Tag: APIs

  • MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB Inc. and Storj Labs announced today they have jointly created a backup service for the open source MongoDB database that leverages a global network for excess storage capacity.

    Storj Labs has created a Tardigrade Decentralized Cloud Storage Service based on an open source object storage system that is compatible with the S3 application programming interface (API) defined by Amazon Web Services (AWS). That object storage system distributes 80 slices of a file across a subset of thousands of nodes that each contain only a slice of the data required to reconstruct that file when needed. Only 29 of those slices are needed to reconstruct a file, which enables IT teams to secure data without having to manage encryption keys.

    Via a connector from Storj Labs, the Tardigrade Decentralized Cloud Storage Service now can be invoked via MongoDB DevOps Manager, which is made available in the commercially supported enterprise edition of the open source databases provided by MongoDB Inc.

    Storj Labs CEO Ben Golub said the Tardigrade Decentralized Cloud Storage Service provides a less expensive alternative to backup and recovery platforms based on the cloud, as excess capacity on devices ranging from servers to individual desktops is readily available, The challenge has been finding a way to marshal all that excess capacity in a way that makes it simple for IT organizations to consume, he said.

    IT organizations, Golub said, should expect Storj Labs to build additional connectors to databases and other platforms that require a less expensive approach to data protection. In the wake of the economic downturn brought on by the COVID-19 pandemic, he noted, more organizations than ever are open to innovative approaches to reducing storage costs.

    Of course, most IT teams are well-used to employing a range of data protection platforms to back up and recover data. The Tardigrade Decentralized Cloud Storage Service is likely to be viewed as one more option that might find traction at a time when the number and types of databases being deployed across the enterprise continue to expand rapidly. Developers are especially fond of adopting open source document databases that don’t require a database administrator (DBA) to get approval for a license from a central purchasing organization. It’s usually not too long, however, before developers look for help from central IT to manage all those databases, especially after an application is deployed in a production environment.

    Naturally, not all those applications are of equal value, so given the current economic climate, there might be a greater willingness to at the very least experiment with alternative approaches to data protection.

    Regardless of platform, however, the one thing that is clear is data protection alongside the rest of IT infrastructure is being driven more by APIs. As such, responsibility for data protection is also being pushed further left toward DevOps teams, who have the expertise required to continuously automate back up and recover using APIs. That might not always sit well with traditional IT administrators who have been using tools based on graphical user interfaces (GUIs) for decades. Nevertheless, IT times are clearly changing.

  • Hasura Launches Beta of GraphQL-Based Remote Joins Tool

    Hasura Launches Beta of GraphQL-Based Remote Joins Tool

    Hasura today announced the public beta of Remote Joins, which makes use of an open source GraphQL query language for application programming interfaces (API) to join disparate data sources residing in different repositories.

    Company CEO Tanmai Gopal said Remote Joins extends a GraphQL engine the company has developed around a project that is now hosted by the GraphQL Foundation, an arm of the Linux Foundation. The GraphQL Foundation counts among its members Airbnb, Amazon Web Services (AWS), Apollo, Coursera, Elementl, Facebook, GitHub, IBM, Intuit Hasura, Paypal, Prisma, Shopify and Twitter.

    Originally developed by Facebook, GraphQL has emerged as the basis for a more streamlined alternative to REST APIs. GraphQL provides a complete description of the data made available via an API and is organized in terms of types and fields rather than traditional endpoints. In addition to making it more clear what data is available via that API, developers can employ types to avoid writing manual parsing code.

    Hasura is now taking that concept a step further by enabling IT organizations to join data residing in different databases and microservices to enable that data to be queried as if it were a single data source. The core Hasura engine automatically generates the GraphQL engine, which enables those remote joins to be created in a few minutes.

    Gopal said joining data across a complex portfolio of modern applications based on microservices and legacy monolithic applications is becoming increasingly difficult as the number of microservices in an IT environment continues to proliferate. The Hasura engine addresses that issue by providing data access and flow tool base on a GraphQL type system for managing APIs that can be applied to GraphQL APIs as well as REST APIs or other protocols, he said.

    The join, authorization logic and consistency checks are all managed by the Hasura engine. Hasura also provides data change management, observability, auditing, security and performance management capabilities. That approach makes it possible for data sources and APIs to evolve independently while still allowing organizations to query data flexibly, noted Gopal.

    As DevOps and DataOps processes continue to converge, IT organizations will need to find a way to advance application and API development in a way that doesn’t result in data access becoming a major bottleneck. Too many DevOps teams are rapidly building applications and APIs only to find themselves waiting to be given access to data. GraphQL could provide a foundation on which IT teams can manage DevOps and DataOps processes more collaboratively.

    It’s not likely IT teams will be replacing existing REST APIs wholesale overnight. However, it’s also apparent that REST APIs may not enable IT environments to scale as efficiently as GraphQL, which is the primary reason why Facebook developed it. Of course, it’s still early days as far adoption of GraphQL is concerned. However, with more IT teams under pressure to innovate faster, interest in a more streamlined approach to building and managing APIs is likely to gain additional momentum.

  • Low-Code Development: The Future of Communications Experiences

    Low-Code Development: The Future of Communications Experiences

    The benefits of embedding real-time communications features into business and consumer applications are well-known. When it comes to customer service, most people would much rather click-to-call from within a web experience, social media site or business application to connect with another person, than find their phone to dial a number and wait in a queue. 

    In today’s new digital world–where instant gratification comes when consumers can choose their communication channel of choice and get their issues resolved more quickly–businesses only stand to benefit from delivering better service with fewer intermediaries. Customer service isn’t the only beneficiary of innovation in communications platform as a service (CPaaS)–web developers can add options to get answers automatically, or from an expert, without the presence of a full contact center. Even small businesses with limited staff can interact with customers through communications channels embedded into their websites or mobile apps, automatically directing questions about specific products, orders or services to the right person through text messaging, email or voice.

    This is all made possible through CPaaS–and this is where the future of customer communications experiences lies.

    Breakthroughs in CPaaS Are Powering Embedded Communications

    CPaaS is one of those industry acronyms that has been tossed around for a few years now, but what exactly is it? CPaaS is a cloud-based platform that enables developers to add real-time communications features to their own applications without the complexity of building infrastructure typically required when developing apps. 

    The ability to embed communications capabilities directly into apps or websites enables businesses of any size to engage customers more effectively across different communications channels, including mobile, web and desktop environments. The result is a much-improved customer experience leading to increased customer satisfaction, customer loyalty and recurring revenues.

    Breakthroughs in CPaaS are making it increasingly easier to embed voice, video, messaging, chat, presence and collaboration into experiences than ever before. Instead of building backend infrastructure and interfaces, CPaaS-based applications are made accessible through low-code development platforms. These platforms allow developers to access the robust application logic within the CPaaS with just a few lines of code, made possible through APIs. These APIs empower developers to quite literally copy and paste code by dragging and dropping application components and connecting them together to create a mobile or web app.

    As an industry, we’ve spent the better part of the last few years building out embedded real-time communications solutions. With low-code development, new communications capabilities take only minutes to create and launch, versus years, months, weeks or even days. By making it easier to add immersive communications solutions into existing applications, low-code development allows companies to introduce innovations such as communications-enabled business processes and automate any component of business processes.

    The Future of Communications Experiences

    There’s no doubt–the future is low-code solutions. In our digital world, with the right CPaaS technology, and a little creativity and planning, businesses can now accomplish things that would have been impossible without the support of APIs. 

    We are just at the beginning of even more exciting and valuable applications. By accessing the massive compute and software application capabilities of CPaaS through just a few APIs, harnessing the power of artificial intelligence and natural language processing is possible. Applications including voice recording, transcription and analytics for greater insights will be made a reality. Bots that sound like humans and can speak in multiple languages, with multiple choices for voices, will leave old breakthroughs like interactive voice response in the dust.

    We’re still early in the cycle, but the benefits and applications of low-code development continue to grow. Jump in–you may be surprised how easy it is to roll out new services that customers will love, and your business will thank you for.

  • Top iOS Security Gotchas

    Top iOS Security Gotchas

    Ensuring the security of user data within your app is critical to building trust in your business and contributing to the online safety of customers.

    Here’s a list of the top 10 essential security mechanisms that Apple offers to up the security posture of your iOS applications. Adopting these technologies and APIs within your products is an effective step toward writing more secure applications, giving you a lower risk of potential data compromise and increased confidence in your security posture.

    Opting Out of System Data Protection

    iOS provides the data protection setting, a robust way to automatically encrypt any files created by your app. This is an important security setting, however, it is turned off by default and many developers never enable it. Leveraging the system’s data protection mechanism is an easy win for increasing the security of user data within your app.

    Transmitting Data Over Insecure Connections

    It’s critical to ensure that any data-in-flight is transmitted over secure connections. By using encrypted HTTPS connections for all apps’ network activities, a wide variety of data-in-flight compromises are mitigated. Additionally, organizations are recommended to leverage SSL pinning for maximum transport-layer security.

    Deserialization Fails

    The default protocol to serialize and deserialize data on iOS, NSCoding, is vulnerable to object substitution attacks, which could potentially allow an attacker to gain remote code execution. Apple offers a near drop-in replacement, NSSecureCoding, which is not vulnerable to this attack. To convert a serialized class to use the NSSecureCoding mechanism, Apple has outlined steps in its documentation. Making the recommended changes allows the system to enforce safe deserialization.

    Opting Out of App Transport Security

    App Transport Security (ATS) is a mechanism provided by Apple to mediate all network connections made by the app and validate that data is being transmitted securely. Opting out of ATS by use of NSAllowArbitraryLoads, or similar exemptions, is an easy way to shoot yourself in the foot and turn off a powerful security mechanism.

    Cryptography API Misuse

    Encrypting user’s data is a no-brainer, but care must be taken to ensure that it’s done in a cryptographically secure way. Some system APIs, such as CommonCrypto, are easy to misuse. This results in the illusion of security, while still allowing an attack vector for user data to be compromised. Be sure to use these APIs with secure options, and never statically embed encryption keys or use an encryption key which is trivially derived.

    Leaking PII to NSUserDefaults

    When handling personally identifiable information (PII) within an app, it can be tempting to store it in a convenient and straightforward way, such as using an NSUserDefaults entry. However, this approach allows any other app on the device to read this potentially sensitive data. Sensitive data, especially identifiable user information, should always be stored in a secure location, such as the device’s keychain, and encrypted when necessary.

    Unsafe Keychain Usage

    While the keychain is the most secure store of data on the Apple device, developers must still take care to ensure they’re using it correctly. It’s possible for developers to save data to the keychain in such a way that the data is always unencrypted and accessible, even when the device is locked and data would otherwise be encrypted. When saving sensitive data to the keychain, ensure that you’re using the strongest possible data-protection settings to maximize security.

    Wherever possible, utilize “kSecAttrAccessibleWhenUnlocked,” the strongest protection class, when saving items in the keychain. This protection class tells the system that data should be encrypted when the user is not actively using your application. If your app needs to access this data while running in the background, you may need to fall back on the “kSecAttrAccessibleAfterFirstUnlock” protection class, which ensures the data is encrypted only until the user has unlocked the device after boot.

    Embedding Vulnerable SDKs

    When an SDK is linked into your application, you’re also implicitly exposing your app to any potential vulnerabilities in the SDK. Compromised SDKs have led to a variety of mobile app attacks, such as a vulnerable AFNetworking version leading to data compromised through a MitM attack. Without a security audit of the SDKs used within the app, developers are blind to the potential vulnerabilities they are introducing.

    Allowing Third Party Keyboards on Sensitive Input Fields

    While installing third party keyboards are useful for user customization, they introduce a new vector for data leakage. This is because the developer of a third party keyboard may be able to extract any information typed on the keyboard. As a result, it’s in the user’s best interest to disable these keyboards when handling sensitive data, such as identifiable information or credit card numbers.

    Leaking PII to Device Logs

    It’s all too easy to leave debug logging, which may include PII, in production builds. Before release, validate that any log statements which might include sensitive data are scrubbed from the code. This might be achieved by way of flags, which only enable these log statements in debug builds. Since logs may be visible to anyone with physical access to the device, it’s paramount to exclude sensitive data from them.

    Since adopting the newest technologies often introduces unforeseen risks, defensive security is a constant endeavor. However, following these top 10 tips will increase your organization’s security posture and reduce vulnerabilities introduced by iOS risks.

  • Defining the Database Requirements of Dynamic JAMstack Applications

    Defining the Database Requirements of Dynamic JAMstack Applications

    Zero-configuration hosting solutions such as Zeit Now and Netlify are taking the frontend community by storm due to their ease of use. If we add static site generators such as Gatsby/Next.js/Nuxt.js/Hugo/Jekyll to the mix and deploy our statically generated pages to a content delivery network (CDN), we get something highly desired with minimal effort: distributed auto-scaling applications with zero configuration.

    The usage of static site generators and CDNs became quite popular, so much so that Netlify decided to give it a name: JAMstack. At first, this might not strike you as something very newsworthy. Haven’t we all deployed static sites such as blogs or documentation on CDNs? What is different about this approach?

    To answer that, let’s first look at the definition that is typically used to explain JAMstack: The JAMstack is a static HTML site, rebuilt automatically every time you update the content, and deployed directly to a CDN.

    Of course, that still does not explain why this approach is different. The first time I read this definition, I wondered how I could ever build something more dynamic than a blog with such a stack. However, note that nothing in the previous description says that every element of our site has to be statically generated. In fact, the JAM acronym stands for JavaScript, APIs and Markup, where the letter A is the answer to dynamic content.

    The idea is to pregenerate markup where you can and then enrich these statically generated pages with dynamic content fetched from APIs. The APIs of choice in a JAMstack application are typically APIs from third-party services (SaaS platforms) or custom-built with Functions as a Service (FaaS). Both Netlify and Zeit have great zero-configuration FaaS offerings to write APIs for your JAMstack.
    In essence, developers in the JAMstack community are often looking for a specific set of requirements:

    • Zero configuration—easy setup, easy deploy, no server management.
    • Scaling—your application can handle sudden spikes of increased traffic without extra effort. 
    • Speed—low latencies and fast page loads (thanks to the distributed nature of CDNs).
    • Pay as you go—only start paying when your page actually serves customers.

    By combining easy-to-use hosting solutions, static site generators, CDNs and scalable APIs in one stack, we can relatively easily get these requirements.

    What If My Application Requires Highly Dynamic Data?

    Imagine that you are building a social network for professionals on which professionals can create profiles. Professionals create profiles to promote their skills, and companies search the network to hire professionals for specific projects. For such an application, you need to store, search, filter and paginate data.

    To build such an application, you need a database, but not just any database. Ideally, you want to avoid losing the zero-configuration, pay-as-you-go, scaling and speed benefits that a JAMstack application typically delivers. There are several features a database can possess that make it a perfect fit for a JAMstack application.

    In this article, we will describe these features and explain how each of them makes a database a better candidate for a JAMstack application. Since such applications often rely on serverless functions, many of these properties also apply for applications built with FaaS.

    Database Properties that Work Well with JAMstack and FaaS Applications

    Multi-Region, Globally Replicated

    To understand why multi-region distribution is desirable, let’s revisit why static websites on CDNs are incredibly fast. A CDN is fast to deliver your content because it contains copies of your content at different locations. When content is requested from the CDN from a specific location, it will attempt to deliver that content from the closest location to the requestor. In order to get an idea of how much that matters, take a glance at the Zeit CDN status page which shows you the difference in latency between your current location and other locations. By deploying our applications to a CDN, our pages automatically load from the closest location to the user, which results in low loading latencies. And low latencies result in a great user experience.

    In order to keep this user experience, the dynamic data that will be loaded from our APIs has to exhibit low latencies as well, and the best way to achieve this is to use a distributed database. Databases that feature multi-region replicas such as FaunaDB, Google Spanner or Amazon Aurora not only provide the dynamic querying that you need, but also deliver your data from the closest location, just like a CDN.

    Connectionless

    Many traditional databases are not connectionless, which means that they require persistent connections with the process that queries the database. There is often a limit on the number of connections that a database can handle, and setting up a connection takes time and puts more strain on the database. A database that supports a JAMstack application will either be called from the frontend (if it’s possible to do securely) or from serverless functions. An increase in the number of users increases the number of running functions or frontend calls.

    Having a limit on connections and/or creating/destroying many connections then quickly becomes a problem. An ideal JAMstack database behaves like an API; it does not require connections. There is an excellent article on this topic that describes the connection problem from a FaaS perspective.

    Flexible Security

    Providing security out-of-the-box takes away tedious configuration from developers. If this security layer can also provide a means to securely access the database from the frontend, we can potentially write our application backendless, eliminating an extra hop and reducing the low latency we’ve gained from distribution even more. When a database is connectionless and can be accessed securely from the front-end, we consider it to be frontend-friendly. However, security requirements can be complex. If we completely rely on the database security layer, it has to be flexible enough to express custom rules. Firebase Cloud Firestore, FaunaDB and the upcoming Userbase offer direct access via clients, like browsers.

    Scaling and Pay-as-You-Go

    Before we add a database, our typical JAMstack application is completely auto-scaling and pay-as-you-g(r)o(w), which is considered an advantage for many startups. We only pay for the CDN bandwidth and function calls that our application actually uses. If our database is also pay-as-you-go and scales automatically, we do not lose this advantage.

    Strong Consistency

    Strong consistency is quite a technical matter, so we’ll explain it briefly, and for the technical details, this article is a great resource. Strong consistency is important in distributed databases when your application stores and updates data. In that case, there are two requirements to preserve a great developer experience:

    • You never lose data: When a write or update is acknowledged, it can no longer be dropped.
    • Data updates are predictable: When you save or update data, a consequent read will reflect these changes. 

    Strong consistency (or strict serializability) is the opposite of eventual consistency. By adopting a database that does what you expect it to do, you can focus entirely on your application. Only a few distributed databases provide strong consistency without limitations.

    Conclusion

    JAMstack applications are not limited to pages that are entirely static; they can be partly static and partly dynamic by retrieving data from APIs. A distributed database can be one of these APIs and is essential in case your application contains dynamic pages with filtered or paginated data. Ideally, such database fulfills the six described requirements so that we can build dynamic JAMstack applications without losing speed, scalability, pay as you go or the zero-configuration approach that we love.

    In case you wonder how a partly static, partly dynamic JAMstack can be created in an elegant way with modern frontend frameworks, take a look at hydration, which might be the topic of a forthcoming article.

    — Brecht De Rooms

  • DevOps Deeper Dive: Mainframe Fallout from BMC’s Compuware Buy

    DevOps Deeper Dive: Mainframe Fallout from BMC’s Compuware Buy

    The acquisition of Compuware this week by rival BMC Software signals that the rate at which mainframe environments are being modernized might not be occurring fast enough to support a vibrant third-party tools provider ecosystem.

    Both BMC and Compuware were sold to private equity firms in 2018 and 2014, respectively. Thoma Bravo, which acquired Compuware, is now selling the company to KKR. BMC was acquired by KKR in 2018 from Bain Capital and Golden Gate Capital for $8.5 billion. BMC was originally taken private by investors in 2013.

    Other rivals in the mainframe category include CA Technologies, which was acquired for $18.9 billion by Broadcom last year, and Micro Focus, which includes software assets originally developed by Hewlett Packard Enterprise.

    BMC executives declined to comment on the merger and terms of the deal for Compuware were not disclosed.

    All these machinations by private equity investors doesn’t do much to inspire confidence among end customers, said Judith Hurwitz, president and CEO of Judith Hurwitz & Associates, a market research and IT consulting firm.

    “Private equity firms always have to eventually look for an exit,” she said. “In this case, one investor wanted out.”

    That leaves IT leaders in the unenviable position of not knowing whether the application development platform on which they have standardized might be around for the long haul, said Hurwitz.

    The challenge faced by third-party providers of application development tools in the mainframe space is largely two-fold. While the number of workloads running on mainframes continues to increase thanks mainly to availability of Linux on the platform, the number of organizations that have a mainframe has declined. The low end of the mainframe market has been eroded by high-end distributed systems. In addition, many applications that previously ran on a mainframe have been shifted into a public cloud.

    The second challenge these providers face is IBM, which is now a much more formidable competitor in the mainframe tooling sector. IBM has launched a series of initiatives to provide tools to modernize mainframe platforms using best DevOps practices as part of a larger digital business transformation initiative. However, regardless of the relative strengths of IBM’s DevOps portfolio, there will always be a significant base of mainframe shops that will prefer tools from IBM over those provided by a third-party rival.

    In a prepared statement shared via email, Barry Baker, vice president of IBM Z Software, said:

    Over the last 18 months, we’ve come a long way to expand the ecosystem for mainframe skills by bringing new tools to IBM Z and LinuxONE. Our goal remains unchanged – to make development on Z a common experience for all developers across the tech stack – not just mainframe developers. We’ve made significant progress toward this goal with the adoption of DevOps and industry-standard tools like Git and Jenkins on the platform, along with our own offerings including IBM Z Open Development and IBM Z Unit Testing. We took another step with Red Hat OpenShift on IBM Z, further enabling cloud developers to deploy z/OS applications using OpenShift without any special Z skills required.

    We continue to invest and over the next few months we’ll be unveiling even more tools across three focus areas: developer experience, automation and operations to truly deliver on our promise for a cloud native experience – and encourage our clients to watch this space.”

    Of course, all of IBM’s tooling rivals in the mainframe space have launched similar DevOps initiatives. The challenge they all face is the rate at which mainframe organizations are embracing DevOps may not be fast enough to sustain a vibrant third-party ecosystem. Not surprisingly, BMC has also been extending its reach to encompass distributed computing platforms. Competition among tooling vendors on those platforms is already fierce.

    There can be no doubt mainframes will continue to play a crucial role in IT. Most large enterprises are still dependent on mainframes to run some of their most mission-critical transaction processing applications. Less clear is to what degree those organizations intend to modernize those applications beyond simply making application programming interfaces (APIs) available for legacy applications. IBM, along with every provider of development tools for the mainframe, has been making a case of deploying new applications running on Linux on a mainframe because the total cost is lower than trying to connect those applications running on a distributed system to a legacy mainframe application.

    A recent global survey conducted by Vanson Bourne on behalf of Micro Focus suggests that argument is starting to resonate. Nearly two-thirds (63%) said some form of modernization was favored over the replacing and retiring of older COBOL-based systems in 2020.

    Regardless of how much economic sense that argument makes, however, the rate at which mainframe applications are being modernized will, at best, continue to be an extended process.

    — Mike Vizard

  • Tenable Allies With Datadog to Drive DevSecOps

    Tenable Allies With Datadog to Drive DevSecOps

    Datadog and Tenable have teamed up to enable organizations to adopt best DevSecOps processes.

    Tenable CTO Renaud Deraison said his company is making the cybersecurity data it gathers via its Nessus vulnerability scanning software available to the monitoring and analytics service provided by Datadog. The goal is to make it easier for DevOps teams to discover and address cybersecurity issues before an application is deployed in a production environment, he said.

    Tenable has more than 30,000 customers, according to the company. Obviously, not all of them have embraced DevOps. However, unless DevOps teams can find a way to incorporate cybersecurity data, it won’t be practical for organizations to define a set of best DevSecOps practices. Even with that data available, Deraison said he expects it may be as long as five years before DevSecOps becomes broadly adopted. Many organizations are going to find a way to make cybersecurity teams part of the application development process. The challenge, of course, is finding a way to achieve that goal without unduly slowing down the application development process. In fact, Deraison said that despite all the hype surrounding DevSecOps at the moment, there still isn’t enough focus on actual workflows.

    Less clear is whether security will become a distinct functional test within a DevOps process or simply be incorporated into an existing quality assurance process. Deraison noted that cybersecurity and quality assurance are really two sides of the same coin.

    In the meantime, Tenable doesn’t have any plans to integrate with any other monitoring tool. The company chose to ally with Datadog because it makes available a set of application programming interfaces (APIs) that are well-defined, he said.

    DevOps teams going forward should expect to see a raft of integrations between providers of cybersecurity tools and various monitoring platforms. That data needs to be made available both when an application is being developed as well as after it has been deployed in a production environment to help developers prioritize bug fixes. Not all vulnerabilities are equal in severity, so it becomes important for DevOps teams to understand which are critical flaws that need to be addressed immediately versus something that can be addressed later in the application development cycle.

    Naturally, the biggest challenge most organizations will face as they move to embrace DevSecOps is melding two very distinct cultures. In some cases, it may prove easier to teach developers the fundamentals of cybersecurity than it will be to teach cybersecurity how to participate in, for example, a sprint. There may not even be enough cybersecurity professionals available to participate in the application development process, given the current chronic shortage of staff. There are already millions of unfilled cybersecurity jobs.

    Precisely what role artificial intelligence (AI) might play in accelerating adoption of DevSecOps has yet to be determined. However, given the chronic shortage of cybersecurity expertise, it’s apparent more organizations are going to have to rely on AI frameworks embedded in monitoring platforms to analyze massive amounts of data in a way that surfaces actionable insights before applications can truly become more secure.

    — Mike Vizard

  • Red Hat Extends Runtimes Middleware Portfolio

    Red Hat Extends Runtimes Middleware Portfolio

    Red Hat has made available the latest instance of Red Hat Runtimes, a suite of lightweight open source components and frameworks that makes it easier to discover the middleware most appropriate for building a specific type of application.

    James Falkner, product marketing director for Runtimes at Red Hat, said as organizations embrace cloud-native application architectures based on microservices it’s become increasingly challenging to determine what middleware to deploy optimally and where. Red Hat Runtimes not only makes it easier to navigate all those options, Falkner said, but all the components and frameworks are certified to be pre-integrated.

    The latest version of Red Hat Runtimes adds support for Open Liberty, a lightweight runtime for building Java applications developed by IBM. Red Hat was acquired last year by IBM.

    The latest installment of Red Hat Runtimes also provides access to what has become a standard distribution of Node.js based on Red Hat Software Collections that will be implemented across all Red Hat offerings.

    Finally, Red Hat has also added support for Red Hat Single Sign-On, an access control framework based on the Keycloak project.

    Falkner said Red Hat Runtimes also serves to reduce the total cost by providing a single subscription through which organizations can access everything from container runtimes to the 3Scale application programming interface (API) management middleware, which Red Hat acquired in 2016.

    Very few IT organizations these days are standardized on a single class of middleware, especially as they embrace microservices-based applications built using containers. Most IT teams for the foreseeable future will need a flexible way to access multiple runtimes in support of everything from monolithic applications based on Java to applications built using Node.js code deployed using Docker containers.

    Rather than a piecemeal approach to the middleware infrastructure required to build, deploy and integrate all those applications, Falkner said Red Hat Runtimes provides a more holistic approach.

    It’s not clear how much or even whether IT organizations are centrally managing middleware in the age of DevOps and the cloud. Historically, many IT organizations preferred to standardize on a single application server platform to deploy various classes of middleware. However, many developers today are deciding what middleware to include within their application stacks without much input from a central IT function.

    Via Red Hat Runtimes, Red Hat is trying to make a case for providing developers with the flexibility they cherish in the form of a subscription service that provides IT teams with a modicum of control over what middleware gets employed.

    Tensions between DevOps teams and central IT organizations have arguably never been higher. In fact, many DevOps teams are operating within lines of business that are outside the direct control of centralized IT. As such, the level of standardization that can be imposed by central IT organizations has become more constrained. Many centralized IT organizations are now trying to influence middleware platform decisions rather than outright make decrees that might get ignored anyway.

    Regardless of the middleware platform choice that ultimately gets made, however, the one thing that most centralized IT teams will have to come to terms with is finding a way to support it.

    — Mike Vizard

  • Survey Sees More Complex API Challenges Ahead

    Survey Sees More Complex API Challenges Ahead

    A survey of more than 10,000 developers of application programming interfaces (APIs) suggests there’s lots of room for improving the overall efficiency of API lifecycle management.

    The survey was conducted by Postman, a provider of a platform for building APIs. Respondents on average said they only spend a quarter of their time (26%) on the development of APIs. The rest of the time is consumed by debugging and manual testing (22%), automated testing (11%), designing and mocking APIs (11%), managing others (9%), documentation (7%), monitoring (6%) and publishing (4%). A full 70% said they are spending more time on manual testing and debugging than they thought they should.

    All that time spent on manual testing and debugging may be having an adverse impact on the number of APIs that can be built, tested and deployed at a time when a transition to microservices-based architectures is requiring organizations to build and support more than ever.

    According to the survey results, about a quarter of respondents (24%) work with more than 20 APIs. Well over half those employed on average (53%) are for internal use, compared to 28% employed specifically for integration and 19% that are made public.

    In terms of technologies survey respondents are most excited about for the coming year, microservices (54%), containers (46%) and serverless computing frameworks (44%) top the list.

    As far as the performance is concerned, survey respondents are evenly split. Just under half (48%) said they feel that their APIs do not break, stop working or materially change specification often enough to matter. However, 28% said these issues arise on a monthly basis, while 16% said they deal with these issues weekly. Another 3% said it was a daily challenge.

    In terms of security, survey respondents are relatively confident: Nearly three-quarters of respondents (73%) said they feel that their APIs are “very secure” or have “above-average security.” Only 2% said they felt they were not at all secure.

    It’s hard to say how secure any API is without testing it. Rebecca Johnston-Gilbert, a marketing manager for Postman, said it’s apparent more organizations are starting to address security at the design phase rather than after the API has been built and deployed. Many organizations have already adopted an API-first approach to application development that enables them to manage them in isolation from the applications they are designed to support, she said.

    Among other survey findings, 73% of survey respondents said they work on a team of 10 members or less, while a quarter (26%) work on teams with 22 to 50 members. In addition, 78% of respondents have five or fewer years of experience in developing APIs.

    In general, survey respondents said they would like to see improvements in the areas of documentation (64%), standardization (59%) and sample code (58%), which suggests consuming APIs is still not all that simple.

    There is no doubt organizations increasingly will be applying best DevOps practices to the building and maintaining APIs. The challenge organizations face is, not only do they need to build and maintain what could soon be hundreds (if not thousands) of APIs to support microservices but also those APIs will need to be a lot more resilient as the dependencies between microservices exponentially increase.

    — Mike Vizard

  • Challenges of Designing API-Driven Experiences

    Challenges of Designing API-Driven Experiences

    As SaaS and mobile application development–and cross-software integration and communication–continue to become increasingly important for organizations across all industries to remain competitive today, APIs play a critical role. In fact, APIs dominate digital experiences today, with an average of 220 new APIs published every month, representing a 30% increase over the previous four years.

    As more organizations shift to an API-first development strategy to further drive innovation, partnerships and rich end user experiences, the proliferation of demand and consumption of APIs can bring its own challenges, if not properly executed from the get-go. Amidst the ever-increasing rush to develop and publish an API to remain competitive, we see several common issues arise–and often only after the API is rolled out–that negatively impact integrations, future partnership opportunities and end user experiences. Read on for a look at these common challenges and how to address them before you hit publish on your next API.

    Infrastructure Costs

    One of the biggest challenges when it comes to API design is the ability to manage costs, in particular infrastructure costs. From managing multiple gateway servers and instances, to building an entire API management program from the ground up, we see many common infrastructure approaches that organizations deploy today when designing APIs that lead to unnecessary and often unwieldy expenses.

    Critical to avoiding spiraling infrastructure costs is leveraging a single gateway to deploy, govern, secure and deliver global API traffic across various data centers. By using this approach, organizations can reduce man-hours spent managing and synchronizing servers; increase reliability by eliminating the need to manage multiple gateway instances; govern APIs without needing to build and maintain a separate API management platform; and eliminate regional gateway replication.

    By considering an API gateway at the onset of a design project to ensure API centric operations (such as authentication, authorization and throttling) are happening at the edge, organizations can proactively control costs and avoid financial surprises.

    Scale

    To a developer, there’s nothing worse than having a wildly successful API that can’t scale to meet the demand.

    Addressing scalability early on in the process can help define both early adoption, future success and the lifespan of the API. However, organizations commonly overlook the need to manage scalability in several ways–including planning for surges in API traffic and managing the volume of API requests consumers can make–which can lead to damaged user experience.

    Developers should look to a combination of load testing, authentication, throttling, quota management and API caching at the edge to improve and predict traffic, while preventing infrastructure from being overwhelmed by requests to ensure availability and reliability for consumers. Building in load testing early on can help a developer determine the traffic volume the application can withstand when surges in requests occur.

    Quota management can help enforce business service level agreements and limit the number of API requests that a partner is allowed to make. When it comes to API caching, some good places to start include: any resource accessible via HTTP GET, static data, immutable responses, infrequently altered or predictable responses and frequently requested data.

    Security

    While the commercial value of API development is clear, the reality is APIs can come with great cybersecurity risk. For one, APIs can provide a glimpse into the back-end of an application implementation and even the database it is connected to, providing hackers with new avenues for attacks. As the communication bridge between multiple applications, APIs left unprotected can also increase an organization’s attack surface and expose it to downtime and malicious attacks, including unintended misuse by legitimate users.

    Critical to protecting APIs is incorporating security at the infrastructure level with a multi-pronged approach that includes leveraging an API gateway to easily validate, authorize and control the access of legitimate API consumers (and block legitimate users), and endpoint protection against malicious traffic. Additionally, rate limiting–which puts caps on the number of requests per minute or second that API consumers can make–can prevent adversaries from overloading origin in an attempt to bring down API infrastructure in the form of a DDoS attack.

    Organizational Decentralization

    As speed and agility increase exponentially and API development evolves from microservices to nanoservices with individual team members owning what feels like ever-shrinking components, it’s easy to see how teams can organizationally splinter. While autonomy is important to making the development process flow quickly, decentralization is creating major governance and communication issues within many organizations today.

    This lack of governance creates its own challenges related to configuration visibility, changes and duplications across implementations which could lead to wasted resources, data leakage and more. Organizations should consider a single gateway that can expose APIs across multiple, distinct implementations but also provide suitable isolation so as to not affect the performance of other APIs when requests occur, while also providing separate control pages and the ability to set up distinct authorization and access rules for each API. The idea is the APIs are managed in the same decentralized way that is required to meet speed and agility requirements under a centralized infrastructure and governance policies.

    Strategic API design is not a simple task, but it is absolutely critical to organizations that desire long-term API success. By seeking cost-effective infrastructure, tapping tools to ensure scalability, building security protocols, practices and policies, and taking steps to more centrally manage the API design process early on will ensure longevity for the API, driving strong partnerships and, ultimately, providing better user experiences.

     

    This article was co-authored by Anthony Larkin, director of product marketing at Akamai. Anthony leads the go-to-market strategy for Akamai’s performance product portfolio. For more than 11 years at Akamai he has been dedicated to helping businesses remove barriers and unlock their potential to better engage users through web and mobile applications.

    — Sid Phadkar