Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Bluesky—Twitter’s research spinout—opens its ADX algorithm, Irish data center electricity worries grow, and Apple employees are the latest to rise up against hybrid working. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Everyone has Twitter advice for Elon, passwordless vision is vacuous, and Apple prevented from forcing Safari. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Why Apple services were down, Linux gets a huge RNG overhaul, and we wonder if Okta was hacked again. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: ByteDance restricts TikTok in Russia, Unified Patents escalates the fight against trolls, and Google Chrome beats the magic 300.
First up this week: Russian TikTok users won’t be able to view or upload new content. For users in Russia, TikTok has frozen its catalog of cringe.
Putin’s vague new “fake news” law is concentrating minds in Beijing’s ByteDance. Is your organization exposed too? To protect its employees—and perhaps its users, too—it’s hitting the Safe Mode button.
Dan Milmo: TikTok restricts service in Russia
Chinese-owned TikTok said it would block livestreaming and uploading of new content in Russia after the Kremlin criminalised the spreading of what it deems to be fake news about its invasion of Ukraine. … The BBC, CNN and other global media outlets have temporarily suspended reporting in Russia to protect their journalists.
…
TikTok spokesperson Hilary McQuaide said the app in Russia now appears in “view-only” mode and won’t let people post or see new videos or livestreams. They can still see older videos, but not if they came from outside the country.
…
She said, “The safety of employees is our top priority,” … adding that the video-sharing service—part of China-based tech company ByteDance—did not want to put either its Russian employees or users at risk of severe criminal penalties.
With more on that head-scratching law, here’s Aimee Chanthadavong:
Russian President Vladimir Putin signed a new law on Friday that bans what the country calls “fake” news about the military. This law will target any statements referring to the invasion of Ukraine as an “invasion”, any attempt to discredit the armed forces, or calls for sanctions on Russia. Those found to be spreading so-called fake news could face up to 15 years in prison.
…
TikTok’s in-app messaging service will not be affected. … “We will continue to evaluate the evolving circumstances in Russia to determine when we might fully resume our services with safety as our top priority,” TikTok added.
And Scott Nover thinks about the effects on Russian citizens:
Russia’s fake news law is a severe step for a country whose government is already antagonistic to … a free press. … The country has blocked Facebook, Twitter, and YouTube proactively, but TikTok beat Russia to the punch. The result is the same, however: The people of Russia … will be locked out from another window into the real-life consequences of Putin’s war.
“Patent assertion entities,” also known as “non-practicing entities,” are organizations that don’t produce anything, but simply acquire and hoard patents—later asserting them against unsuspecting organizations. The aim is to extort money from those they claim are infringing.
The problem? Many of those patent claims are as weak as a sickly kitten.
You might think you’re safe, but trolls also go after the users of the disputed technology. Examples include podcasting, JPEG images, order-confirmation emails, geo-locating a car and even caching data.
Steven Vaughan-Nichols: Open Source Zone grinds away at patent trolls
Patent trolls, aka Patent Assertion Entities (PAEs), have plagued … software for ages. … The attacks keep mounting up. The reason is simple: It’s profitable.
…
[But] Unified Patents, an international organization of over 200 businesses … brings the fight to the trolls. It deters patent trolls from attacking its members by making it too expensive for the troll to win. … With United Patents’ high success rate in knocking out bad patents, slowly but surely the patent trolls are being driven back.
…
For example, an Accelerated Memory Tech patent 6,513,062, was used by the troll IP Investments Group to claim … Redis, which manages cache resources on the cloud, violated the patent. [The troll] went after Hulu, Citrix Systems, Barracuda Networks, Kemp Technologies, and F5 Networks for their use of Redis software. IP Investments Group gave up rather than fighting it out. Everyone who uses Redis wins.
Ban software patents? Beware of throwing out the baby with that bathwater, thinks WierdUncle:
Patents themselves are a good idea: … Inventive people should be rewarded for their contributions to the economy.
…
[But] patent trolls are parasites who contribute nothing to the prosperity of citizens. … The patent troll business plan is unfortunately quite viable. You don’t invent anything, or fund new developments. You have sufficient funds to clobber anybody who challenges you, by having better lawyers.
The underlying issue is weak patents. Here’s nzkbuk:
Start suing the patent office for damages against wrongly issued patients. It would then be in their best interest to set up this sort of thing as an alternative where the patient can be investigated first.
Google Chrome on macOS boasts a better benchmark score than Safari on an M1 MacBook Pro. Hilariously, this is using Apple’s own Speedometer benchmark tool.
Great PR, and popcorn-worthy Cupertino trolling. But aren’t there better optimizations Google could be making?
Frederic Lardinois: Chrome on macOS is now faster than Safari
Version 99 of Chrome on macOS manages to score 300 points on the Speedometer benchmark, which was originally developed by Apple’s WebKit team. This, Google points out, is the fastest performance of any browser.
…
It’s been a while since competition in the browser market focused on speed. … When a new chip comes along, though, there’s always room for optimization. Originally, Chrome on Apple’s M1 chips had passable performance, but … Chrome now runs 43% faster on them.
…
Speedometer 2.0 tests for responsiveness, which makes it a good proxy for user experience. … It doesn’t take much to make software feel more responsive, so the 43% on M1 Macs will surely make you feel more productive.
How? Try not to gloat, Max Christoff:
Building on many performance changes over the last year, we enabled ThinLTO in M99, a build optimization technique that inlines speed-critical parts of the code base, even when they span multiple files or libraries. … Two of the other recent major contributors to Chrome’s speed are the V8 Sparkplug compiler and short builtin calls. Sparkplug is a new mid-tier JavaScript compiler. … Short builtin calls are used by the V8 JavaScript engine to optimize the placement of generated code inside the device’s memory [which] boosts performance by avoiding indirect jumps when calling functions.
…
We know that benchmarks are just one of many ways of measuring the speed of a browser. [But] combined with recent graphics optimizations (namely, pass-through decoder and out-of-process rasterization) … Chrome is now 43% faster than … 17 months ago.
Benchmarks/schmenchmarks, thinks codedokode:
Browser developers are optimizing the wrong thing. … Optimizing for speed usually causes increased memory consumption, and this increases the chance of invoking swapping. If the system starts swapping, it becomes orders of magnitude slower.
…
If the browser could use [half the] memory while using twice amount of CPU time, that would be perfect. Just think how many laptops with 2 or 4 GB of RAM would become usable again.
You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.
Image: Rostislav Artov (via Unsplash; leveled and cropped)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: iMessage lock-in lessons, attrition-rate fixes, and more on Mozilla.
First up this week: The weekend story getting the technorati chattering was about how Apple iMessage denizens pour scorn on Android users—identifying them by their “icky” green chat bubbles. An iPhone user’s message gets a “proper” blue background, y’see.
Amusing though the story was, the writer seemed to be hell-bent on proving some sort of Apple C-suite-led “conspiracy to lock in.” The reality is far more mundane—but it teaches important lessons for DevOps.
Could your DevOps team make a trivial engineering decision that pays unexpected dividends? While lock-in might be distasteful, seemingly irrelevant design or technical choices can have huge ramifications with users.
Tim Higgins: Why Apple’s iMessage Is Winning
[The] pressure to be a part of the blue text group is the product of decisions by Apple executives starting years ago that have … helped to cement the iPhone’s dominance among young smartphone users. [It] encourages people to pay the premium … and remain loyal to its brand.
…
Teens and college students said they dread the ostracism that comes with a green text. The social pressure is palpable. … Jeremy Cangiano, who just finished up his MBA, … tried to cash in on it last year by selling his own merchandise that touted, “Never Date a Green Texter.”
…
The blue iMessage bubble was born out of a simple engineering need, according to Justin Santamaria, a former Apple engineer who worked on the original feature. … The idea that it would keep users locked in to using Apple devices wasn’t even part of the conversation at the time, he said.
And then the other shoe dropped—via Ron Amadeo:
Google took to Twitter this weekend to complain that iMessage is just too darn influential with today’s kids. … The company is hoping this public-shaming campaign will get Apple to change its mind. [But it] probably has the least credibility of any tech company [because it] has released 13 half-hearted messaging products since iMessage launched in 2011.
…
Google … seems to have learned nothing from its years of messaging failure. Today … the situation is an incredible mess, and no single Google product is as good as Hangouts was in 2015.
Ouch. With a sociological perspective, here’s Christina “filmgirlcw” Warren:
iMessage is incredibly popular with certain demographics. … It’s an in-group signifier—the way teens have always had in-group signifiers (when I was in high school, it was AIM, a Nokia, and wearing Abercrombie). … It’s always fascinating for me to go to other countries and see a ton of iPhone users not using iMessage but something else because that app has become the in-group signifier. … Every teen I know uses Discord more than they use almost anything else.
…
It isn’t about lock-in or regulation or technology. It’s about fashion.
A study published this week says DevOps orgs and other internet companies rank third for attrition in the 38 industries surveyed. And if you lump that category together with “enterprise software,” it would be in clear first place.
But some companies get this right—how can you be one of them? Culture, innovation, recognition and remote work. It’s definitely not only about pay.
Donald Sull, Charles Sull and Ben Zweig report their fascinating study: Toxic Culture Is Driving the Great Resignation
Between April and September 2021, more than 24 million American employees left their jobs. [But] while resignation rates are high on average, they are not uniform … from less than 2% to more than 30%. … More-innovative companies … are experiencing higher attrition rates than their more staid competitors.
…
Pay has only a moderate impact on employee turnover. … A toxic corporate culture is by far the strongest predictor of … attrition and is 10 times more important than compensation. … Job insecurity and reorganizations are important predictors of how employees rate a company’s overall culture. … But it is surprising that … the more positively employees talked about innovation at their company, the more likely they were to quit. … Employees are more likely to leave companies that fail to distinguish between high performers and laggards [or] that tolerate underperformance.
…
Our analysis identified … actions that managers can take … to reduce attrition. … Lateral career opportunities are 12 times more predictive of employee retention than promotions [and] 2.5 times more powerful [than] compensation. … Company-organized social events, including happy hours, team-building excursions [and] potluck dinners … are a key element of a healthy corporate culture. … Unsurprisingly, when employees discussed remote work options in more positive terms, they were less likely to quit.
And the flipside of resignation? Hiring replacements. Let’s turn to the equilibrium of Nash Reilly:
It’s only gotten harder in recent months [and] I think I know why. … You need to offer engineers some combination of these three things to pique their interest: Cool stuff to work on, smart people to work with [and] some degree of repeatability.
…
You can’t really prove to an engineer that you can give them things like good management, minimal churn, and decision making authority [so] let them talk to your employees. … Also, figure out a way to let your team “backchannel” to the candidate. [If] your product is not that cool … play up the things you can offer them: smart coworkers, and a stable working environment. … You can afford to be honest about what it is that you do offer to a candidate, [so] pitch them the truth: that you want to do good work, sustainably, for as long as you can—ideally with them on your team.
Perhaps the smart money is already skating to where the puck will be? Here’s echelon:
Engineering salaries are … one of the biggest expenses. … Companies love that they can now hire remotely and pay adjusted cost of living. They’ll hire as many workers in middle America as they can, and once enough of the workforce is concentrated outside of expensive cities, you’ll see them stop hiring in SF and NY entirely. [And] startup capital is already beginning to shift to … emerging markets. Employment will eventually head there too.
…
Make your money now while the iron is still hot.
After accusing Mozilla of jumping the shark last week, perhaps I owe the Firefox folks a positive inclusion this time? The release notes for Firefox 96 certainly sound good.
Outside the Apple walled garden, Firefox is about the only non-Chromium browser. A browser monoculture can’t be a good thing for anyone—not DevOps nor users.
Michael Gariffo: Firefox 96 update focuses on noise improvements, main thread efficiency
On the desktop side of things, Mozilla’s latest release made “significant improvements” to the browser’s built-in [sound] noise suppression and auto-gain-control features. These improvements are aimed at web-based video chat users.
…
The second tentpole feature in version 96 focuses on reducing main-thread load, which should help the browser function better on older, slower, or congested systems. [And] a new enforcement setting for cookies … will, by default, apply the “Same-Site=lax” policy. Mozilla claims this will help better defend users against Cross-Site Request Forgery (CSRF) attacks.
…
Mozilla also acknowledged that it is working on correcting the performance of detached videos being played in full screen on macOS devices. … No timeframe was mentioned for when it might be available again.
Okay. Sounds good. But not to Tetch:
Never mind all that fancy stuff. … Any reduction in crashes?
…
FF crashes for me several times a month. … I always take the trouble to fill in the “What were you doing immediately before the crash?” section of the crash submission dialog, and never hear another thing.
But more efficiency on the main thread? Tell me more. ksec:
Such an important detail that deserves at least few more sentences of marketing message or explanation. But the whole release note just feels like they couldn’t be bothered anymore.
You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.
Image: Moritz Knöringer (via Unsplash)
Here in the U.S., when our calendars turn to September we know that some exciting things are about to happen. Trees change up their wardrobe. Pumpkin spice lattes warm the fingers and hearts of the masses. And the world’s premier DevOps conference opens its doors to thousands of enthusiasts.
Yes, it’s that time of year. DevOps World 2021 is taking place on September 28-30, and the organizers are hard at work ensuring that this year’s event will be the best one ever. Like last year, the 2021 version will be virtual, making it easy for attendees to log on from the comforts of their workplace or couch. It will feature a full slate of engaging sessions, speakers and networking opportunities for every member of the DevOps community.
In 2021, we had attendees “show us their world”—giving them a chance to engage in two-way dialogue from thousands of locations across the globe. This year, the event is going “back to the future.” We won’t have any time machines on hand, but we will be focusing on how we can build the future of software delivery together through security, CI/CD, scalability and DevOps best practices.
Like last year, you can log on, watch keynotes, participate in break-out sessions, network with attendees, scan the virtual sponsor booths, attend demos and gain certifications on your computer, tablet or hand-held device. And, aside from a handful of training sessions, it’s all free.
The official theme of DevOps World 2021 is “Building the Future of Software Together.” As we’ve seen over the past year, during the pandemic, the future is now! Organizations have moved rapidly to scale up their technology resources to increase agility, efficiency and customer engagement. Software delivery will serve as the critical driver as they transform their operations to meet future challenges.
So, what can you expect at DevOps World 2021?
The headliner for this year’s event will be Steve Wozniak, co-founder of Apple. The man they call “Woz” was the chief designer for the first wave of computers that launched Apple on its journey to becoming the $2 trillion global powerhouse that it is today. Over the years he’s been involved in a variety of business and philanthropic ventures focusing on everything from software engineering to blockchain technology.
Wozniak will deliver a keynote called Future of Security Working Together. During the session, he will talk with Hope Lynch, technology strategy director at CloudBees, about topics ranging from Apple’s innovation and creativity to robotics and automation to his personal vision for the future of technology.
Wozniak will close the show on Sept. 30. Other keynotes will cover the following topics:
● Build the Future Today – Presented by Stephen DeWitt, CEO, CloudBees
● Security and Scalability Using Open Source Tools – Presented by Dan Lorenc, Google software engineer
This year’s DevOps World 2021 is packed with must-see sessions for developers and tech executives alike. With over 100 different sessions and 130 speakers, everyone is sure to find a full slate of sessions that will engage them and challenge their skills. Topics include security, DevSecOps, compliance, diversity, inclusion and belonging, building careers, progressive delivery, automation, value stream management, Kubernetes, cloud, GitOps, open source and Jenkins, measurement and ROI.
The best part of these sessions is that for those who join live, you’ll be able to interact with other attendees and, in many cases, with the speakers as well. But if something suddenly comes up and you can’t make your favorite session, don’t worry! You can stream all sessions on-demand.
DevOps World 2021 is debuting two new tracks—financial services and public sector—to focus on the unique challenges and requirements of these industry segments and personnel. Forward-looking enterprises and government agencies such as American Family Insurance, the U.S. Air Force, Broadridge Financial Solutions and U.S. Citizenship and Immigration Services will share their DevOps best practices. The popular leadership track will continue this year, with sessions tailored for executives who are leading DevOps and transformation initiatives. Community tracks and those led by the Continuous Delivery Foundation will also take center stage.
Dozens of leading organizations in the industry will be supporting DevOps World, and most of them will have virtual booths in the Expo Hall. Exhibitors include AWS, Sonatype, Mirantis, VMware, CyberArk, the Continuous Delivery Foundation and many more. Check out the full list of sponsors here.
As we do every year, The DevOps World 2021 Awards will recognize the achievements of DevOps innovators around the globe. The CloudBees Innovation Awards will honor companies that demonstrate quantifiable business value from using CloudBees solutions. CloudBees awards include designations for DevOps and Analytics; DevOps Scalability Achievement; DevOps Rising Star; Security, Compliance and Audit Innovation; and Enterprise Progressive Delivery.
For DevOps World 2021, CloudBees will be hosting a variety of workshops held at varying times to accommodate global participants. This year’s workshops include “Self-Service Releases with CloudBees Software Delivery Automation,” “Building Audit-Ready Pipelines with CloudBees Software Delivery Automation,” “Flexible Delivery Methodologies with CloudBees Feature Management” and “Configuration as Code with CloudBees Continuous Integration.” If you’re interested in attending any of these workshops, a workshop pass also includes complimentary access to the CloudBees Certification program!
With all of these exciting sessions, keynotes, workshops and more, now is the time to register for this year’s DevOps World event! We’re excited to bring everyone back for another year of virtual fun as we come together to build the future of software. To ensure your free spot at DevOps World 2021, register today!
JumpCloud today announced it is adding a zero-touch enrollment for Macs capability to its cloud directory platform that will also be extended over time to applications.
Greg Keller, JumpCloud CTO, said this new capability extends Apple Business Manager, formerly known as Apple Device Enrollment Program (DEP), all the way down to specific users by leveraging data that resides in the JumpCloud platform.
Whenever a user logs into a new Mac, it can automatically be synchronized with the JumpCloud Directory, which then uses the identity of that end user to configure the device in addition to providing the appropriate access to all corporate resources via their JumpCloud credentials.
Keller said the need for zero-touch approaches to IT administration has become more acute in the wake of the COVID-19 pandemic. With employees working from home more frequently even after the pandemic eventually subsides, Keller noted the days when IT teams could physically provision a Mac are on the wane.
While Apple Macs still represent less than 10% of all the PCs shipped in a year, Keller noted small-to-medium (SMB) businesses are adopting Macs at a faster rate than large enterprises. As the endpoints become more diverse, Keller said the JumpCloud platform provides an alternative to Microsoft Active Directory for managing both Windows and Mac devices. Apple, of course, last year acquired Fleetsmith to gain access to provisioning tools. However, those tools are not yet integrated with any type of directory.
Most recently, JumpCloud has added a tool that enables IT teams to remotely install software onto end user Windows devices, as well as integrations with Slack, Salesforce, Atlassian, GitHub and Amazon Web Services (AWS).
Fresh from raising an additional $100 million in funding, JumpCloud is making a case for a zero-trust approach to managing endpoints using a directory that verifies the identity of each end user. JumpCloud, which makes a free edition of its platform available for individuals and small teams, is already being used by more than 100,000 organizations spanning more than a hundred countries. More than 3,700 of those organizations, including Cars.com, GoFundMe, Nimbus Therapeutics, Grab, Pulselive, SlimPay, Foursquare, Beyond Finance and Funding Societies, are paying customers.
In the longer term, there may come a day when verbal commands are employed to provision endpoints for specific end users. In the meantime, the process of configuring and provisioning those endpoints is becoming more automated. IT teams are now able to remotely manage fleets of endpoint devices without having to physically touch them. In fact, there may be no need for IT managers to return to an office, as tasks become increasingly automated and able to be performed remotely.
While there are a lot of options available to achieve that goal, Keller said the number of them that are tightly integrated with a directory to ensure the right system winds up in the right end user’s hands is few and far between. The challenge now is getting organizations to rethink their directory requirements at a time when IT teams are increasingly expected to deliver personalized, white-glove services regardless of where an end user is located.
Ensuring the security of user data within your app is critical to building trust in your business and contributing to the online safety of customers.
Here’s a list of the top 10 essential security mechanisms that Apple offers to up the security posture of your iOS applications. Adopting these technologies and APIs within your products is an effective step toward writing more secure applications, giving you a lower risk of potential data compromise and increased confidence in your security posture.
iOS provides the data protection setting, a robust way to automatically encrypt any files created by your app. This is an important security setting, however, it is turned off by default and many developers never enable it. Leveraging the system’s data protection mechanism is an easy win for increasing the security of user data within your app.
It’s critical to ensure that any data-in-flight is transmitted over secure connections. By using encrypted HTTPS connections for all apps’ network activities, a wide variety of data-in-flight compromises are mitigated. Additionally, organizations are recommended to leverage SSL pinning for maximum transport-layer security.
The default protocol to serialize and deserialize data on iOS, NSCoding, is vulnerable to object substitution attacks, which could potentially allow an attacker to gain remote code execution. Apple offers a near drop-in replacement, NSSecureCoding, which is not vulnerable to this attack. To convert a serialized class to use the NSSecureCoding mechanism, Apple has outlined steps in its documentation. Making the recommended changes allows the system to enforce safe deserialization.
App Transport Security (ATS) is a mechanism provided by Apple to mediate all network connections made by the app and validate that data is being transmitted securely. Opting out of ATS by use of NSAllowArbitraryLoads, or similar exemptions, is an easy way to shoot yourself in the foot and turn off a powerful security mechanism.
Encrypting user’s data is a no-brainer, but care must be taken to ensure that it’s done in a cryptographically secure way. Some system APIs, such as CommonCrypto, are easy to misuse. This results in the illusion of security, while still allowing an attack vector for user data to be compromised. Be sure to use these APIs with secure options, and never statically embed encryption keys or use an encryption key which is trivially derived.
When handling personally identifiable information (PII) within an app, it can be tempting to store it in a convenient and straightforward way, such as using an NSUserDefaults entry. However, this approach allows any other app on the device to read this potentially sensitive data. Sensitive data, especially identifiable user information, should always be stored in a secure location, such as the device’s keychain, and encrypted when necessary.
While the keychain is the most secure store of data on the Apple device, developers must still take care to ensure they’re using it correctly. It’s possible for developers to save data to the keychain in such a way that the data is always unencrypted and accessible, even when the device is locked and data would otherwise be encrypted. When saving sensitive data to the keychain, ensure that you’re using the strongest possible data-protection settings to maximize security.
Wherever possible, utilize “kSecAttrAccessibleWhenUnlocked,” the strongest protection class, when saving items in the keychain. This protection class tells the system that data should be encrypted when the user is not actively using your application. If your app needs to access this data while running in the background, you may need to fall back on the “kSecAttrAccessibleAfterFirstUnlock” protection class, which ensures the data is encrypted only until the user has unlocked the device after boot.
When an SDK is linked into your application, you’re also implicitly exposing your app to any potential vulnerabilities in the SDK. Compromised SDKs have led to a variety of mobile app attacks, such as a vulnerable AFNetworking version leading to data compromised through a MitM attack. Without a security audit of the SDKs used within the app, developers are blind to the potential vulnerabilities they are introducing.
While installing third party keyboards are useful for user customization, they introduce a new vector for data leakage. This is because the developer of a third party keyboard may be able to extract any information typed on the keyboard. As a result, it’s in the user’s best interest to disable these keyboards when handling sensitive data, such as identifiable information or credit card numbers.
It’s all too easy to leave debug logging, which may include PII, in production builds. Before release, validate that any log statements which might include sensitive data are scrubbed from the code. This might be achieved by way of flags, which only enable these log statements in debug builds. Since logs may be visible to anyone with physical access to the device, it’s paramount to exclude sensitive data from them.
Since adopting the newest technologies often introduces unforeseen risks, defensive security is a constant endeavor. However, following these top 10 tips will increase your organization’s security posture and reduce vulnerabilities introduced by iOS risks.
