ProDevOps

Well nobody cares about data breaches in India. Leaks are a feature, not a bug.

I once criticized CERT-In on LinkedIn and got calls from terrified employers (past & then present) asking me to remove it. I said no and proceeded to change all my employment history to ‘Confidential’ to ease their worries. The reason they panic is because they don’t want to lose their “CERT-In Empanelment”. CERT-In Empanelment is one of the biggest scams in the Indian cyber security industry. CERT-In makes you go through several stages of tests (all worthless btw) and then “certifies” you as an empaneled auditing firm. This status then allows you to bid on government contracts for cyber security projects along with enabling you to serve compliance customers under regulatory bodies. If, for whatever reason, CERT-In decides to revoke this empanelment, the firm would lose majority of its business. That’s how CERT-In keeps all the major cyber security firms in India under their thumb.

that hacker who tweeted. Is his claim reliable?

Hey @ecovacsrobotics, @excitel_rocks ecovacs.com (resolves to all.ecovacs.com.a1.initww.co…) isn't reachable from a few ISPs like Excitel in India. Excitel resolves that to 43.109.97.45 & times out, whereas Airtel resolves to 155.102.2.162 & works. Check your DNS!

Today is another package-lock.json appreciation day! - Make sure you always commit your project with the package-lock.json file. It is the ONLY version locking enforcement mechanism. - Use npm ci instead of npm install. The first one will work ONLY if package-lock.json exists. - If you need to update or pull new packages, use the --min-release-age flag (available since npm v11.10.0) to make sure you only install updates, which are at least 7 days old: npm install --min-release-age=7 Or hardcode this setting into your .npmrc file: min-release-age=7 There will be more malicious updates to popular npm packages in the future, driven by supply chain attacks. It's just the beginning. Thankfully, they will be caught in the first 24 hours. The npm ecosystem is broken by design. Adapt and act accordingly. Stay safe out there!

We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too. Full story: blog.calif.io/p/mad-bugs-vim…

Conspiracy theory: They leaked it so that real humans can finally review the code. Since they do not read or review the code themselves at all. Now they ask us to do it for them for free.

NASA writes mission-critical flight software in C. And the rules are absolutely INSANE. > No recursion. Ever. > Every loop must have a provable upper bound. > No dynamic memory allocation after initialization. > Max ~60 lines per function. > Minimum 2 assertions per function. > Every return value must be checked. > Zero compiler warnings allowed. > Daily static analysis. Zero warnings there too. > No function pointers. > Restricted pointer dereferencing. This is how they write code at NASA / JPL for mission-critical systems.

I reduced my cloud bill from +$8000/m to ~$900/m. The two biggest AWS cost drivers: - Database and compute. And it's such an easy cost trap to avoid. If I had to start over today, there is *one* service I would prioritize the highest: DynamoDB. For years, I thought DynamoDB was both brilliant and convenient. - Schemaless - Serverless - Cheap What's not to like? Well, turns out, it's only cheap for a while. And the schemaless nature of DynamoDB quickly starts working against you... Instead, I ditched DynamoDB and went with some boring old tech. Let me explain 👇

My call hours everyday, as a hiring specialist. It's not easy recruiting.

2 servers.                          8 CPUS.                                              Processing 8 billion ticks per day. Under 2 milliseconds.   Running at 20% CPU utilization.  Sometimes the best infrastructure is the one you build yourself.  That's our market feed data infrastructure at Sahi. This processes high speed feeds from the Exchanges and builds the critical data products that power your trading experience on Sahi.                                            Rather than throw hardware at the problem, our engineering team relied upon thoughtful architecture choices:                                                                                                         → Lock-free Rust actors                                                                                                               → Pre-serialized message caching                                                                                                          → Time-bucketed partitioning                                                                                                            → Token-aware database routing                                                                                                                                                                                                          Full technical deep-dive:                                                                                                              sahi.com/blogs/from-exchange…  @Sahi_HQ

1. Get your fundamentals right. 2. Network for long term. 3. Be well spoken, mild mannered. 4. Improve your articulation skills. 5. side projects are extremely helpful in early career, it allows you to showcase your learning ability, interest and agency. 6. Learn the art of marketing yourself. 7. Be visible in social media - if you can.

I was inspired by this so I wanted to see if Claude Code can get into my Lutron home automation system. - it found my Lutron controllers on the local wifi network - checked for open ports, connected, got some metadata and identified the devices and their firmware - searched the internet, found the pdf for my system - instructed me on what button to press to pair and get the certificates - it connected to the system and found all the home devices (lights, shades, HVAC temperature control, motion sensors etc.) - it turned on and off my kitchen lights to check that things are working (lol!) I am now vibe coding the home automation master command center, the potential is 🔥.And I'm throwing away the crappy, janky, slow Lutron iOS app I've been using so far. Insanely fun :D :D

every time I entertain that idea my mind is blown, but it's the most accurate model I came up with for thinking about k8s think about this for a few minutes: kubernetes provides you with a type system for managing your infrastructure much like a programming language does, but instead of integers, characters and strings, you get services, deployments and pods and just like in a programming language you can have custom types in the form of CRDs every single thing you have in your cluster is wrapped in a type and that's very important because it makes it very clear what is running inside the cluster and what it can do combined with a runtime whose job is to continuously reconcile your declared resources (each with its own type btw) into actual workloads that's the moat of kubernetes it's not the container orchestration part and it never has been