The first ever SaimaaSec meetup was organized last week and had three presentations from the infosec and cybersecurity industry. The event was held at LUT University which also sponsored it. Here are my (very) short notes from the presentations.
War stories from Incident Response - key takeaways
Juho Jauhiainen talked about incident responses and war stories. We heard about how the famous Vastaamo case happened and many more stories. Nothing in my notes though.
TLS is fine and why we should really care about it
Encrypting network traffic is great but as Tomi Koski talked in his presentation you should also really care about it. This was an interesting story of how MDM can be a vulnerability if it isn't done right.
This time it was about how the application checked TLS certificate of the server it communicated with. Due not verifying the certificate there was place for MITM attack. Also some not so good practices in the application development which leaked secrets and lead to spoof legit update package and possibility to install whatever the attacker wanted.
First year as Director of Information Security in a unicorn cloud company - Lessons learned
Riku Tarkiainen from Visma Solutions had some lessons to share from the manager point of view about information security.
Some of his points were:
"It's all about customers. You need to understand what you're protecting and why you're protecting them."
"Know your status and know what you don't know. Do you have data?"
Security is part of business.
People and communication are key factors.
Understand how you learn and do it. Daily. And teach also.
The field of Cyber Security is broad:
And last, what areas should a CISO concentrate on 2023, told by ChatGPT:
This year has been challenging for meetups and gatherings but one good side of the restrictions was that remote work has become more acceptable and also meetups and conferences have invested to streaming and virtual participation which is great for people living in an area where there's no meetups.
Fighting alert fatigue and visibility issues in SOC
Juuso Myllylä from OptimeSys talked about fighting alert fatigue in security operations center (stream from 41:41 onwards). The goal in the talk was to improve automated detection, introduce "detection logic killchain" framework he has worked on as his master's thesis and shift our minds from signature based detection and move towards intelligence based.
Threat detection framework based on design science research method:
Identify: What is a threat? What kind of things make up a threat?
Convert your idea into a security information and event management (SIEM) search query
Procedures: many APT (Advanced Persistent Threat) groups have used valid accounts as an entrypoint
Deploy the use case
Evaluate: evaluate detection logic
Analyze the SIEM logs once your SIEM use case has been deployed
e.g. check Azure AD audit logs, eliminate non-related data
Applies also to threat hunting
Communicate: Document your detection logic in Sigma form
Can be shared with others, try to be SIEM agnostic
iPhone BFU Acquisition and Analysis
The meetup continued with iPhone forensic from @1:19 by Timo Miettinen from Nixu. The presentation explained first how the iPhone iOS filesystem's two main partitions are protected: non-encrypted System and encrypted Data. Data partition is encrypted with burned-into-hardware UID key. The files have additionally 4 classes of Data Protection.
From forensics point of view access to data is protected with many layers: USB connectivity is restricted; Logical extraction is divided to iTunes backup + some media files, password protected backups contain more data, backup password can be reset but has deviations; Full file system extraction needs jailbraking the device; iCloud extraction (synced backup).
The case talked in the talk was a lost iPhone which was later returned by law enforcement. The question was: What was done with it while missing? Was it stolen or just inspected by friendly authorities? Phone was powered off and passcode was changed.
So they had BFU device in their hands for data extraction: device that has been powered off or rebooted and has never been subsequently unlocked. The amount of the data they can theoretically get is really limited.
In BFU the file encryption keys are wiped from the device RAM and only unencrypted class D protected files are available. Biometric authentication is not possible, USB restricted mode is enabled (need biometric authentication or passcode to activate data connections), lockdown records become useless (logical data acquisition impossible) and passcode recovery attack falls to BFU speeds.
Utilizing exploits and jailbreaks:
checkm8: unpatchable bootrom exploit released by axi0mx on September 2019 which enables jailbreaks, activation lock bypass etc.
checkra1n: jailbreak released on November 2019 which utilizes the checkm8 exploit to run unsigned code on an iOS device. Doesn't always pass the USB restricted mode, depends on the combinations of hardware and software versions.
Open source and free tools:
libimobiledevices has collection of useful tools:
SSH over USB using iproxy
ideviceinfo gives iOS and HW versions
idevicecrashreport gets crash logs from the device
In their use case the checkra1n jailbreak didn't work and USB restricted mode was activated. Also some of the commercial tools enabled to extract some data but wasn't able to read the archive format the software created. They decided to the analysis manually which is a good idea even if the tools are working.
Some open source or free tools for analysis:
APOLLO (Apple Pattern of Life Lazy Output'er): parses pattern of life data from databases and properties into human readable format.
For reading plists you can use: plutil -p <filename>
DB Browser for SQLite
Google's protobuf utilities (protoc)
When doing analysis you should look for plists, binary plists, plists in plists, blobs may contain binary plist files and SQLite databases (Shared Memory file .shm, write ahead log .wal). Some applications store data in protocol buffers (protobufs) in SQLite database blobs, plist files or just data files. Tools find most of the interesting data but you can make your own script to dump all text files, convert plist files to readable format, dumps data from every database, get all embedded binary plists from plist files and databases and convert them to readable format.
In their case they found out that the phone was reinstalled 12 hours after it was lost. Mobile banking, social media and instant messaging applications were installed. The device was used to communicate with several contacts and used around the city. The phone was stolen and reinstalled with intention to use it.
Still Fuzzing Faster (U Fool)
Joona Hoikkala talked about Web Fuzzing and using fuff tool for fuzzing directories, login, basic auth, virtual domain, content id:s and more. Follow the talk from the stream at 2:19:00 and the demo starts around @2:33:00. The slides are good starting point.
You can use fuzzing with different input contents to target i.a. GET parameters (names, values or both), headers (Host, authentication, cookies, proxy headers) and POST data (form data, JSON, files). What to look for (matching)? Response codes, content (regexes) response sizes (bytes, # of words).
Laura Kankaala, from Robocorp and Team Whack fame talked about the price of a digital identity starting at 3:20:40. Data is central, security - privacy: how companies view data and how data sellers view data.
What we are
What we have
What we produce
Laura also presented that ~90-99% of data collected is dark data which is collected but not really utilized. But we are just getting started. But it's good to remember that our data belongs to us. We give permission to collectors and controllers.
Do you know what's your data worth? Data is valuable and for example there are companies like doc.ai and datum which tries to monetize it so that also user gets part of it. But yet the data is used more for targeted ads, providing content just for us, increasing efficiency and creating better services. And of course every one remembers Cambridge Analytica and (trying) to affect electoral processes in the US.
The most valuable things being sold online are: credit cards, identity numbers, passports, credentials, phone numbers, home address. Passports are quite logical of value and e.g. France passport goes for $124, USA $115, Canada $103, UK $60 and so on, depending of the data included with it.
Kankaala talked about how the collecting of our data has sneak to our lives (e.g. social credit systems). Companies collect data and when our normal live becomes very tangled with our live online it becomes easier to monitor us, to see what we're up to and to moderate our behaviour. We need to be careful when we allow new type of access to our live, e.g. COVID-19 tracking.
Regulation, awareness and education is at least a patch to some of these issues. We are hackers and we should be the pathfinders and show people that it doesn't have to be that if something works the way it does today and although it works it doesn't mean it works right or ethically.
We are all vulnerable
Magnus Lundgren from Recorded Future told a tale of two databases, a panda and someone who was listening starting at 4:25:00.
There's a race of when vulnerability is found and assigned a CVE number until it's either patched or exploited. 12 517 CVEs were first published on NVD in 2016-2017 and it takes average 33 days until an initial assesment of the vulnerability is made available via NIST's NVD. For example Dirty Cow (CVE-2016-519) it took 21 days to initial release on NVD but it took only 8 days to create an exploit (Proof of Concept shared on Pastebin) for it and sold/shared on the deep and dark web.
A tale of two databases: NVD (NIST) and CNNVD (CNITSEC). In the Chinese CNNVD it takes on average only 13 days compared to 33 days on NVD for initial assesment. The difference comes from the detail that CNNCD is doing active collection while NVD is doing passive collection from vendors. But always it doesn't be that way like it was the case with some Android backdoor where it took 236 days from CNNVD and 60 days from NVD. It takes longer for CNNVD to publish high threat vulnerabilities than low threat ones and during the publication lag Chinese APT groups are exploiting those vulnerabilities.
When the Recorded Future published a blog post identifying 343 "outlier" CVEs (regarding the issue the of CNNVD lag) CNNVD backdated 338 of those CVEs. Someone was listening.
Deep / Dark web monitoring of activity is crucial for a good patching cadence.
Magic can be done with threat intel data that has been organiced for analysis.
Chinese intersection is particularly vicious for foreign companies: Ministry of State Security (China) runs multiple threat actors e.g. APT3, runs CNNVD and cherry picks CNNVD vulnerabilities for targeting.
DevOps 2020 Online was held 21.4. and 22.4.2020 and the first day talked about Cloud & Transformation and the second was 5G DevOps Seminar. Here are some quick notes from the talks I found the most interesting. The talk recordings are available from the conference site.
How to improve your DevOps capability in 2020
Marko Klemetti from Eficode presented three actions you can take to improve your DevOps capabilities. It looked at current DevOps trends against organizations on different maturity levels and gave ideas how you can improve tooling, culture and processes.
Build the production pipeline around your business targets.
Automation build bridges until you have self-organized teams.
Adopt a DevOps platform. Aim for self-service.
Invest in a Design System and testing in natural language:
brings people in organization together.
Testing is the common language between stakeholders.
You can have discussion over the test cases: automated quality assurance from stakeholders.
Validate business hypothesis in production:
Enable canary releasing to lower the deployment barrier.
You cannot improve what you don't see. Make your pipeline data-driven.
Practical DevSecOps Using Security Instrumentation
Jeff Williams from Contrast Security talked about how we need a new approach to security that doesn't slow development or hamper innovation. He shows how you can ensure software security from the "inside out" by leveraging the power of software instrumentation. It establishes a safe and powerful way for development, security, and operations teams to collaborate.
Security testing with instrumentation:
Add matchers to catch potentially vulnerable code and report rule violations when it happens, like using unparameterized SQL. Similar what static code analysis does.
Making security observable with instrumentation:
Check for e.g. access control for methods
Preventing exploits with instrumentation:
Check that command isn't run outside of scope
The examples were written with Java but the security checks should be implementable also on other platforms.
Their AppSec platform's Community Edition is free to try out but only for Java and .Net.
Open Culture: The key to unlocking DevOps success
Chris Baynham-Hughes from RedHat talked how blockers for DevOps in most organisations are people and process based rather than a lack of tooling. Addressing issues relating to culture and practice are key to breaking down organisational silos, shortening feedback loops and reducing the time to market.
Three layers required for effective transformation:
People and culture
Scaling DevSecOps to integrate security tooling for 100+ deployments per day
Rasmus Selsmark from Unity talked how Unity integrates security tooling better into the deployment process. Best practices for securing your deployments involve running security scanning tools as early as possible during your CI/CD pipeline, not as an isolated step after service has been deployed to production. The session covered best security practices for securing build and deployment pipeline with examples and tooling.
Standardized CI/CD pipeline, used to deploy 200+ microservices to Kubernetes.
Make CI feedback actionable for teams, like generating notifications directly in PRs.
When to trigger deployment
PR with at least one approver.
No direct pushes to master branch.
Only CI/CD pipeline has staging and production deployment access.
Secrets management using Vault. Secrets separate from codebase, write-only for devs, only vault-fetcher can read. Values replaced during container startup, no environment variables passed outside to container.
Container runtime security with Falco: identify security issues in containers running in production.
Data-driven DevOps: The Key to Improving Speed & Scale
Kohsuke Kawaguchi, Creator of Jenkins, from Launchable talked how some organizations are more successful with DevOps than others and where those differences seem to be made. One is around data (insight) and another is around how they leverage "economy of scale".
CFO: why do we spend so much on AWS?
Visibility into cost at project level
Make developers aware of the trade-off they are making: Build time vs. Annual cost
Small: 15 mins / $1000; medium: 10 mins / $2000; large: 8 mins / $3000
Whose problem is it?
A build failed: Who should be notified first?
Regular expression pattern matching
Improving software delivery process isn't get prioritized:
Data (& story) helps your boss see the problem you see
Data helps you apply effort to the right place
Data helps you show the impact of your work
Cut the cost & time of the software delivery process
Predictive test selection
You wait 1 hour for CI to clear your pull request?
Your integration tests only run nightly?
Reordering tests: Reducing time to first failure (TTFF)
Creating an adaptive run: Run a subset of your tests?
Deployment risk prediction: Can we flag risky deployments beforehand?
Learn from previous deployments to train the model
Automation is table stake
Using data from automation to drive progress isn't
Lots of low hanging fruits there
Unicorns are using "big data" effectively
How can the rest of us get there?
Moving 100,000 engineers to DevOps on the public cloud
Sam Guckenheimer from Microsoft talked how Microsoft transformed to using Azure DevOps and GitHub with a globally distributed 24x7x365 service on the public cloud. The session covered organizational and engineering practices in five areas.
Connect our customers directly and measure:
Direct feedback in product, visible on public site, and captured in backlog
Develop personal Connection and cadence
For top customers, have a "Champ" which maintain: Regular personal contact, long-term relationship, understanding customer desires
Definition of done: live in production, collecting telemetry that examines the hypothesis which motivated the deployment
You Build It, You Love It
Live site incidents
Communicate externally and internally
Gather data for repair items & mitigate for customers
Record every action
Use repair items to prevent recurrence
Align outcomes, not outputs
You get what you measure (don't measure what you don't want)
Customer usage: acquisition, retention, engagement, etc.
Pipeline throughput: time to build, test, deploy, improve, failed and flaky automation, etc.
Service reliability: time to detect, communicate, mitigate; which customers affected, SLA per customer, etc.
"Don't" measure: original estimate, completed hours, lines of code, burndown, velocity, code coverage, bugs found, etc.
Good metrics are leading indicators
Trailing indicators: revenue, work accomplished, bugs found
Leading indicators: change in monthly growth rate of adoption, change in performance, change in time to learn, change in frequency of incidents
Measure outcomes not outputs
Get clean, stay clean
Progress follows a J-curve
Getting clean is highly manual
Staying clean requires dependable automation
Make technical debt visible on every team's dashboard
Your aim won't be perfect: Control the impact radius
Deploy one ring at a time: canary, data centers with small user counts, highest latency, th rest.
Feature flags control the access to new work: setting is per user within organization
OWASP Helsinki chapter meeting number 36 was held 12.2.2019 at Veikkaus premises in Pohjois-Haaga. The theme for this meeting was about software security and the topic was covered with two talks and with a card game. Here’s my short notes.
What Every Developer and Tester Should Know About Software Security
The event started with "What Every Developer and Tester Should Know About Software Security" by Anne Oikarinen from Nixu. The main point was that information security isn't something you can sprinkle over your applications - security needs to be baked in. Take security into account in every step of your software development process, focusing on design and development.
The talk was a great overview to software security and covered the topic from three perspectives: security requirements, threat modeling and security testing. It was nicely practical and theoretical and gave good tips to tools and how to approach the issue. The presentation slides can be seen on SlideShare.
Joakim Tauren from Visma continued the event with "Security in Agile Development"and told how they manage security in large scale. The sofware security team provides security as a service to produc teams and utilize OWASP SAMM to empower teams. The in-house built system to manage security maturity matrix was cool.
The event was wrapped up with OWASP Cornucopia - a live card game session. The idea behind Cornucopia is to help development teams, especially those using Agile methodologies, to identify application security requirements and develop security-based user stories.
The game plays like card game with six suites and cards from one to ace like normal deck of cards. Cards have security themed questions and the players try to answer in the given context if the issue at hand is a problem to be look into. In this case the context was Death Star themed with given architecture diagram.
But what does cornucopia mean? In modern depictions, the cornucopia is typically a hollow, horn-shaped wicker basket filled with various kinds of festive fruit and vegetables. In this context it would relate to can of worms :)
Have you ever wondered how to become a bug bounty hunter or wanted to organize a bug bounty program? OWASP Helsinki chapter meeting number 35 told all about bug bounty programs from hacker and organizer point of views. The event was held 6.11.2018 at Second Nature Security (2NS) premises in Keilaniemi. Here's my short notes.
Notes from OWASP Helsinki chapter meeting #35
"Hunting for bounties in a web browser" by Juho Nurminen from 2NS started the event talks and told about how to approach the issue and showed some findings in details. For the usual of understanding the technology and focusing on what you know, it's beneficial to read up prior art. Is it repeatable bug? Reproduce it in other context. The talk presented cve-2018-6033 (extension code can execute downloaded files), cve-2018-6039 (XSS in DevTools, privileged API can be overwritten) and cve-2011-2800 (data leak across origins). tl;dr; pwn things, submit crbug.com, profit.
"#OWASPHelsinki 35 started by @jupenur hunting bounties in web browsers. Understand the tech (web, js, extensions, plugin API, devtools, NaCI, WebAssembly, etc.). Focus on what you know. Read up prior art. Nice examples of bugs found. @OWASPHelsinki meetup hosted by @2NS_fi." - @walokra
In "How to become a bug bounty hunter" Iiro Uusitalo from Solita talked about bug bounty platforms and tips to be succesful. In short: POC or GTFO, recon, stay on scope, automate all the things, focus, report, wait, profit, join the community.
"How to become a bug bounty hunter, told by @iiuusit at @OWASPHelsinki meetup. Tips: poc or gtfo, recon, stay on scope, automate all the things, focus, report, wait, profit, join the community. #OWASPHelsinki" - @walokra
"Running a successful bug bounty program" by Thomas Malmberg from Hackrfi bug bounty program covered the topic from the "random dude from the other side of the table" point of view. "What really matters is finding bugs" but there's a lot of things to manage. It comes to managing expectations of hackers and program owners. And remembering that hackers work for you (program owners) but they are not your employees.
"What really matters is finding bugs.” @tsmalmbe from @hackrfi told how to run a successful bug bounty program at @OWASPHelsinki meetup. Managing expectations of hackers and program owners. Remember: hackers work for you; hackers are not your employees. #OWASPHelsinki" - @walokra
The evening ended with a panel & discussion about bug bounty with Juho, Iiro and Thomas. There was lots of interesting questions asked and here's some of them in short.
Hardware bug bounties, how to do if device not publicly available?
On premises hack days -> not so successful, too little time, concentrate on low hanging fruits.
How to choose [bug bounty] program?
Wide scope -> low hanging fruits.
What kind of reports of findings
OWASP Top 10 covers almost everything.
Everyone is scared of finding remote code execution.
Business impact findings.
Recon: who we are, what we do -> what has big business impact. Also where's the legacy code?
Impact of how hacker and product owner sees findings? Owner will set the impact, how it should happen at both ends? how to define the final impact corresponding the value?
Always estimate, run some CVSS estimator.
Use Google's approach.
Fairness and trust. Programs task is to create trust.
Awfraid of reporting found bugs when there's no bug bounty program?
Program has rules which covers legal matters. Read the rules, ask.
Top 3 negative things?
Program runner went public, lots of bugs, hackers pwned whole system.
Program runner: call on Friday night, database lost. bug bounty program to blame.
Bug bounty programs role, client and customer: public programs. -> ncss, cert-fi.
Pentesting vs. bug bounty?
You shouldn't do bug bounty if you don't have enough security maturity. Too many reports at start (duplicates, cost much, etc.), then nothing if you don't pay.
Low hanging fruits are not interesting for good hackers
Pentesting last 30 days and result is report covering certain things.
Bug bounty concentrates on specific aspect.
Bug bounty and threat model? When program open, easier for black market to find vulnerabilities?
Threat model for users? Depends on product / service you are providing.
0-day on some Finnish site selling on USA black market -> not much interest.
Pentesting should be done first.
How to improve process?
Educating the bottom of the pyramid. Hammer and nails.
Public programs generate lots of noice vs. private
Bug bounty in 5 years?
More automated things, scripts to detectivive things, AI
Bug hunter side: more professional all around the pyramid, more spam
GraphQL Finland 2018 conference was held last week (18-19.10.2018) at Paasitorni and the first of its kind event in Finland brought a day of workshops and a day of talks around GraphQL. The event was organized by the same people as React Finland and it showed, in good ways. The talks were interesting, venue was appropriate, atmosphere was cosy and after party was bookie. Here's my notes from the event.
All of the talks were live streamed and they're available on Youtube. I was lucky to get a ticket to the event and be able to enjoy the talks live. In overall most of talks were easy to comprehend although I only had some experience with GraphQL through experiments and what I had learnt couple of months ago at React Finland 2018 conference (my notes from day 1 and day 2).
"GraphQL is an open source data query and manipulation language, and a runtime for fulfilling queries with existing data. It was developed internally by Facebook in 2012 before being publicly released in 2015. It provides a more efficient, powerful and flexible alternative to REST and ad-hoc web service architectures. It allows clients to define the structure of the data required, and exactly the same structure of the data is returned from the server, therefore preventing excessively large amounts of data from being returned. - Wikipedia"
Adopting GraphQL in Large Codebases - Adam Miskiewicz
The event started with Adam Miskiewicz's story from Airbnb and incrementally adopting GraphQL. It's simple to start using GraphQL in your project but adding it incrementally and carefully in huge codebases powering large distributed systems is not quite as straightforward. The talk dived into how Airbnb is tackling this challenge, what they've learned so far, and how they plan to continue evolving their GraphQL infrastructure in the future. Towards GraphQL Native!
Going offline first with GraphQL — Kadi Kraman Kadi Kraman from Formidable Labs talked about going offline first with GraphQL. She did a nice interactive demo with React Native and Apollo 2. Users expect your mobile app to work offline and the tooling in GraphQL makes it reasonably straightforward to get your React Native app working offline. Slides
"Do this as you go and offline comes almost as a side-effect"
Life is hard and so is learning GraphQL — Carolyn Stransky
Life is hard, without documentation. Carolyn Stransky presented her story of ups and downs when learning GraphQL and documentation's role in it. The problem with GraphQL is that - because there's no "vanilla" GraphQL - there’s no central hub for all of the information and tooling necessary to learn. It's underutilized and scattered throughout our community. The talk touched on how to better enable GraphQL docs for learning and comprehension and slides pointed to good resources.
Some of the GraphQL Finland talks were quite deep in the content and as most of the talks were around 15 minutes, the pace was quite demanding. At the event I concentrated on topics which seemed most relevant and saved the rest for later. The sponsor's lounge by Gofore and Digia provided nice relaxing space to get your thoughts together. Here are the topics I saved for later.
End-to-end type-safety with GraphQL — Johannes Schickling
Talk dived deep into one of the most powerful features of GraphQL - its type-system. GraphQL can be used to enable end-to-end type-safety across any language, making your application architecture more resilient and easier to evolve.
Reason and GraphQL — Nik Graf
Using Reason's type inference you can create GraphQL servers with 100% type coverage. And Reason shines even more so on the client. Send one quick introspection request and you get full autocompletion on your schema right in the browser.
Red Hat Forum Finland 2018 was held 11.9.2018 at Finlandia-talo and it's mainline was "Ideas worth exploring. Come with questions. Leave with ideas." The event was divided to keynote and to four breakout sessions. The four breakout sessions were: 1. Automation – Ansible 2. Journey to Cloud-Native Applications with OpenShift 3. Business & Solution track 4. Half day Executive discussions and round tables. I chose to get hands-on with OpenShift but also Ansible would've been interesting. Here's my notes from the event.
Red Hat Forum Finland 2018: Ideas worth exploring
Red Hat Forum 2018 Helsinki started with keynote session by Michel Isnard from Red Hat and in "Digital transformation & the open organization" he talked about open source and how Red Hat embraces it. "Open source is collaborative curiosity, a culture with a desire to connect and the technologies to do it. Yet what draws our attention isn't the technology alone; it’s what we can do with it. It gives us the platform for imagination, a focal point to collectively push for new possibilities."
Be courageous, be open and innovate in the open.
Next there was customer reference by Markku Reinikainen from SOS International. He told us about their open innovation platform and how they have modernized their applications and moved to the mobile world.
Journey to Cloud-Native Applications with OpenShift
The main content of the Red Hat Forum event were the breakout sessions. I chose the full day hands-on workshop which showed how to modernize an existing legacy monolithic application by applying microservice architecture principles, using modern lightweight runtimes like WildFly Swarm (Thorntail.io) and Spring Boot, and deploying to container-based infrastructure using OpenShift Container Platform. The material and slides are available on GitHub.
The lab was split into four scenarios, going through the process of understanding how a developer can most effectively use Red Hat technologies in deploying a monolith to OpenShift, wrapping it with a CI/CD pipeline, developing microservices to start replacing functionality in the monolith, and integrating it all together to form the beginnings of a complete modernization of an existing app. The last scenario was about using Istio to prevent and detect issues in a distributed system.
The session started with Red Hat Application Migration Toolkit (RHAMT) and migrating (lift & shift) Java EE monolith app on WebLogic to run on JBoss EAP and OpenShift in the cloud. Crafty tool which fixed poor and non-standard choices done in legacy app.
The breakout session had also a talk from Red Hat partner. "Shift to a Cloud-First Core" talk by Capgemini told how they are approaching OpenShift projects. Different options, some are easier depending of legacy technologies. Retain, retire, migrate: lift & shift, new layers, new apps.
OpenShift hands-on session continued with developer introduction which was about live synchronization and changes, deploying to different environments, Jenkins Pipeline, Continuous Delivery and approval steps.
Third and fourth scenarios were about strangling the monolith with transforming it to microservices architecture with and without Spring Boot. Splitting up monolith to domain specific applications and connecting them. Lots of things that goes over the hill and seems magic if you're not familiar with them. You just click click click, done, profit. Some technologies used were Spring Boot and Spring Cloud, Snowdrop, Feign and Hystrix.
The last and most interesting part of the hands-on session was Istio and resilient apps and due time schedule Red Hat guy clicked and talked it through. It gave good overview to visualization, monitoring, metrics, fault injection, traffic shifting, circuit breaking, rate limiting and tracing. Time was limited so much things left to be read.
All the OpenShift scenarios used Katacoda which made the hands-on experience with just a few clicks. Crafty tool for this kind of sessions and although you just clicked through with relative fast pace. For example "Developer Introduction to OpenShift" estimated time 45-60 minutes and the lab had 23 minutes. The limited time made the hands-on experience somewhat superficial but you got the point what the possibilities are and how OpenShift works.
And last Red Hat talked about OpenShift and their services regarding application modernization. Modernization of legacy applications is in high demand and there are different paths to achieve that.
One point regarding monoliths vs. microservices was that as Martin Fowler wrotes in Monolith First.: "you shouldn't start a new project with microservices, even if you're sure your application will be big enough to make it worthwhile."
Red Hat Forum Finland 2018 was nice event and the content was interesting. The hands-on session was fast paced but you got the point and ideas worth exploring. Will look into Istio. The WiFi network had some problems but got better when more access points were added. After the official program there was some networking and drinks. Some food other than hemp snacks and vegetable chips would've been nice but Woolshed provided in that regard. Thanks for Red Hat for organizing the event and good talks.
The meetup started with Splitting React codebases for increased development speed by Hugo Kiiski from Smartly.io. He told how their Video Editor component is separated from main frontend. Code is in monorepo managed by Lerna. More tools going to be splitted. The recording of the presentation can be seen on Vimeo. (Twitter)
Use GraphQL! by Mikhail Novikov showed a quick intro to GraphQL, covered the current state of its adoption and described several ways of how to move to GraphQL. GraphQL "fills the gap between client and server developer needs and values. Matching server capabilities with client requirements." GraphQL clients to use are i.a. Apollo and Relay. See the slides for more information. The recording of the presentation can be seen on Vimeo. (Twitter)
As I mentioned the event has hosted by Smartly.io and their office in Postitalo was cosy and had nice demo room for the meetup. Also the food and beverages were nice althought the hamburger patty was a bit too raw.
OWASP Helsinki Chapter held a meeting number 34 last week at Eficode with topics of
"Perfectly secure API" and "Best friends: API security & API management". The event gave good overview to the topics covered and was quite packed with people. Eficode's premises were modern and there was snacks and beverages. And also a sauna. Here is a short recap of the talks.
Perfectly secure API
Matti Suominen from Nixu talked about perfectly secure API and things related to get there. Can API be secure? On gut feeling APIs seems to be rubbish and have problems. He covered the topic from three view points: security, risks and defense. Good starting point is to read OWASP resources like ASVS, Top 10 and Security cheat sheet. Also implement security centrally, involve business in design and DIY never works out.
Antti Virtanen from Solita talked about API security and API management and how we've traveled from dark ages to modern times. You can do API security with tools like Amazon AWS API Gateway but the main point was to step further with API management. Use some already made products like Apigee and open source alternative Tyk.io. Slides are available in Slideshare.
React Finland 2018 conference was held last week and I had the opportunity to attend it and listen what's hot in the React world. The conference started with workshops and after that there was two days of talks of React, React Native, React VR and all things that go with developing web applications with them. The two conference days were packed with great talks and new information. This is the second part of my recap of the talks and my notes which I posted to Twitter. Check out also the first part of my notes from the first day's talks.
React Finland 2018, Day 2
How React changed everything — Ken Wheeler
"Best part of React is the community"
Get started with Reason — Nik Graf
The keynote also touched Reason ML and Nik Graf went into details kicking off with the basics and going into how to leverage features like variant types and pattern matching to make impossible states impossible.
Making Unreasonable States Impossible — Patrick Stapfer
Based on "Get started with Reason" Patrick Stapfer's talk went deeper into the world of variant types and pattern matching and put them into a practical context. The talk was nice learning by doing TicTacToe live coding. It showed how Reason ML helps you design solid APIs, which are impossible to misuse by consumers. We also got more insights into practical ReasonReact code. Presentation is available on the Internet.
Conclusion about ReasonReact:
More rigid design
More KISS (keep it simple, stupid) than DRY (don’t repeat yourself)
Forces edge-cases to be handled
Reactive State Machines and Statecharts — David Khourshid
David Khourshid's talk about state machines and statecharts was interesting. Functional + reactive approach to state machines can make it much easier to understand, visualize, implement and automatically create tests for complex user interfaces and flows. Model the code and automatically generate exhaustive tests for every possible permutation of the code. Things mentioned: React automata, xstate. Slides are available on the Internet.
"Model once, implement anywhere" - David Khourshid
The talk was surprisingly interesting especially for use cases as anything to make testing better is good. This might be something to look into.
Compelling use case for state machines is: model code & automatically generate exhaustive tests for every possible permutation of the code. @DavidKPiano and surprisingly interesting talk of Reactive State Machines and Statechart at #ReactFinland. "Model once, implement anywhere" pic.twitter.com/v5iynBA4te
After theory heavy presentations we got into more visual stuff: React VR. Shay Keinan presented the core concepts behind VR, showed different demonstrations, and how to get started with React VR and how to add new features from the Three.js library. React VR: Three.js + React Native = 360 and VR content. On the VR device side it was mentioned that Oculus Go, HTC Vive Focus are the big step to Virtual Reality.
"Virtual Reality's possibilities are endless. Compares to lucid dreaming." - Shay Keinan
WebVR enables web developers to create frictionless, immersive experiences and we got to see Solar demo and Three VR demo which were lit ?.
World Class experience with React Native — Michał Chudziak
I've shortly experimented with React Native so it was nice to listen Michał Chudziak's talk how to set up a friendly React Native development environment with the best DX, spot bugs in early stage and deliver continuous builds to QA. Again Redux was dropped in favour of apollo-link-state.
Work close to your team - Napoleon Hill
What makes a good Developer eXperience?
GraphQL was mentioned to be the holy grail of frontend development and perfect with React Native. Tools for better developer experience: Haul, CircleCI, Fastlane, ESLint, Flow, Jest, Danger, Detox. Other tips were i.a to use native IDEs (XCode, Android Studio) as it helps debugging. XCode Instruments helps debug performance (check iTunes for video) and there's also Android Profiler.
React Finland App - Lessons learned — Toni Ristola
Every conference has to have an app and React Finland of course did a React Native app. Toni Ristola lightning talked about lessons learned. Technologies used with React Native was Ignite, GraphQL and Apollo Client ? App's source code is available on GitHub.
Have a designer in the team
Reserve enough time — doing and testing a good app takes time
Test with enough devices — publish alpha early
React Native Ignite — Gant Laborde
80% of mobile app development is the same old song which can be cut short with Ignite CLI. Using Ignite, you can jump into React Native development with a popular combination of technologies, OR brew your own. Gant Laborde talked about the new Bowser version which makes things even better with Storybook, Typescript, Solidarity, mobx-state-tree and lint-staged. Slides can be found on the Internet.
How to use React, webpack and other buzzwords if there is no need — Varya Stepanova
Varya Stepanova's lightning talk suggested to start a side-project other than ToDo app to study new development approaches and showed what it can be in React. The example was how to generate a multilingual static website using Metalsmith, React and other modern technologies and tools which she uses to build her personal blog. Slides can be found on the Internet.
Doing meaningful side-projects is a great idea to study new things and I've used that for i.a. learning Swift with Highkara newsreader, did couple of apps for Sailfish OS and played with GraphQL and microservices while developing app with largish vehicle dataset.
Two days full of talks of React, React Native, React VR and all the things that go with developing web applications with them was great experience. Days were packed with great talks, new information and everything went smoothly. The conference was nicely organized, food was good and participants got soft hoodies to go with the Allas Sea Pool ticket. The talks were all great but especially "World Class experience with React Native" and "React Native Ignite" gave new inspiration to write some app. Also "ReactVR" seemed interesting although I think Augmented Reality will be bigger thing than Virtual Reality. It was nice to hear from "The New Best Practices" talk that there really is no new best practices as the old ones still work. Just use them!
Something to try and even to take into production will be Immer, styled components and Next.js. One thing which is easy to implement is to start using lint-staged although we are linting all the things already.
One of the conference organizers and speaker, Juho Vepsäläinen, wrote Lessons Learned from the conference and many of the points he mentions are to the point. The food was nice but "there wasn't anything substantial for the afternoon break". There wasn't anything to eat after lunch but luckily I had own snacks. Vepsäläinen also mentions that "there was sometimes too much time between the presentations" but I think the longer breaks between some presentations were nice for having a quick stroll outside and have some fresh air. The venue was quite warm and the air wasn't so good in the afternoon.
The Afterparty at Sea Life Helsinki was interesting choice and it worked nicely although there wasn't so many people there. The aquarium was fishy experience and provided also some other content than refreshments. Too bad I hadn't have time to go and check the Allas Sea Pool which we got a free ticket. Maybe next time.
Thanks to the conference crew for such a good event and of course to my fellow Goforeans which attended it and had a great time!