The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,860 other subscribers

Archive for the ‘DevOps’ Category

Buddy (software) – Wikipedia

Posted by jpluimers on 2025/12/03

Interesting: Buddy (software) – Wikipedia

Buddy (also known as Buddy.Works) is a web-based and self-hosted continuous integration and delivery software for Git developers that can be used to buildtest and deploy web sites and applications with code from GitHubBitbucket and GitLab. It employs Docker containers with pre-installed languages and frameworks for builds, alongside DevOps, monitoring and notification actions.

On my list of things to try in case built-in GitGub and GitLab functionality does not suffice my needs any more.

I wonder how well it runs on ARM architecture.

–jeroen

Posted in Cloud, Containers, Continuous Integration, Development, DevOps, Docker, DVCS - Distributed Version Control, git, GitHub, GitLab, Infrastructure, Power User, Software Development | Leave a Comment »

Be inquisitive: a Thread by @cyb3rops on Thread Reader App – The act of hiding is often more suspicious than what’s being hidden.

Posted by jpluimers on 2025/11/19

[Wayback/Archive] Thread by @cyb3rops on Thread Reader App – Thread Reader App

If your agent gets flooded – detect the flooding.
If code gets obfuscated – detect the obfuscation.
If ETW gets silenced – detect the silence.
If the EDR gets killed – detect the killing.
If logs get cleared – detect the clearing.

The act of hiding is often more suspicious than what’s being hidden.

It’s like a surveillance camera going black or freezing.
That is the signal.
I’ve been doing this successfully for years.

I detect obfuscated crap all the time.
People ask, “What is it?”
I say, “No fucking clue. Could be:
– a Themida-packed sample with a Microsoft copyright,
– a UPX-packed ELF with a 1-char filename,
– a PowerShell script that looks like static noise, or
– a fake svchost.exe with no Microsoft copyright.”

I don’t need to know what it is.
It’s obviously shady.
That’s enough to detect it – and deal with it.
There’s a Chinese saying that fits perfectly: 欲蓋彌彰
The more you try to hide it, the more obvious it becomes.

--jeroen

Posted in Blue team, Development, DevOps, LifeHacker, Power User, Red team, Security, Software Development | Leave a Comment »

Infinite loops and the True Meaning of DevOps (Forrest Brazeal on Twitter)

Posted by jpluimers on 2025/11/05

[Wayback/Archive] Forrest Brazeal on Twitter: “Multiple people on LinkedIn have commented on this to swear they’ve seen people DELIBERATELY SHIP INFINITE LOOPS to justify their infra footprint That, my friends, is the true meaning of DevOps”

which was sparked because of comments on his [Wayback/Archive] Forrest Brazeal on Twitter: “Not all “utilization” is created equal…” cartoon:

Read the rest of this entry »

Posted in Development, DevOps, Infrastructure, Software Development | Leave a Comment »

Kevlin Henney on “configuration is code” in his essay “Out of Control. An essay on paradigms, refactoring…”

Posted by jpluimers on 2025/07/31

For my link archive [Wayback/Archive] Out of Control. An essay on paradigms, refactoring… | by Kevlin Henney | Dec, 2020 | Medium.

Neither because Kevlin describes how to refactor a basic algorithm to convert Roman numerals into Hindu-Arabic numerals (in part by using the fact that an if statement can be considered a bounded case of a while loop), nor because he splits the resulting algorithm in coded data and coded statements, or because he mentions the [Wayback/Archive] Gilded Rose Kata but because well, you should just read it in full.

Remember though: Read the rest of this entry »

Posted in Configuration Management, Development, DevOps, Power User, Python, Scripting, Software Development | Leave a Comment »

The Twelve-Factor App

Posted by jpluimers on 2024/11/21

Still relevant: [Wayback/Archive] The Twelve-Factor App and [Wayback/Archive] 12 Fractured Apps — Medium

Once Docker hit the scene the benefits of the 12 Factor App (12FA) really started to shine. For example, 12FA recommends that logging should be done to stdout and be treated as an event stream. Ever run the docker logs command? That’s 12FA in action!

Via

–jeroen

Posted in Back-End Development, Cloud Development, Communications Development, Conference Topics, Conferences, Deployment, Developing scalable systems, Development, DevOps, Distributed Computing, Event, Software Development | Leave a Comment »

Some lessons to learn from the CrowdStrike debacle

Posted by jpluimers on 2024/08/20

About a month from International CrowdStruck Day, just a few thoughts, more likely to follow:

  • How well does your infrastructure behave when none of your Windows machines can boot?
  • How well is your out-of-band management?
  • How well is your CMDB doing key management, for instance for BitLocker encryption?
  • Is checkbox compliance more important than a single point of failure?
  • Can you ensure all updates from your supply chain are staggered/staged/phased with a kill switch when things get out of hand?
  • Are the worst case scenarios in your disaster recovery plans really the worst?
  • Do you understand the human factor of large scale outages (both of the people that – often indirectly – triggered them – hello #HupOps – and the ones that cannot work because of them)?
  • Do you value your people – especially the ones that pulled you out of this situation – enough, and did you rename your Human Resource department into something that is more friendly to your people?
  • Do you realise this could have happened on any of the platforms you use, including Linux and MacOS?
  • If you were mentioned in the media by not recovering well, do you have any idea how much a target you will be from adversaries?
  • Did CrowdStrike finally show some real postmortem instead of the half-hearted communications they did mostly after the weekend following the debacle?
  • How does your organisation perform dates of critical files?
  • Would other platforms be less or more risky? If so: why?
  • Will eBPF solve most of this, or at least centralise the issues and what consequences would that have?

Read the rest of this entry »

Posted in Configuration Management, DevOps, HugOps, Infrastructure, Power User, Windows | Leave a Comment »

Software development dice

Posted by jpluimers on 2024/03/06

D20 shaped dice can be handy for software development blame…

Via [WayBack] Amy Renee on Twitter : “When you need to roll for blame in IT… 😂❤️… “

[WayBack] rachel binx on Twitter : “… “:

 

–jeroen

Read the rest of this entry »

Posted in Development, DevOps, Software Development | Leave a Comment »

Ookla speedtest CLI for Windows has some undocumented arguments to accept license and GDPR

Posted by jpluimers on 2023/10/11

I had speedtest-cli running on MacOS and various Linux machines, but not yet on Windows (see for instance my post Ubuntu: Fixing the myserious “Failed to stop apt-daily.timer: Connection timed out”).

[Wayback/Archive] Install and Test Internet Speed with Speedtest CLI Command Line – NEXTOFWINDOWS.COM reminded me there is a Speedtest CLI for Windows download at at [Wayback/Archive] Speedtest CLI: Internet speed test for the command line, but I am a an automation/scripting/devops person, so luckily there are also [Wayback/Archive] Chocolatey Software | Speedtest by Ookla (don’t get [Wayback/Archive] Ookla.Speedtest download, as that is the GUI version).

Both the Chocolatey and winget packages are named the same, so that is quite confusing. This is how I have set them apart:

Read the rest of this entry »

Posted in *nix, *nix-tools, Batch-Files, Chocolatey, DevOps, GDPR/DS-GVO/AVG, Internet, ISP, KPN, Notepad++, Power User, Privacy, Scripting, SpeedTest, Windows, xs4all | 2 Comments »

The CPU load average metric often is not a good one to alert on

Posted by jpluimers on 2023/04/20

Boy I wish threads with more than one person could be saved by the ThreadReaderApp.

Anyway:

[WayBack] Thread by @mipsytipsy: oh boy.. i was just idly musing over how the single most ubiquitous/useless metric is “CPU load average”, lol i wonder if you could use CPU…

oh boy.. i was just idly musing over how the single most ubiquitous/useless metric is “CPU load average”, lol

i wonder if you could use CPU load alerts to score how modern and powerful a team’s toolchain is, like a Waffle House Index for tooling. 🤔

 

…oh oh! but i was gonna say, this thread between @drk and @shelbyspees is a killer nanotutorial in how to ask better questions about your code — where to start, how to drill down and dig in, how to instrument, and how to approach such an open-ended exploratory jaunt. 👏🐝❤️

it’s a really good illustration of this thing we end up saying all the time, which is “don’t fear the future, it is simpler and clearer and *easier* here! the way you are doing it NOW is the hard way!” 😖

time for cpu load average to go the way of the PC LOAD LETTER …

0:00
/ 0:01

 

 

Read the rest of this entry »

Posted in *nix, Cloud, Development, DevOps, Infrastructure, Power User, Software Development, Systems Architecture | Leave a Comment »

Does it still hold: “Never keep anything important on AWS in US-EAST-1”?

Posted by jpluimers on 2023/01/31

Reminder to self to check if this still holds: [Archive] Varun Krishnan on Twitter: “Never keep anything important on AWS in US-EAST-1” / Twitter

Slightly more than a year ago, the Amawon Web Services region US-EAST-1 collapsed with world-wide downtime consequences for many AWS services. It took some 8 hours to recover most of the services.

Before that, it was plagued with outages, maybe because it was their first ever region:

The outage was covered many times. I have included this El Reg link, as I like their tone of voice: [Wayback/Archive] AWS technical woes in US East region cause widespread outage • The Register.

Basically, any cloud stack is founded on these three layers:

  • Storage (S3 or Simple Storage Service in AWS speak)
  • Compute (EC2 or Elastic Compute Cloud in AWS speak)
  • Authentication and Authorisation (IAM or Identity and Access Management in AWS speak)

On top of that, any other services are implemented. And for Amazon Web Services, many of these have become available over the last two decades.

Indeed Anders Borum was right in his tweet: US-EAST-1 is the first ever AWS EC2 region and started in 2006, more than 15 years ago. It is also the region with the largest capacity. Likely both play a role in US-EAST-1 being part or initiating factor in many of the major AWS outages. If you look in all AWS outages, US-EAST-1 plays a role in most if not all outages since 2017,

So for now, if hosting at AWS, I would host outside of US-EAST-1.

Depending on the kind of application and money involved, I would consider hosting in multiple regions, and if a truckload of money was involved: hosting on multiple clouds.

I fully agree with [Archive] Gergely Orosz on Twitter: “If you were impacted by the recent AWS outage, the decision to invest in multi-cloud / multi-datacenter is simple: How much did this outage cost you vs the cost of adding a (lot) more complexity & maintenance with multi-cloud/DC? If outage cost >> this, only then do it.” / Twitter

Some more insight on multi-cloud hosting is via [Archive] Redmond on Twitter: “New feature from @jdanton: A full post-mortem from AWS is still to come, but in the meantime, IT pros should start bolstering their cloud disaster recovery strategies now — before the next outage. https://t.co/ios5Re5ZCs” / Twitter at [Wayback/Archive] AWS Outage Fallout: What Lessons You Should Learn — Redmondmag.com

Is It Time to Go Multicloud?

No. Well…if you are running a major property with a big customer-facing presence, it can be a good strategy to have static Web and app content hosted in a second cloud. In the case of an outage like yesterday’s, you’d have the option to direct traffic to the static presence, which can supply some level of experience for your users.

A good example of how this approach can be useful is an outage dashboard. Whenever a cloud provider has an outage, they are notoriously bad at properly reporting ongoing status. This is because they have hosted their dashboards in their own clouds using their own APIs — and when these APIs go down, they take the monitoring with them. Using DNS, you can quickly redirect traffic to this static site, where your engineers can update the page with status updates.

Related

–jeroen

Read the rest of this entry »

Posted in AWS Amazon Web Services, Cloud, Cloud Development, Deployment, Development, DevOps, Infrastructure, Power User, Software Development | Leave a Comment »