Mikhail Garber

If you're the kind of person who's excited about all the recent S3 feature announcements (bucket policy unlocks via temporary root sessions, up to millions of buckets per account, pagination and region filtering for ListBuckets, conditional writes, ListCallerAccessGrants API) and you're attending re:Invent, then you should come to our storage track session, STG306 Advanced security patterns on Amazon S3. Learn how to use all the exciting new stuff securely in the most interactive format available at re:Invent!

94

2 Comments

This is a bittersweet post (more on that later) and long. When I joined The ASSISTments Foundation over 4 years ago, our platform was a hodgepodge of code and frameworks accumulated over decades. Ruby on Rails, GWT, JSP, Java, an API with no standard, and a database and data structures that had long since lost their ability to scale with the kinds of things we needed it to support. All running on a few physical servers at WPI. There was SO much work to do if we were ever going to have a foundation on which to truly innovate. Over the last few years, we’ve moved our entire infrastructure to the cloud, rebuilt the teacher experience and student experience in Vue.js from the ground up, and launched a brand new product for school admins and instructional leaders. But the last step was the biggest: we had to refactor all five of our products to use our new RESTful API (SDK 3.0), migrate terabytes of content to our new database structures and build an entirely new content management and authoring system to support everything. Plus, we wanted to include some of the first new features not possible on the old system: new item types and an alpha version of teacher authoring for our longtime ASSISTments 1.0 users. On Tuesday, after well over a year of the most complex refactoring you can imagine, the team delivered flawlessly. Even though this is not the Oscars (and I certainly am not “the winner” of this), I’m now going to go over my time limit and praise the amazing team responsible for this: First, Director of Engineering Ryan Emberling and Senior Product Manager Cindy Starks organized and managed the entire project through the many, many curve balls we were thrown and pivots we had to make, building the management systems on the fly as we figured out this herculean task, with help from Michael Weingarth owner of our district admin product. Lead Designer Kyle Scheuing, working with our Director of Content and now Product Owner Dawn Peterson designed an intuitive but amazingly powerful authoring environment that is legitimately worthy of a design award if such things were given for authoring environments. Our engineering leads, Christopher Donnelly, Joan Wong, and David Magid—along with Ryan—self-organized in true agile fashion to lead the rest of the engineering team through countless hours of analysis, architecture decisions, code review, and God-knows-what-else. And finally, our amazing engineering team: Danita Forbes-Sample, Manuel Gonsalves, Rownok Nowrose, Brian Rojas, Jaime Torres, Jose Velazquez did months and months of work rewriting vast swaths of our codebase. I am so proud of this team, and honored to be able to work with them. Their achievement has set the stage for innovation at ASSISTments for years to come. The bittersweet part of this is that I will not be with them for that journey. I will miss this team incredibly, and I hope our paths will cross again.

44

8 Comments

Karl Knechtel provides a very good and very detailed summary of the recent petty "PSF Show Trials." He takes far more time detailing chronology than I can imagine doing myself. I don't see anything inaccurate in his narrative (and even if some dot or tittle is off, the general sense is right). #psf #python #CoC #showtrial https://lnkd.in/eJCxiT-Q

7

2 Comments

Taken from TLDR - full article attached. "To automate entire job functions" it says. Talking about making your job easier? You won't have to do anything! 🤖 In two months they have generated 700k in ARR (Annual Recurring Revenue, so subscriptions. Artisan, a fast-growing startup founded in 2023, is revolutionizing the future of work by developing AI employees, called Artisans, to automate entire job functions, starting with sales. After initially struggling with a self-serve model, it transitioned to a sales-led approach, resulting in significant growth. Artisan is focused on building an efficient inbound lead generation system and aims to create the best outbound AI SDR on the market. It plans to expand into other areas like marketing and customer success. https://lnkd.in/eUnT972j

6

3 Comments

🖥 Can you Crack the Code?! 💾 You're a software engineer trying to crack into a secure system (legally, of course!). The system uses a password that follows a special pattern: The password is made up of 6 characters: 3 letters followed by 3 numbers. The letters can be any lowercase letter from 'a' to 'z'. The numbers can be any digit from 0 to 9. The password must satisfy these conditions: The sum of the ASCII values of the 3 letters must be divisible by 3. The product of the 3 numbers must be a prime number. Now, the password hint provided by the system admin says the following: "The sum of the ASCII values of the letters is exactly 315." "The product of the numbers is 13." Your Challenge: What is the password? (Hint: You can use Python to write a script, or just use logic and creativity to solve it!)

2

I've seen a lot of bugs. (No, not another cicada post). Software here. Egregious, immediately noticeable bugs. The opposite - those that require 6 concurrent conditions and 6 hairs from your nextdoor neighbor and it still only triggers once a month. (Okay, 7 conditions, 6 hairs...don't split those hairs). A continuum of buggage. Those complicated ones, sans the hyperbole - those are your Zero day issues. Regression testing doesn't find them. A super wily code-reviewing look-at-it-all software QA professional (I know the best one)...might...but probably not. How do we even engineer testing all of the complicated conditions? The interrelationships at runtime? I don't see a lot of talk about "how could we have caught this?" in public for disclosed issues. Most of the fixes for Zero days (those security holes best known because they're patched with updates to software like Google Chrome browser, Apple's ioS, Microsoft Windows) are downplayed. You get "Hey, user, look at these new features you're getting, and in whispered voice, "and security updates." Not familiar with the term? Zero day means a security issue without a patch. When the patch arrives, there's a remedy for the problem. Users often don't APPLY the remedy until much later...its own problem...prolonging the risk of the Zero day issue. Back to my kinda silly example. That's a wicked hard problem to test for. A bunch of concurrent situations that then trigger the problem. But, when the problem's a known issue, it's not hard to re-trigger. And therefore exploit. So what do we do? Other than fixing/patching, and communicating? What else is there to add to this conversation? Sunday thoughts. Sunday thoughts.

13

7 Comments

Government agencies have been calling for devs to move away from languages like C++ for years! I am not sure why articles and blogs like this always catch my attention but they do. Maybe it is because over the past 15+ years that I have been recruiting in the embedded space I haven’t worked on a single search where C/C++ experience was not a hard requirement and I wouldn’t be surprised if this is the case for the next 20 years as well! The article is highlighting that C/C++ are not memory safe languages while languages like Rust, Python and Java are MSLs. One of the lines that really caught my attention was: “C and C++ have leave much of the security burden on developers, where sloppy coding practices and slapdash code testing can lead to security vulnerabilities that threat actors can exploit to gain access to arbitrary files or inject malicious code.” So that leads me to ask: Is the problem with the language or the fact that developers are sloppy? If done correctly is C/C++ just as secure as the others? For embedded development I have been hearing about Rust for the past 4 years but have yet to have a client ask for someone with Rust experience. I will note, I am seeing Rust show up on job descriptions more regularly so maybe we are about to reach an inflection point. https://lnkd.in/gH2VZD3Y

1

🚨 Microservices are Technical Debt? 🚨 A bold claim from DoorDash’s Principal Engineer, Matt Ranney, caught my attention recently. He stated that “Microservices are Technical Debt” 🤔 If I think back a decade, I was a vocal advocate for Microservices myself. They were the shiny new tool, a game-changer for our struggles with monolithic architectures. For those who’ve worked on massive enterprise software, you’ll recall the headaches: lengthy time-to-market, endless regression failures, and teams constantly stepping on each other’s toes within the same codebase. The rigid design of monoliths made even the smallest changes painstaking and strained product development cycles. Microservices, by contrast, offered a solution rooted in the SOLID principles of object-oriented development. For product, process, and engineering teams, it felt like the perfect answer—driving us to dive headfirst into refactoring those monoliths. In one of our major syndication initiatives, we developed an entire suite of Microservices: scalable, efficient, and seamlessly interfaced with other products. This was an inflection point. As teams grew, so did the number of services, and the arrival of cloud computing made deployment even more accessible. Fast forward to today: leading SRE, I can see the other side of the Microservices equation. We have a sprawling service network, creating challenges for triaging, support, and maintenance. Many original team members have moved on, and managing the complex web of interdependent services has become a maintenance nightmare. So, are Microservices technical debt? From my experience, yes. Matt’s perspective resonated with me—Microservices often bring as much socio-functional complexity as they solve. Perhaps the answer isn’t as black-and-white; monoliths might still work with robust design and planning, but managing them with large teams is its own kind of chaos. Today, many organizations are realizing their vast microservices landscape can be laden with duplicate code and redundant functionality, turning them into technical debt. The silver lining? Decommissioning services can be more manageable than refactoring monoliths, though many services still linger, waiting for their turn to be merged or sunsetted. Curious if others feel similarly! Could this lead to a resurgence of monoliths, especially with AI-assisted code development in the mix? Or do Microservices remain the best answer? Let me know in comments, Cheers !!! 🍻

104

77 Comments

Llama 3.1 has demonstrated one more time that open source is the way to go. Still doubtful? Give it a try using distilabel. 1️⃣ pip install distilabel 2️⃣ Select your favorite LLM 3️⃣ Test it with your own prompts And if you like, build with it!

28

2 Comments

"If you ship something users hate and makes no money, but your leadership team is happy, you still shipped" I disagree with this take that hit the front page of Hacker News this week. I'm not entirely against optics; you should make your work visible. However, impact (and the reality of it) should always come before good optics. Top big tech companies do not reward people based purely on optics. Although companies get more political as they grow, even the biggest companies (e.g. FAANG) have designed their organizations to minimize this. These companies are data-driven where possible and reward people who improve metrics that help the business. This makes career growth less about making leadership happy and more about the concrete improvements you drive. Of course, metrics can have drawbacks (especially when measuring the wrong thing), but that is where you can make a difference. Don't accept the status quo if it's obviously not better for the business. Engineers should influence the direction of their organization to avoid work that isn't impactful. Full thoughts on this here: https://lnkd.in/gP6TUwVY

110

4 Comments

Fellow Hiring Managers, Be a knife collector! A Swiss Army Knife collector to be specific. In 2024 when AI has memorized every coding language, you should be looking for a software engineer who can pickup a new language over the weekend and make something with it vs a coder who has memorized 0.000001 of what AI has. Look at their accomplishments and if you give them a coding challenge, don't look for immediate proficiency, instead look for adaptability. Have them code in a language new to them but don't do it over their shoulder. Your software engineers need to be Swiss army knives, not encyclopedias. We have AI for that now.

11

Has anyone used the Sourcegraph Code Search tool? It's adjacently related to something else I'm researching and evaluating but I'm just not "getting it". I feel like I'm missing something critical because I know people use it but I don't see the value in dropping money on a "better code search" tool. If you've ever used it, could you please help me understand why it matters? It's not a dig at the product, it's just not clicking for me. Better semantic searches? Stronger contextual awareness? Makes Ruby easier? What is it?

10

5 Comments

A recent significant development in release management I think flew under the radar for many: the Abseil C++ library's adoption of a "live at head" policy as its recommended method of depending on the library. What the maintainers mean by "live at head" is to "depend on and build the latest snapshot of Abseil," which implies that every commit to the head of the repo is to be considered a production release to be compiled in. The head of the main branch is the current release, period. The project is also tagging LTS releases every six months with support of two years pledged but also state there is nothing special about those tags, that it's just a snapshot at that point in time. Despite recommending against depending on their LTS releases, they are providing this for who the live at head policy doesn't work. Abseil release management: https://lnkd.in/egFchD4f --- #ReleaseManagement #Cplusplus #SoftwareEngineering #VersionControl #LiveAtHead #Abseil #OpenSourceSoftware #SoftwareDevelopment #LTSReleases #SoftwareUpdates #embedded #software #Cprogramming #CplusplusProgramming #C

1

An RPG leveling tree for Engineering Managers 🧝🏻‍♀️ You can also check out the SWE and DevOps leveling trees in my previous posts. TPM and QA coming soon.

4

2 Comments

Time to be fair.... In past posts, I have been less than complimentary of the DLC regulations that now make it more difficult to implement SMS into an application. I understand that all sorts of organizations use (and misuse) SMS millions (billions?) of times daily. I get that the new regulations make an attempt to reduce, as much as possible, SMS Spam. All in all, it just seemed like another example of hand-cuffing the good guys while trying to put some limits on the bad actors. My experience at the time was with #Twilio... and I tried to make it very clear that my frustration wasn't necessarily with them - they were doing the best they could to handle an avalanche of organizations trying to comply with new rules that everyone was stumbling their way through. I've been using Twilio for years and can't complain AT ALL about the platform performance for my particular small-scale needs. It was the nearly impossible approval process that really soured me. After nearly a year of living without application-based SMS (email only), I decided to revisit. The application was already all wired up for the feature - it was just dormant. This time around I was able to get up and running in 3 days... 99% of which was the DLC approval - which happened today. Kudos #Twilio for suffering through the tough days and making SMS once again something that can be done with very little pain. #twilio #sms #dlcapproval

2

A junior software developer might evaluate a career path. Common options available after some seasoning are senior software developer, software architect, and project manager. Software development managers. Delivery managers. Hop on over to QA if you like to break software. This slight field shifts requires you to develop some maniacal laughter strains. Might shift into DBA, or database administrator, work, too. Some of the most valuable career exploration is determining what you like and don't like. Martin Fowler's book Patterns of Enterprise Application Architecture (not pictured), while well organized and brilliant, taught me I did NOT want to be a software architect. And that was important to learn early. The book pictured here is the Fowler's I more easily identify with - modern English usage in writing. My copy of Martin Fowler's book is currently at the Missouri Cybersecurity Center of Excellence SOC. I figured this swapping out the books was almost as amusing as AI black cats. I'll be writing a whole lot more about my work at MCCoE in future posts...but for today... Like software development, cybersecurity offers a great many career options. Early learning should provide context and insight into where to focus to learn the foundational basics. Why? So that the learner is well rounded and also able to later specialize in the right area of interest while serving well in the current role. Self-taught people need mentors to help identify the path, and this field is one of the best in giving back to the community of the aspiring next generation. I'm frequently amazed and pleased to play a part. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- I learned in the first couple of years that my tech career needed to focus on people and their needs. Software is, after all, built for people. It should make their work easier and their lives better. Please, someone else make it run faster and leaner, and I'll verify flows well and the data that powers it is accurate. Fowler's Modern English Usage only mentions cybernetics, not cybersecurity. "... a by-product of the word is the use of the first element -cyber in a wide range of computer terms such as cyberphobia, cyberpunk, and cyberspace, or virtual reality..." #cybersecurity #career

14

4 Comments

The recent wave of layoffs in technology is more than a temporary setback. It impacts the software engineering labor market in ways that could last for years. Layoffs have eroded the implicit trust between employers and employees, leading to a workforce that may be more cynical and less committed to long-term loyalty. This could increase job-hopping and make retention even harder. Some experienced engineers might leave tech for more stable industries, and new grads could choose different career paths. This could result in a talent shortage down the line, leaving companies struggling to fill crucial roles. With traditional full-time roles appearing less secure, some may embrace gig or contract work, prioritizing flexibility over stability. This shift could make it challenging for companies to maintain long-term cohesion in teams. Employees will increasingly push for remote work, flexible hours, and greater work-life balance. This helps de-risk relocating for jobs that don't deliver on promises. Workers may focus on continuously improving their skills to stay resilient. We could also see a cultural push for collective representation or employee advocacy in technology. If companies want to attract and retain the best engineers in the future, rebuilding trust and prioritizing employee well-being isn’t just a nice-to-have, it’s essential. Would be great to hear people's thoughts! #TechLayoffs #SoftwareEngineering #FutureOfWork #TalentManagement #WorkplaceCulture #EmployeeExperience

60

11 Comments

For the record. 10x developers get a lot of attention. In my experience there are 10x’ers in every organization. Limiting that credential to development is short sighted and narrow minded. It’s a first principle not an organizational principle.

62

3 Comments