease of use and rapid functionality, organizations must look for low-code tools with security built-in.
Security: A Priority for Low-Code Tools

Security must be a top priority for organizations using low-code tools in any capacity, from using a low-code platform for application development or using a no-code SaaS solution for business process automation.

Anytime an organization introduces outside applications or any third-party API integration to an environment, the organization is entirely dependent on the vendor’s security implementation. This is especially true when combining various solutions to create a unified product or service. If the vendor doesn’t take security seriously, other parts of a solution could be exposed to risk because of a weakness in another area.

Problems can get in either intentionally or unintentionally, as demonstrated with the recent Apache Log4j vulnerability. The bug in this commonly used routine was found to have massive potential for cybersecurity attacks. As CNET cautioned, “The vulnerability in the widely used software could be used by cyberattackers to take over computer servers, potentially putting everything from consumer electronics to government and corporate systems at risk of a cyberattack.”

Ways to Remedy Security Risks of Low-code Tools

Organizations can’t make assumptions about the security of every tool, solution or platform they bring into their environment. They must complete their own due diligence for security in the software development pipeline or any time a 3rd party app or tool is introduced.

One critical step to addressing security is incorporating DevSecOps and shifting security left in the software development pipeline. The Log4j vulnerability put the need for DevSecOps in the spotlight. Taking a shift left approach and implementing security earlier and more often in the DevOps process can help to catch more potential vulnerabilities. It’s critical to introduce DevSecOps early in the development cycle, or organizations risk missing a bug or vulnerability. In the development cycle, security isn’t an antivirus scenario; all code must be scanned for vulnerabilities.

Organizations also need to employ due diligence when exploring options and solutions to bring into their environments. Look for solutions with security at their core. Before integrating any low-code solution, examine the vendor’s approach to security.

Some security measures to look for when considering vendors or solutions include:

Ensure they’re using the latest OAuth/2 models for both client to server security as well as server-to-server security or an equivalent standard.
All communications should utilize at least TLS 1.2 (transport layer security) and comply with industry standards for certificates and encryption keys.

All hashing should be using current accepted standards with HMAC, they should be enforcing security rules on passwords such as only storing password hashes and requiring 2FA if they interact directly with customer accounts.

Low-code platforms and tools have the ability to accelerate digital transformation efforts without having to rely on hand-coded, on-premises solutions. The potential for time savings and cost savings is significant, but it’s important for organizations to ensure they’re not compromising security when choosing solutions.
January 14, 2022
IT Ops Trends: Cloud, Containers and COVID

Almost all companies are modernizing their IT infrastructure to remain competitive, with the focus firmly on migration to the cloud and the use of dynamic infrastructures. In a recent Trends in IT Ops 2021 survey, more than 160 IT professionals were asked how the implementation of IT strategies affected their day-to-day work. The results provided an impressive insight into the current work priorities of system administrators and IT Ops in general.

According to the survey, most administrators believe that monitoring cloud (79%) and container (73%) environments will take on a more important, or much more important role for them in the future. Additionally, 59% of those surveyed agree that their job role has evolved over the years due to cloud computing and containerization.

Not all IT Teams are Equal

However, the data also shows that the changes are not affecting every IT team equally. For example, 37% of all respondents say that cloud solutions are not relevant—or less relevant to them on a day-to-day basis. This response shows that on the one hand, system administrators see cloud computing as an essential topic. However, on the other, the impact in practice is not felt to the same extent by every administrator. These responses show that not every administrator has to deal with cloud platforms on a day-to-day basis, with some being ‘siloed’ into dedicated teams that may not interact with the broader corporate cloud strategy. In addition, not every organization has fully committed to the cloud, with some finding their migration hindered by applications that are not suited to cloud migration.

In the survey, 45% of respondents also said they believe the importance of monitoring physical infrastructure will not change in the next few years. However, 43% believe that monitoring physical systems will become more important or much more important. Conversely, a mere 1% replied that they thought physical infrastructure monitoring was less critical.

Taken together, these responses demonstrate that, despite the excitement around the cloud, many organizations take a hybrid approach to infrastructure. IT Ops and administrators recognize the importance of monitoring cloud systems and dynamic assets while, at the same time, the monitoring of local systems remains relevant or is even expected to gain in relevance.

Network Management and Automation

Cloud and containers enable faster growth of IT environments and promote digitalization. However, they also lead to a sharp increase in data traffic and more complex networking of systems. As a result of these changes, the demands on local networks are growing. This increasing demand demonstrates the importance of network management tools. 81% of respondents said that solutions in this area are relevant, or very relevant to them in their day-to-day work.

This year, the move to a home office joined the trend towards migration to the cloud, containers, and network monitoring. In the wake of the COVID-19 pandemic, many IT departments had to adapt their infrastructure to allow employees to work from home offices. However, most administrators were relatively stress-free, with 54% saying they had no trouble adapting infrastructure to meet remote work requirements.

Automation is also a key issue. For example, 81% of all respondents say projects that deliver deployment and configuration automation have been relevant in their organizations in the past 12 months. In addition, 92% say that automation tools are relevant, or very relevant to them on a day-to-day basis.

Cloud, Containers and COVID

The Trends in IT Ops 2021 survey shows that system administrators are concerned with cloud computing and containers and several other topics. In addition, most administrators recognize the increasing importance of monitoring cloud environments and containers. That said, administrators continue to see monitoring networks and other physical infrastructure assets as critical, and some system administrators see increasing importance in monitoring this vital area.

In addition to the topics outlined here, respondents also provided feedback on topics such as virtualization, application performance monitoring and network management.

January 12, 2022
Enable Multi-Cloud Networking With Automation
As we enter a new era of technology, we’re experiencing a “third wave” of cloud innovation that brings new complexities into the IT landscape, mainly centered around multi-cloud networking. With every wave of cloud technology advancement, networking components are becoming more complex and distributed across multiple groups. Further, multi-cloud networking brings new challenges around connecting and managing across dispersed environments comprising private and public clouds, along with physical data centers. Organizations must unify their network operations in a way that enhances their capabilities into a new level of skill and efficiency.

Augment Strategies

Looking forward to new capabilities offered by automation tools, technology leaders can augment their 2022 IT strategies. How?
- Support a more seamless transition to cloud within hybrid IT infrastructures.
- Cultivate new values brought to an organization from network engineers.
- Enable executive leaders to easily align operations across multiple teams – spreading innovation across the entire organization.
Connecting Hybrid IT Infrastructures

As more IT leaders invest in an assortment of digital tools to streamline network operations – some engineering teams might feel more reluctant to leave behind old processes or feel intimidated by the multitude of new capabilities at their fingertips. With modern tools and processes gradually being incorporated into the workflow of IT departments, it’s critical to find the right balance in this “hybrid” environment, which will include a combination of both traditional on-premises systems with new cloud applications. Automation can help smoothen the transition to new technologies by simplifying manual processes previously relied on, while also bridging together the plethora of systems for easier management.

Leveraging Cloud-native automation

When bridging together disparate systems, leveraging cloud-native automation solutions that provide API capabilities can make all the difference. These solutions not only build the appropriate connectivity required between different applications but also provide the flexibility to manage networks in a cloud-friendly way. Additionally, automation can be deployed to ensure compliance of device configurations that span both on-premises network devices, as well as those connected to cloud-based infrastructures. For example, with automation it’s possible to quickly perform a configuration back-up, check for compliance and execute “intelligent remediation”. This translates to a network device or group of devices that can be backed up and the current configuration compared against the existing golden configuration standard. Changes can be automated to ensure the network is adhering to the current compliance standard. Further, automation is changing the way that IT teams approach daily operational challenges.

Evolving Value in Network Teams

Network engineers play a unique role in organizations by performing tasks that require years of training, and an understanding of the complex ins and outs of their internal systems. Although the performance of these manual tasks might be assumed to be the value-driver for engineers – the adoption of new technologies has pushed the boundaries of what network professionals are familiar with. In turn, this has evolved expectations for what constitutes true success and impact. Organizations are looking for engineers to harness the power of these new technologies and execute on a modern strategy – utilizing automation to support this new mindset.

Streamline the Adoption of Integrated Multi-cloud Environments

Breaking down the silos between technologies and teams is critical in order to understand how to get the most out of their investments. For network teams to fully embrace multi-cloud networking, they need to practice deeper management, segmentation, security and control of cloud networks. As with segmentation – automation can help network teams lean away from using overlays, and instead use the native software tools in AWS, Azure, etc. Additionally, many network teams might be under the false misconception that automation requires them to learn to program and write code – when in many new tools, network elements can be managed and orchestrated directly from within the code of an application. This will make network programmability part of the cloud software fabric, and streamline the adoption of integrated multi-cloud environments. Network teams can implement both compliance and automation to standardize both on-prem or new cloud programs, simultaneously building their automation skills without the need to write a single line of code.

Aligning Operational Efficiency

When investing in new IT infrastructures across organizations, IT leaders typically build up their programs “vertically” within each department. However, this creates a gap between teams, as each is operating in separate models and functionalities – driving up unnecessary costs and inefficient business practices. To successfully align multi-cloud initiatives for increased operational efficiency in 2022, IT leaders will be required to invest more “horizontally” across their organizations – and in doing so, incorporate automation tools to reduce time and stress.

Implementing NaaS

Achieving operational efficiency can reduce the time and stress experienced by IT teams – this is where the adoption of networking-as-a-service (NaaS) tools can play a beneficial role. IT leaders can invest in networking services directly from the cloud rather than building a new network. Over the next year, as cloud infrastructure expands, NaaS implementations will in tandem grow in importance – enterprises and other organizations (including service providers) will have opportunities to leverage cloud infrastructure without building new networks themselves. Automation tools can help accelerate the time-to-complete and automate the highest percentage of tasks in the activity, eliminating as much idle time as possible.

Moving Models and Making Improvements

When considering the investment in these types of tools, it is important to keep in mind how they impact the entire process versus individual tasks. By automating an entire process, not just individual tasks, the operator gains the flexibility to do more in much less time with fewer resources — making innovation possible. With increased flexibility and more time available, engineering and operations teams can focus their attention on strategic activities of greater value instead of performing routine, time-intensive activities. Operations are improved when IT leaders can move from a “human-centric” paradigm to an “automation-centric” model. For example, for maintenance checks, the team can let systems run an increasing number of pre-checks in seconds – enabling the process to execute more efficiently and safely. The key is adopting a model that automates the entire process versus individual tasks.

Moving Forward

In the next year, as more workplaces operate in hybrid models, IT leaders will need to evolve their processes to not only unify operations/approaches for remote and in-person employees – but move forward with this new wave of cloud modernization. In doing so, automation can help mitigate and manage the challenges that come with multi-cloud networking, bolstering skill and efficiency for long-term business impact.
January 10, 2022
Intel Expands Scope of OneAPI Toolkit Initiative

Intel has made available a 2022 edition of its oneAPI toolkit through which it makes processor extensions accessible to DevOps teams.

James Reinders, chief evangelist for Intel software products, said the goal is to make it simpler for DevOps teams to expose extensions to any company’s processors in the runtimes developers use.

At its core, the oneAPI toolkit is a collection of APIs that Intel created for x86, graphics processing units (GPUs), application-specific integrated chips (ASICs), field programmable gate arrays (FPGAs) and other classes of processors.

Reinders noted that developers have never had as much ready access to so many different processor classes before. The challenge organizations face, however, is making it simpler for developers to take advantage of those capabilities in a way that doesn’t require them to write low-level code, he added.

The oneAPI 2022 toolkit adds additional capabilities including the world’s first unified compiler implementing C++, SYCL and Fortran, data-parallel Python for CPUs and GPUs, advanced accelerator performance modeling and tuning and performance acceleration for artificial intelligence (AI) and ray tracing visualization workloads. Collectively, Intel said it has made 900 new and enhanced features available via the oneAPI toolkit in the last year, including deeper Microsoft Visual Studio Code integration, support for Microsoft Visual Studio 2022 and Microsoft WSL2 for Linux development on Windows.

As IT continues to evolve it will become more routine for developers to invoke heterogeneous classes of processors within the same application, said Reinders. Those capabilities will drive an explosion of software development innovation through the rest of the decade and beyond, he added.

Intel is especially focused on making it easier for developers to invoke inference engines that take advantage of processor extensions to run AI workloads, Reinders said. Going forward, most applications will take advantage of machine learning algorithms that run inference engines optimized by Intel via extensions to its processors. As those workloads are constructed, integrating AI models within DevOps workflows will become the next major challenge, noted Reinders.

It’s too early to say how simplified access to heterogeneous processors, also known as XPUs, might change the application development landscape. The one thing that is clear is IT organizations now have more options than ever. The issue now is finding a way to invoke all those capabilities in a way that doesn’t overwhelm developers. DevOps teams will play a key role in deciding which processors and associated extensions to make available to their development teams.

In the meantime, the battle for processor dominance will only intensify in the months ahead. DevOps teams will need to decide how comfortable they are using processors manufactured by a single company like Intel or whether they want to employ a mix of processors provided by multiple vendors. Regardless of what they decide, it appears APIs will play a critical role in making it easier to benefit from advances in processor technologies.

January 7, 2022
Crafting an Agile Enterprise Architecture
Digital transformation, business agility and enterprise architecture are frequently heard terms in this era of digital technologies and rapid change. The appropriation of digitalized applications, solutions and processes has enabled organizations to increase efficiencies. In turn, this allows them to respond to shifting customer needs and trends in a more flexible and agile manner.

Digital transformation, the rise in mobility and a remote workforce have created a shift in the business model paradigm. The adoption of a more agile approach has been gathering steam, and businesses that are building agility into their processes are seeing the payoffs. The results are greater productivity, faster time-to-market (TTM) and increased consumer satisfaction.

The Culture of Agile

Digital transformation succeeds in a business environment that embraces a more collaborative and flexible philosophy. Moving from simply doing agile business processes to being agile across the board requires a shift in the corporate mindset. When a business develops a truly agile architecture, everyone in the enterprise is involved in delivering solutions; from business operations and tech to marketing, finance, compliance and security. The agile culture moves from a company-oriented one to a people or customer-oriented culture, embracing the tenets of collaboration, co-creation, ownership, flexibility and communication.

Short-Term Cycles and Fluid Planning

Agility is redefining enterprise architecture from the traditional schematic of centralized governance, lengthy development cycles, scheduled quarterly reviews and reliance on a waterfall delivery method. Instead of long-term operating and strategy plans, agile enterprise architecture involves short-term cycles and fluid planning that is customer and market-centric. The language changes from top-down project mandates and management to continuous product development, experimentation, testing and monitoring within collaborative product teams.

Essentials for Crafting Your Agile Enterprise Architecture

The blueprint for a truly agile architecture requires fundamental shifts in the business dynamic. There are three essentials that stand out as requirements for attaining agility across the entire enterprise.
- Collaboration – The bedrock of successful enterprise-wide agility is collaboration. Innovation will flourish when it is decentralized, and isolated silos give way to cross-functional, agile and self-organizing teams. An isolated IT team leads to delayed projects, overrun budgets, productivity that is hard to measure and disconnects between business and operations. Every department must be involved in supporting and achieving key business goals.
Teams containing a mix of business line and IT professionals accelerate development and delivery, greatly reducing time to market. Based upon a shared customer-centric goal and vision, there is shared ownership of outcomes and a deeper level of engagement throughout the enterprise. Daily communication and collaborative feedback nurtures creativity, problem-solving, and drive continuous integration and continuous development. Collaborative input from colleagues, inside and outside the organization, is essential for enterprise, technology, and solution architects.
- Current state mapping – Adopting agile practices and principles throughout an enterprise entails potentially massive change. Without a clear roadmap for navigating the process, a business can flounder. Instead of achieving a leaner simplicity, there is increased complexity and a muddied vision. Before a business can successfully embrace an agile architecture, the current state of operations must be fully understood. Essentially, a blueprint of functionalities, capabilities, applications, and the tech stack must be crafted. Everything, from the data catalog to business process workflows must be mapped. Business leaders can ask the following questions to analyze the current state and assess impact points:
- Which projects should we prioritize and what capabilities will they require?
- Which processes rely upon what software applications?
- If we remove one or two apps, how will that impact processes?
Once the blueprint of the current state is mapped out, a business can work in a structured way to create the future state of its architecture with ease and at its own pace.
- Balance agile transformation with daily operations – Continuing to work with some of the current architecture for a time can allow the top level of the organization to ease into adopting the agile mindset and culture. In the iterative process of developing agile architecture, the architects, executives, and tech leaders will need to strike a balance between transforming initiatives and effectively maintaining daily operations. They will have to discern how much direction is needed versus support and how much they will set the pace.
If the focus is first on value delivered to customers, then the architecture will be prioritized according to the most strategic projects, capabilities and applications. An agile architecture will adopt a ‘just enough’ approach to project design and delivery.

Agile Architecture Optimizes Collaboration

Enterprise agility facilitates more direct communication and involvement of enterprise architects within the cross-functional teams. Through daily discussions and various touchpoints, architects can provide guidance, advice, and feedback on IT decisions and assist teams in jointly owning the solutions.

Working together, enterprise and solution architects can develop a complete view of the IT landscape and how it will need to be modified to fit into future needs; minimizing waste and optimizing resources. Solution architects can view the architectural map across all apps, solutions, and systems and collaborate on improvements. They can also help enterprise architects scale standardization across the entire business. That cornerstone of collaboration at the core of agile transformation enables architects and non-tech leaders alike to gain more clarity and alignment.

The Value of Agile

Business value is greatly improved when enterprise architecture combines agile practices. According to a report from McKinsey & Co., businesses transitioning to more agile models can improve financial performance by 20-30%, with 30-50% improving operational performance, TTM, and customer satisfaction scores. Embedding an agile model within processes, people, and technology will cultivate ongoing support for CI/CD, groundbreaking innovation, synergistic collaboration — and ultimately maximize customer outcomes.
January 7, 2022
IoT Developers: Get Familiar With LoRaWAN for 2022

IoT Analytics forecast the global number of connected IoT devices would grow to 12.3 billion active endpoints in 2021. That number is expected to grow exponentially in the near future as more and more industries make use of long-range wireless capability. For example, president Biden’s infrastructure plan promised major investment in smart cities and smart municipalities across the United States. 2022 will also see IoT growth in the manufacturing and utility sectors as ‘brownfield industries’ look to update their existing machinery for Industry 4.0. Both of these factors will bring about a massive surge in demand for low power wide area network (LPWAN) solutions using the long range wide area network (LoRaWAN) standard next year.

LoRaWAN is the standard protocol for LoRa wireless technology. LoRa was built specifically for long range use cases (it’s in the name). This means that technology using LoRaWAN requires significantly fewer repeaters and gateways to cover a large area, like a city, than would be required using traditional technologies. Additionally, LoRa is robust in how it responds to interference, and LoRaWAN sensors use less energy than other sensors, making them more efficient. In fact, ABI Research forecast that, by 2026, LoRa will be the leading non-cellular LPWAN technology.

In the grand scheme of IoT, LPWAN technology is relatively new. LoRaWAN became an open standard just six years ago when the LoRa Alliance was formed in 2015. This means the main challenge for IoT developers in 2022 and beyond will be educating themselves on the technologies needed to put LoRa-enabled plans into action. There are two big reasons why you should begin that process now: The rising demand for smart cities and Industry 4.0.

Building Cities Smarter

When it comes to infrastructure, roads and bridges might come to mind first, but in reality, infrastructure is much more holistic. Utilities like electricity, gas and telecommunications should all be included in any infrastructure discussion. These industries have already come to rely on IoT technologies to collect data and function in the modern world.

The government IoT endpoint electronics and communications market is expected to reach $21.3 billion in spending in 2022, according to projections by Gartner. As governments continue to modernize and implement more wireless technology, I expect a good amount of this money to go toward the development of solutions using LoRaWAN to create flexible networks on a very large scale for smart cities.

In fact, this movement has already begun. In September, the city of San Jose, California, announced its partnership with a blockchain-based provider to extend the city’s broadband access. In exchange, the city is now hosting and expanding its peer-to-peer IoT network infrastructure.

Updating Brownfield Industries for Industry 4.0

2022 will also see IoT advancements in ‘brownfield’ industries. These are industries with legacy, stand-alone machines and processes, such as in the manufacturing and utilities sectors, that weren’t originally created with internet connectivity in mind. Players in brownfield industries already have large install bases of machines that have no way of reporting status or other pertinent data.

These industries have long been looking at developing IoT solutions to solve this issue. Most are prototyping now with the goal of getting data to flow between large, legacy manufacturing machines with the end goal of improving manufacturing processes. However, unlike other industries where modern updates are often needed to improve efficiency, these manufacturers aren’t going to replace equipment that already gets the job done and has done so for decades. Instead, they need to find an alternate way to gather data and insights from the equipment they already have in place.

For many, LoRa-enabled sensors will be the answer. Often, upgrading to new technology requires equipment be substantially changed. That isn’t the case with LoRaWAN solutions, which allow manufacturers to add LoRa-enabled sensors to existing machines. LoRa-enabled sensors are durable, don’t require much maintenance and have low battery footprints. They also allow manufacturers to keep their data on-premises and on their own internal networks, a common preference for these types of industries. These characteristics make LoRa-enabled sensors ideal for manufacturing purposes.

In the new year, we will continue to see more pilot deployments go into production to help these industries gather the data they need to improve their processes and, in return, their bottom lines.

LoRaWAN Resources for Developers

The intention of the Biden administration’s high-tech infrastructure plans in the United States and the benefits of LPWAN (and LoRaWAN in particular) for private, long-range networks are converging to present a lot of great opportunities for this technology this year. That’s why 2022 will be the year IoT developers need to brush up on their knowledge of LoRaWAN.

If you are interested in learning more about LoRa, check out the LoRa Alliance or LoRa Developer Portal communities to get started.

January 4, 2022
Rails 7 FTW | WFH is SOP | 586M Passwords Dumped

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Ruby on Rails 7.0 is go, working from home is still de rigueur, and HIBP gets far, far bigger.

DHH is Excited

First up this week: Ruby on Rails version 7.0 is now in production. It promises less bloat, better security and even more developer efficiency.

Analysis: Last chance for greatness

Talk to devs about Ruby on Rails and you’ll hear a wide range of opinion—all the way from “obsolete memory hog” to “productivity secret weapon.” But its important promise seems to be to encourage devs to use better design patterns.

Paul Krill: Ruby on Rails 7 rejiggers JavaScript support

Ruby on Rails 7, the latest version of the web application framework, is now available as a production release. … It gives developers a “no-Node” approach to front-end development while still providing access to NPM packages and modern JavaScript.
…
Most Rails applications will not require Node.js, given the new defaults. … Other improvements:
…
Encrypted attributes have been added to Active Record, enabling applications to offer at-work encryption in addition to traditional at-rest and in-transit. … With asynchronous query loading, two unrelated queries can be run concurrently. … The Spring application preloader is no longer on by default, as faster computers have made it unnecessary.

Let’s hear from Rails creator David Heinemeier Hansson—AKA DHH:

Seven is … the culmination of years of progress on five different fronts at once. … The part that really excites me … is how much closer it brings us to the ideal of The One Person Framework. A toolkit so powerful that it allows a single individual to create modern applications upon which [to] build a competitive business.
…
It’s been well over twenty years for me now, and a big release like this still makes me giddy. … What a glorious time to be working in web development.

What a whatnow? Here’s bb_matt:

I don’t pretend … it’s a “glorious time to be working in web development,” except for one important aspect: … Experienced programmers coming over from software development and starting to make amends [with] strong typing, robust CI/CD, a focus on TDD, a focus on domain modeling.
…
99% is still total **** though—but then again, so is most software.

Home Working Ain’t Gone Away

A month ago, my long-suffering editor permitted me to write, “WTH? We Wanna WFH.” And survey after survey says tech workers work better at home. After the last 21 months, there’s simply no denying it.

Analysis: Genie out of bottle—no going back

If you’re under the misapprehension that DevOps is somehow “special” and your workers will be glad to return—think again. Find a way to make it work, or work will stop—and your business will die.

Steven J. Vaughan-Nichols: How to lure employees back to the office? You can’t. Not now. Not ever.

Months have gone by, and the great resignation keeps rolling along. … People don’t want to catch COVID-19 [but] bosses still think they can force skilled workers to return to offices. … That’s not going to happen.
…
The problem? Many executives and owners haven’t gotten the clue yet. [But] any doubts you may have about people not doing a good job unless you’re looking over their shoulders should have vanished by now. … The monthly academic WFH research.com survey has found almost six out of 10 workers reported being more productive working from home. … In the Dice State of Remote Work report … 53% of technologists listed greater productivity as one of the main benefits.
…
It’s simple: It works better for them and for your company. … Anyone who’s been paying attention … must agree. You can either go along with the flow, or you can fight it and first lose your staffers and then your company

So what do DevOps managers think? One of them is kozikow:

100% remote is not great either. … When there was a long period of 100% remote during Covid, there were some issues. … We developed a policy that Mondays are required, Wednesday are encouraged, rest is work from home. … It was shared decision of the team.
…
I think that most people who are strongly against hybrid work just have to live in a miserable place like SF. … It’s unfortunate that so many software companies are in the Bay Area.

But you couldn’t pay some people enough to go back—people such as this Anonymous Coward:

No way in hell they’d ever be willing to pay me … to come back into an office. … No having to go out in ****ed up weather, no fighting traffic and … dangerous drivers, plus I get all that commuting time back.
…
And I don’t have to put up with Linda cooking fish in the microwave.

Have I Been Pwned? There’s a 38% Higher Chance

This week saw a huge bump in the size of Troy Hunt’s already-massive database of stolen credentials. In case you’ve not seen it, HaveIBeenPwned.com is an amazing free service that lets apps securely check a user’s password isn’t already used elsewhere on a compromised site.

Analysis: Build the API into your auth flow ASAP

The UK’s equivalent to the FBI has donated a huge trove of credentials—after deduping, it’s added more than 225 million new passwords to the database. Frankly, if you still allow your users to rely on any of the 847 million passwords in HIBP, it would be negligent.

Simon Sharwood: National Crime Agency finds 225 million previously unexposed passwords

Troy Hunt, of Have I Been Pwned (HIBP) fame, yesterday announced … the NCA shared 585,570,857 [creds] with HIBP, and Hunt said 225,665,425 … he hasn’t seen before in the 613 million credentials HIBP already stored. [HIBP] lets anyone conduct a secure search of stolen passwords to check if their credentials have been exposed.
…
The NCA’s statement to Hunt did not reveal the source of the password trove [but said they] “were able to identify a huge amount of … passwords in a compromised cloud storage facility. … It became clear that these credentials were an accumulation of breached datasets known and unknown.”
…
[The] release brings the total Pwned Passwords count to 847,223,402, a 38 percent increase.

How’s this relevant to DevOps? Troy Hunt explains:

In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against … HIBP’s Pwned Password API. … There are all sorts of amazing Pwned Passwords use cases out there. For example … checking their customers’ passwords on every registration, login or password change to see if it’s previously been breached.
…
The UK’s National Crime Agency has done some wonderful work over the years to combat cybercrime. … Today’s release is about turning on the firehose of new passwords and making them immediately available to everyone for free. Having this open to the community, owned by the community and supported by the FBI and NCA is an enormously pleasing result.

Time for a metaphorical thought experiment. LenKagetsu obliges:

You were told by a reliable source that an unknown person … posted a high-res image of … your house key … on the internet. Would you change the locks?

The Moral of the Story: Never switch horses in midstream

You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

Image: David Emrich (via Unsplash)

December 21, 2021
Best of 2021 – Torvalds’ Bug Warning is a Lesson for Linux Users

As we close out 2021, we at DevOps.com wanted to highlight the most popular articles of the year. Following is the third in our series of the Best of 2021.

Linux does, occasionally, raise security concerns. While many users see it as the most secure, robust and versatile operating system available — that’s this writer’s opinion, as well — security precautions still have to be taken.

A recent, widely publicized case illustrated this point; Linux creator himself, Linus Torvalds, warned against the use of the Linux 5.12 release. He described a “nasty bug,” and wrote that the situation is a “mess,” due to the use of swap files when adding Linux updates. This nasty bug, in fact, had the potential to destroy entire root directories.

Some of the main takeaways following this “mess” include: tread very carefully when installing early Linux releases, especially those that involve swapping files instead of partitions, and especially, despite Linux’s well-known security advantages, avoid becoming complacent, because Linux security is not always foolproof.

Hence, while the “state of Linux security today is quite good, and has evolved in a positive way with more visibility and security features built, like many operating systems, you must install, configure and manage it with security in mind; that is how cybercriminals take advantage, [via] the human touch,” said Joseph Carson, chief security scientist and advisory CISO at Thycotic, a provider of privileged access management (PAM) solutions.

A Patch for Nastiness

As Torvalds noted a few weeks ago, “most people don’t use a swap file, but a separate swap partition and the bug in question really only happens when you have a regular file system, and put a file on as a swap.”

“The bad news is that the reason we support swap files in the first place is that they do end up having some flexibility advantages, and so some people do use them for that reason. If so, do not use [release candidate] RC1,” Torvalds wrote. “Thus, the renaming of the tag.”

After issuing the warning, Torvalds released a patch that he says prevents the bug from destroying swap file systems. However, it may have already been too late for early adopters of release 5.12. Ubuntu, a leading Linux distro, can swap files by default.

“It is nasty bug if you are still using swap files,” Carson said. “If you do still use swap files, then you could be impacted, resulting in potential data loss or a corrupted system.”

DevOps teams – or anyone else running Linux and installing patches, whether on multi-servers or on individual workstations – still need, of course, to follow strict best practices. “Like any operating system, security depends entirely on how you use, configure or manage the operating system,” Carson said. “Each new Linux update tries to improve security; however, to get the value, you must enable and configure it correctly.”

Linux Goodness

The fact that Torvalds was so forthcoming about the bug, as well as the level of transparency that the Linux kernel offers, also demonstrates one of the many reasons Linux remains popular. Given that the Linux kernel, in one variety or another, is used “not only in about 50% of the internet servers of the world, but also in a substantial part of all our smartphones, it is good to see this level of transparency at ‘root level,” said Dirk Schrader, global vice president, security research at New Net Technologies (NNT), which providers cybersecurity and compliance software.

“The security of Linux is based on its transparency; the ability to review the code of a distribution,” says Schrader. “Quite often forgotten is that transparency also involves talking about the mistakes, the errors, those nasty bugs.”

Citing National Institute of Standards and Technology (NIST) vulnerability database statistics, Schrader described how, compared to the Windows family of desktop and server operating systems, for example, the Linux kernel shows better results for overall vulnerabilities. The number of vulnerabilities have also declined over the past four years, while Microsoft’s operating systems do not display the same trend, according to NIST’s national vulnerability database.

Since Linux’s famous kernel is open source and transparent, it is possible to extrapolate that there are a greater number of potential vulnerability watchdogs compared to those monitoring vulnerabilities in closed systems. Some may argue that Microsoft has been, at times, less successful at detecting vulnerabilities and issuing much-needed patches.

However, Linux users still must remain vigilant.

“Still, for any of the Linux distributions, anyone using the early release candidates — RC1 in particular — should make sure that their own development or build process is undergoing change control, so that no mishaps will transfer the nasty bug into a production environment,” said Schrader.

December 21, 2021
Quali Adds Free Tier to DevOps Automation Platform

Quali has added a free tier of service to its Torque platform for automating infrastructure provisioning and application workload deployments.

In addition, the company has updated the software-as-a-service (SaaS) platform to provide blueprints through which it provides tighter integration with Terraform, an open source infrastructure-as-code (IaC) tool, along with support for custom tags to make it easier to generate reports and dashboards that provide greater visibility into infrastructure costs.

Quali CEO Lior Koriat said the free tier is intended to make the Torque platform more accessible to both small teams of DevOps professionals and individual users. It includes the ability to build environments on Amazon Web Services (AWS) or the Microsoft Azure cloud in addition to providing integration with a variety of DevOps tools and platforms and access to a sample blueprint library. Support for the free tier is provided via an existing community edition of the platform.

Koriat said Torque takes IaC a step further by also making it possible to automatically deploy complete application environments on top of infrastructure provisioned as code using blueprints rather than low-level Terraform scripts. The goal is to increase developer productivity by extending Terraform so that developers can spin up environments across multiple cloud computing platforms via self-service, he added.

That approach also sharply reduces the chances a cloud platform will be misconfigured, which Koriat noted is the bane of cloud security professionals’ existence. Most developers lack the cybersecurity expertise required to ensure cloud computing environments are configured properly. Simplifying the provisioning of infrastructure is especially critical when developers employ complex platforms such as Kubernetes, added Koriat.

At the same time, Quali’s Koriat said IT leaders want more visibility into how cloud resources are being consumed as the number of workloads deployed in these environments steadily increases. Developers tend not to remember to de-provision cloud resources when no longer needed, which Koriat noted conspires to increase cloud costs unnecessarily.

It’s not clear just yet how quickly DevOps teams might be moving away from relying on lower-level tools toward automation frameworks accessed via a SaaS platform. However, as application environments become more complex, it becomes even more challenging to provision and manage IT environments—especially since many DevOps teams are still working from home to help limit the spread of the COVID-19 pandemic.

One way or another, the amount of time and effort spent managing IT infrastructure needs to be reduced. After all, while application environments are increasing in both size and complexity the number of individuals that make up a DevOps team remains largely the same. The need to rely more on automation frameworks has reached a tipping point that is becoming increasingly obvious to all concerned.

As more organizations start to operate as software companies in the age of digital business transformation, it’s clear the way IT has been managed in the past is about to fundamentally change. The issue now is determining which automation framework lends itself best to enabling DevOps teams to achieve that goal.

December 20, 2021
How Log4j Becomes a Serious DevOps Problem
The recent discovery of the Apache Log4j vulnerability has wide-ranging implications for anyone who develops software, especially for those in the DevOps realm. What’s most troubling about the vulnerability (CVE-2021-44228) is how prevalent the use of Log4j is. The vulnerability is reported in a vast array of applications and directly impacts numerous Apache projects, including Druid, Dubbo, Flink, Flume, Hadoop, Kafka, Solr, Spark and Struts. There are also numerous Cisco programs impacted by the vulnerability. The list of impacted applications and libraries seems to be almost infinite, extending to Elastic LogStash, GrayLog2, Neo4J, Steam, Twitter and even the VMware Tanzu family of programs.

Simply put, any application that uses Log4J for logging and tracing is subject to the identified family of attacks known as Log4Shell. Those attacks prove easy to exploit and can be used to take control of vulnerable servers.

Why DevOps Practitioners Should be Concerned

The world of DevOps is all about reiteration, where features and improvements to applications are slipstreamed into production environments. To accelerate development, the QA process is usually limited to the most recent changes.

In other words, developers, via their pipelines, can often establish a baseline of quality and then speed up their CI/CD pipelines by testing only what has changed since the last iteration of the application. This process ensures an acceptable level of quality without introducing what are perceived to be unnecessary steps.

However, those processes do not take into account newly discovered flaws in older APIs and libraries, meaning that those flaws could telegraph into deployed applications and leave DevOps teams completely unaware of the impact and possible disruption. Detecting flaws after an application is deployed is like putting the cart in front of the horse.

Further complicating the situation is that many developers lack a well-defined and well-maintained software bill of materials (SBOM), which means developers may be unaware of the components and/or libraries being used in a deployed application.

Without an SBOM, it becomes increasingly difficult to remediate an issue with an application—especially if developers are unaware of the issue to begin with.

Where Should Responsibility Lie?

More often than not, vulnerabilities introduced into applications become a game of finger-pointing, where developers blame library suppliers or infosec staffers, and infosec blames developers for not performing due diligence on the components they are selecting to incorporate into their applications.

Of course, finger-pointing only adds to the angst and delays the process of remediation and does nothing to determine where the responsibility for detecting and remediating vulnerabilities lies. DevOps teams need to put these squabbles aside and establish a process that deals with unintentionally introduced vulnerabilities. What’s more, DevOps teams need to invest in DevSecOps to make sure that vulnerabilities are detected and remediated as quickly as possible.

To avoid the potentially massive disruption that a vulnerability like Log4Shell can cause, those running DevOps should consider:
- Creating and maintaining an SBOM
- Deploying automated tools that scan for discovered vulnerabilities
- Automatically comparing the SBOM against vulnerabilities
- Including DevSecOps processes within their CI/CD pipelines
- Frequently testing applications for flaws
- Coordinating with cybersecurity personnel when a flaw is discovered
- Patching frequently
With more and more vulnerabilities discovered on an almost daily basis, DevOps teams must be ever vigilant about what components are incorporated into their applications. What’s more, with the increased use of low-code/no-code tools and integrated development environments (IDEs), DevOps will also need to consider if those tools use other libraries that can become compromised.
December 20, 2021