Monthly Notes 55

It's a new year and let's start it with Monthly notes. Something new and something old from the short tech notes. Let this year be good!

Issue 55, 5.1.2021

Tools of the trade

Awesome CI
List of Continuous Integration services. There's a bunch of them to choose, my favorites are: GitHub Actions, Circle CI, Google Cloud Build, Drone CI.

Alternatives to JIRA which is moving to cloud only:
Asana
ClickUp
Linear
Redmine

Ignore node_modules in BackBlaze

PostgREST
"PostgREST serves a fully RESTful API from any existing PostgreSQL database. It provides a cleaner, more standards-compliant, faster API than you are likely to write from scratch." (from hackernewsletter)

alyssaxuu/screenity
"Screenity is a feature-packed screen and camera recorder for Chrome. Annotate your screen to give feedback, emphasize your clicks, edit your recording, and much more." (from Weekend Reading)

Foam
"Foam is a personal knowledge management and sharing system inspired by Roam Research, built on Visual Studio Code and GitHub."

Web Development

Integrate the Web Share API into our websites
"Use the Web Share API instead of these ugly lists of social icons. We should take care that our products support the native frameworks to make the web a better place." (from WDRL 285)

Sass vars, CSS vars, and semantic theme vars
"How we should define semantic variable names in the age of light and dark themes." (from WDRL 285)

Apple now lets us integrate Face ID and Touch ID on the web
"Building it on top of the Web Authentication API. Imagine how this can improve the logging in experience for a good part of your user base."

Work life

A Day in the Life of an Engineering Manager
"Engineering Manager is one of the roles that most people don’t know exactly what it’s about and what these people do. Karl Hughes explains what he does all day and it turns out it’s a role full of soft skills like networking, explaining things or translating between two people, between company departments and to raise awareness around delivery, around process management and recruiting as well as people’s happiness in their jobs." (from WDRL 285)

Development

Collection of tips for note taking by Dr. Sam Ladner
"This is a great collection of tips for note taking. For user research, design reviews, board meetings, whatever". (from Weekend Reading)

How to Make Your Code Reviewer Fall in Love with You
"Value your reviewer’s time". tl;dr; Start with these and read the article for more:

  • Review your own code first
  • Write a clear changelist description
  • Automate the easy stuff
  • Answer questions with the code itself
  • Narrowly scope changes
  • Separate functional and non-functional changes
  • Break up large changelists

Cloud

Monitoring & securing AWS with Microsoft
"Interesting approach, how to setup (advanced) monitoring of AWS with Azure Security Center (CSPM), Azure Defender (CWPP), Cloud App Security (CASB), and Azure Sentinel (SIEM)." (from Cloud Security Reading List)

Learning

How I read books: setting up a new system
"Knowledge is much more valuable when we can act on it, and change our behavior."
tl;dr; Active learning / reading; Processing and reflecting; Repeating; Presenting; Taking action. (from HackerNewsletter)

Things you're allowed to do
"This is a list of things you’re allowed to do that you thought you couldn’t, or didn’t even know you could."

Short notes on tech 52/2020

Week 52, 2020

Code

Learning

Stop using Material Design text fields!
"But Google uses it!" — yeah, that’s not a good enough reason. (from Weekend Reading)

Collection of tips for note taking by Dr. Sam Ladner
"This is a great collection of tips for note taking. For user research, design reviews, board meetings, whatever". (from Weekend Reading)

Tools

EStimator 
"Calculate how much you can save by switching your website to modern JavaScript." (from Weekend Reading)

An Instant GraphQL API Using Google Sheets
"The takeaway is, skip the complicated and under-documented Google Sheets API, and use the Google Charts Visualization API instead." (from Weekend Reading)

Something different

The 'Japanese Bob Ross': How a 73-year-old artist took YouTube by storm
(from hackernewsletter)

Short notes on tech 51/2020

Week 51, 2020

Cloud

AWS launches new managed services: Announcing Amazon Managed Service for Grafana (in Preview) and Amazon Managed Service for Prometheus.

Monitoring & securing AWS with Microsoft
"Interesting approach, how to setup (advanced) monitoring of AWS with Azure Security Center (CSPM), Azure Defender (CWPP), Cloud App Security (CASB), and Azure Sentinel (SIEM)." (from Cloud Security Reading List)

Development

Can developer productivity be measured?
"Defining and measuring programmer productivity is one of the most difficult parts of an engineering manager or CTO’s job description. When everything you do is intangible, how should you measure it? Can it be measured at all?"

The CSS Mindset
"You need a certain mindset to write good CSS."

How to Make Your Code Reviewer Fall in Love with You
"Value your reviewer’s time". tl;dr; Start with these and read the article for more:

  • Review your own code first
  • Write a clear changelist description
  • Automate the easy stuff
  • Answer questions with the code itself
  • Narrowly scope changes
  • Separate functional and non-functional changes
  • Break up large changelists

Software

Chrome is bad
tl;dr; "Google Chrome installs Keystone on your computer, which makes your whole computer slow even when Chrome isn't running. Deleting Chrome and Keystone makes your computer way, way faster, all the time." Alternative facts about the issue from Hacker News.

Learning

The Modern JavaScript Tutorial
(from HackerNewsletter)

How I read books: setting up a new system
"Knowledge is much more valuable when we can act on it, and change our behavior."
tl;dr; Active learning / reading; Processing and reflecting; Repeating; Presenting; Taking action. (from HackerNewsletter)

Something different

The Donut King who went full circle - from rags to riches, twice
(from HackerNewsletter)

Short notes on tech 50/2020

Week 50, 2020

Cloud

Wait, Docker is deprecated in Kubernetes now? What do I do?
tl;dr; Use CRI runtimes instead: containerd or CRI-O.

Google Cloud: default container runtime to change to Containerd with GKE node version 1.19 and higher.
"As the Docker container runtime will be removed from the Kubernetes project in the future, GKE is beginning a migration to the Containerd runtime. Support for the Containerd image variants became Generally Available in GKE in September 2019." See: Using containerd images

A better Kubernetes, from the ground up
"What we would do differently if we built something new, from the ground up, with no regard for compatibility with Kubernetes?" (from Cloud Security Reading List)

DevOps

Travis CI is no longer providing CI minutes for open source projects
The move from Travis CI to other (more OSS friendly) Continues Integration services has been seen for some time and this will accelerate it. The popular choices are: GitHub Actions, Circle CI, Google Cloud Build, Drone CI.

AWS Lambda now supports container images as a packaging format
You can now package your functions as container images and use familiar container development tools to build Lambda applications. (from Cloud Security Reading List)

Monitor and secure your containers with new Container Threat Detection
Google announced the general availability of Container Threat Detection (a built-in service in Security Command Center Premium tier) to help monitor and secure container deployments in GCP. (from Cloud Security Reading List)

Programming

Advent of Code
Reminder that the Advent of Code is again here with programming puzzles.

PostgREST
"PostgREST serves a fully RESTful API from any existing PostgreSQL database. It provides a cleaner, more standards-compliant, faster API than you are likely to write from scratch." (from hackernewsletter)

public-apis/public-apis
A collective list of free APIs for use in software and web development. (from Weekend Reading)

Learning

The UI & UX Tips Collection: Volume One
"Collection of my popular UI & UX tips from the past 12 months that can, with little effort, help improve both your designs, and the overall user experience." (from Weekend Reading)

Something different

Chess tactics explained
If you watched the The Queen's Gambit miniseries and got interested of playing it, the Chess tactics explained gets you started with more than just basic rules. (from hackernewsletter)

NoCode tools
"Discover the best tools to build software, no code required"

Short notes on tech 49/2020

Week 49, 2020

Development and Operations

Using SSL certificates from Let’s Encrypt in your Kubernetes Ingress via cert-manager
Walkthrough of the process of automating the issuance and renewal of certificates provided by Let's Encrypt for Kubernetes Ingress using the cert-manager add-on. (from cloudseclist.com)

Use Amazon EC2 Mac Instances to Build & Test macOS, iOS, ipadOS, tvOS, and watchOS Apps
"Powered by Mac mini hardware and the AWS Nitro System, you can use Amazon EC2 Mac instances to build, test, package, and sign Xcode applications for the Apple platform including macOS, iOS, iPadOS, tvOS, watchOS, and Safari." The downside of this is that "The instances are launched as EC2 Dedicated Hosts with a minimum tenancy of 24 hours" which is due Apple EULA and thus one CI build costs about $26. And what I read from HN the real viable option is still to use MacStadium.

Tools of the trade

cloudquery
"cloudquery transforms your cloud infrastructure into queryable SQL tables for easy monitoring, governance and security." (from cloudseclist.com)

k8s-security-policies
"Repository providing a security policies library that is used for securing Kubernetes clusters configurations. The security policies are created based on CIS Kubernetes benchmark and rules defined in Kubesec.io." (from cloudseclist.com)

alyssaxuu/screenity
"Screenity is a feature-packed screen and camera recorder for Chrome. Annotate your screen to give feedback, emphasize your clicks, edit your recording, and much more." (from Weekend Reading)

Miscellanous

Why Apple's replacement for Intel processors works really, really well
"They added Intel's memory-ordering to their CPU. When running translated x86 code, they switch the mode of the CPU to conform to Intel's memory ordering."

Short notes on tech 48/2020

Week 48, 2020

Tools of the Trade

Next.js 10
Built-in Image Component and Automatic Image Optimization, Internationalized Routing, Next.js Analytics, React 17 Support.

Node.js 15
Throw on unhandled rejections, pm 7 includes yarn.lock file support, peer dependencies are now installed by default, V8 8.6.

kachkaev/njt
"njt (npm jump to): a quick navigation tool for npm packages". This is super useful: njt react h brings the home page, njt graphql g takes you to GitHub, other jump points include changelog, source code, issues, and more.

Coding Fonts
A microsite that shows off fonts specifically designed for writing code.

Upptime
Open source uptime and status page system, powered entirely by GitHub Actions and Issues.

Gitlint
Git commit message linter (for Linux and Mac, experimental on Windows), that checks your commit messages for style.

Alternatives to JIRA which is moving to cloud only:
Asana
ClickUp
Linear
Redmine

Nova app from Panic
Native code editor for Mac.

Microsoft Clarity is out of beta
Tool for visualizing user experience. Click and scroll heatmaps, individual session replay, rage clicks metric, and more.

Apple

Does it ARM?
"Apps that are reported to support Apple Silicon"

Accessibility

Atkinson
New free and hyperlegible font published by the Braille institute.

Web

Apple now lets us integrate Face ID and Touch ID on the web
"Building it on top of the Web Authentication API. Imagine how this can improve the logging in experience for a good part of your user base."

Monthly notes 54

Working from home continues as COVID-19 still surges and if you yet haven't checked your video call capabilities, read the How to make video calls almost as good as face-to-face article. The remote working isn't going away as this year has shown that pendeling to offices every day isn't really needed.

Issue 54, 6.11.2020

"Nobody gets hacked"

Working from home

Companies plans for remote work going forward
Twitter thread by Chris Herd of what he learned by speaking to 1,000 companies over the last 6 months about their plans for remote work going forward. Office space going down; flexi-work; people working too hard; burnouts; asynchronous communication is difficult; invest to ergonomic working equipment; workers will be happier as a result of remote work; need tools to track output; documentation is the unspoken superpower of remote teams; coaching and facilitators are needed;

How to make video calls almost as good as face-to-face
How much nicer video calls would feel if the problems with low-quality microphones and webcams, lag and such would be solved? The post summarizes what can be done by fiddling with gear and software. TL;DR; Get away from other people; Throw your wireless headset in the trash; Don’t mute; Get a better microphone; Listen to yourself; Improve your lighting; Use your real background; Don’t bother with webcams;

Docker and Kubernetes security

Dockerfile Security Best Practices
List of common security issues and how to avoid them. For every issue there's an Open Policy Agent (OPA) rule ready to be used to statically analyze your Dockerfiles with conftest. TL;DR; Do not store secrets in environment variables; Only use trusted base images; Do not use ‘latest’ tag for base image; Avoid curl bashing; Do not upgrade your system packages; Do not use ADD if possible; Do not root; Do not sudo;

Docker Threat Model

The Current State of Kubernetes Threat Modelling
"If you are planning on using Kubernetes in production, one of the key things to consider from a security perspective is your threat model."

Arsenal of Cloud Native (Security) Tools
Marco Lancini's curated list of tools he finds useful, alongside a quick “usage” guide for each one of them. i.a.: Docker Bench, kube-bench, kube-hunter, AWS Security Benchmark,

Something different

2020 UCI Cycling eSports World Champs heads to Zwift’s Watopia in December
"2020 UCI Cycling eSports World Championships are set to take place on virtual ride platform Zwift in their online Watopia environment. Garmin-Tacx will supply all of the connected trainer for with elite men and women to race each other virtually"

Monthly Notes 52

Issue 52, 9.9.2020

Software development

Field Ops Guide
"The Field Ops Guide (by Futurice) is a booklet that makes it possible to survive a software development project. It's a distillation of years of wisdom gathered working in client projects."

Kubernetes

Threat matrix for Kubernetes
"While Kubernetes has many advantages, it also brings new security challenges that should be considered. Therefore, it is crucial to understand the various security risks that exist in containerized environments, and specifically in Kubernetes."

Docker

Faster Builds and Smaller Images Using BuildKit and Multistage Builds
"Multistage builds feature in Dockerfiles enables you to create smaller container images with better caching and smaller security footprint. In this blog post, I’ll show some more advanced patterns that go beyond copying files between a build and a runtime stage, allowing to get most out of the feature."

Tools

img
"Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder."

GraphQL Voyager
"Represent any GraphQL API as an interactive graph."

SQL diagrams

Something different

Cheating in eSports: How to cheat at virtual cycling

Monthly notes 51

It's August and after summer holidays it's time to get back to monthly notes. If you read only one note, check the "Some important things to keep in mind when you work remotely" which has good tips also in general. Happy reading :)

Issue 51: 2020-08-07

Kubernetes

How to gracefully shut down Pods without dropping production traffic in Kubernetes?
If you've ever noticed dropped connection after a rolling upgrade, read Daniele Polencic Twitter thread which digs into the details with detailed pictures.

Web development

Prevent Info leaks and enable powerful features: COOP and COEP
"Cross-Origin Embedder Policy (COEP) and Cross-Origin Opener Policy (COOP) isolate your origin and enable powerful features." The video by @agektmr helps you understand how it works and why this is important. Unlock access to new perf API's to help you identify JS bottlenecks, memory leaks, and more. (from @igrigorik)

How To Setup Your Local Node.js Development Environment Using Docker
(from @Docker)

Web Stories are coming to WordPress!
Web Stories are tappable, engaging visual stories brought to the web. They’re powered by AMP technology. (from @pbakaus)

Working remotely

Some important things to keep in mind when you work remotely
Check the Twitter thread for 10 great tips for working remotely. They are also good tips also in general. I've also found the tip 8. be great. Writing notes and making (public) blog posts of them helps you to process new information better and also help other developers. Documentation is often undervalued and it takes time to do it correctly.

Software development

It's probably time to stop recommending Clean Code
"There is a growing movement against Rob Martin's books (e.g., Clean Code). After reading the article, I have to agree with a lot of it, but I also hope that this movement doesn't push too far to the other side." (from @maybeFrederick) My take is that don't believe everything you read be it on a book or nowadays in the Internet. Use your own thinking and reasoning. "Clean Code" has good points and suggestions but also goes a bit overboard with how "clean" things should look.

Tools

Boop
"Boop is a place to paste text, and transform it using basic operations. The goal is to allow quick experimentation and avoid using random websites to do that stuff. It's super useful when working with logs, JSON data, etc." (from @OKatBest). This is what I've always needed. No more searching for online tool for a specific task (or looking it from tiny-helpers.dev which is a great collection).

Git-bug
Fully embedded bug-tracker in git: you only need your git repository to have a bug tracker.

Something different

Remy Metailler Smashes Squamish Mountain Bike Trails

Following a Pro Enduro Racer Down Whistler's Hardest Trails // Wyn Masters

Monthly notes 50

Issue 50, 15.6.2020

Serverless

AWS Lambda — should you have few monolithic functions or many single-purposed functions?
Interesting question of if single responsibility principle (SRP) should be followed in the serverless world. What is a “function” if not SRP? TL;DR; many single-purposed functions are better.

Stories

Twitter search of "telling early-in-career engineers stories of times you messed something up real bad is a good way to help them combat their own impostor syndrome." from (@ElleArmageddon)

Kubernetes

In Kubernetes, what should I use as CPU requests and limits?
Good Twitter thread of what are the difference of requests and limits.

How should I answer a health check?
Explains how to use liveness and readiness probes (on Kubernetes). Heard that liveness probe should be always off unless there’s a bug in app which it can’t recover. And long checks can be cached.

Managed Kubernetes Price Comparison (2020)
"TL;DR: Azure and Digital Ocean don’t charge for the compute resources used for the control plane, making AKS and DO the cheapest for running many, smaller clusters. For running fewer, larger clusters GKE is the most affordable option. Also, running on spot/preemptible/low-priority nodes or long-term committed nodes makes a massive impact across all of the platforms."

Learning

Performance profiling for Web Applications with Sam Saccone
"How to use Chrome DevTools to understand a Web application's performance bottlenecks. Goes over a few different workflows that will help us to answer the question "Why is this slow and how can I fix it"."

Tools

OpenSnitch
GNU/Linux port of the Little Snitch application firewall. (from Hacker Newslettter #490, comments)

Kubectl-debug
kubectl-debug is an out-of-tree solution for troubleshooting running pods, which allows you to run a new container in running pods for debugging purpose (examples). The new container will join the pid, network, user and ipc namespaces of the target container, so you can use arbitrary trouble-shooting tools without pre-installing them in your production container image.

Lighthouse audit add-on for Firefox
"Report, Performance, Accessibility, PWAs, SEO scores for any public site. Without opening DevTools."