Posts

Originally published on DEV Community. I run a decent little stack of services out of my house. Whisper (an end-to-end encrypted secret sharing app), bar_keep, archivist, a few other side projects, plus the base infra that ties them together: Traefik, shared networks, a handful of private stacks. For a while every deploy meant SSHing into the server, and I was pretty tired of it. What I actually wanted was something like the popular GitOps tools a lot of folks run on top of Kubernetes. Push code, get a deploy, done. No shell, no secrets on disk, no kubectl. But I’m not running Kubernetes at home and I wasn’t about to install it just for this, so I took a different route. ...

Originally published on Let’s Encrypt. Nick Silverman is a Senior Infrastructure Engineer on the Edge Infrastructure team at Shopify, where he maintains the systems that provision, renew, and publish SSL certificates for millions of merchants’ custom domains. He is also a contributor to the Ruby acme-client gem. The challenge Shopify’s automated certificate management system relied on a static renewal threshold: 30 days before the end of the 90-day lifetime. To spread the load of provisioning and renewing certificates, we implemented a random 0–72 hour delay for each. While this helps evenly distribute certificate management over time, it did not take into account the Certificate Authority’s (CA) load. It was also incapable of reacting to a dynamic renewal window based on information provided by the CA. ...

Originally published on AWS for Industries. By Nick Silverman, Jigna Gandhi, Kim Fushimi, and Randy Moy. Containerization becoming popular for application lifecycle In the retail industry, more and more developers are using containerization as the primary software lifecycle for applications and services. There are countless benefits to this approach, and it shifts the focus of configuration and runtime management to the container itself. This means that there’s much less configuration and setup at the host level. However, you still need to consider patching and security at the host. ...

Originally published on DEV Community. The latest Ruby runtime for AWS Lambda runs Ruby 2.7. Though this version of ruby is only 6 months old, the version of OpenSSL that Lambdas instance of Ruby was compiled with is over 3 years old. You can verify that by running the function below and seeing what it returns: require 'openssl' def lambda_handler(event:, context:) return OpenSSL::OPENSSL_VERSION end # OpenSSL 1.0.2k 26 Jan 2017 That’s Old! That means that Ruby’s OpenSSL library is missing some key features like SHA-3, TLS 1.3, and the scrypt KDF. ...