Tim Obezuk

There has been a lot of hype around the Rust programming language. Most articles and blogs I read are heavy on promises, and a little light on testing. I’ve done a simple comparison between a lambda written in Python vs the same lambda written in Rust. Both use the official AWS SDKs. Boto3 is well established but the Rust SDK is new. The official release was about 8 months ago at reinvent. I’ve load tested both using K6. Why? Well, because I want to see for myself if I really do get the 8x improvement in performance and equivalent reduction in cost that people promote. What were the results? Come along and find out! https://lnkd.in/gfzVfDXY

8

10 Comments

Next up we have the crazy and always hilarious Paul McCarty. Paul will he presenting "Repo Swatting: How to delete anyone's source code repository anonymously". Paul will discuss a new attack called Repo Swatting identified in major SCM providers including GitHub, GitLab, and Gitea. He identified the attack and theorized that it could be weaponized to take developer resources offline. He was correct. Swatting is a terrible practice as it allows malicious attackers to target unsuspecting, innocent people by using law enforcement as a directed weapon. Join Paul to learn more about this attach and how he found it. https://lnkd.in/gqPDu9Ca #BSidesMelb2024

24

After 11 years of running a software engineering company, particularly collaborating with clients who had their own engineering teams, I realized that clearly defining how you add value and how the client perceives that value is crucial—especially when that value drives the growth of both companies. In March 2013, we began working with an Australian client that had its own internal engineering team, which we needed to collaborate with. At the time, we were two years into our operations—young, Black, fresh university graduates given a big opportunity. Since then, we've worked with large telecom companies, banks, startups, and Fortune 100+ companies. At this stage of our business, doing things just for the sake of revenue without delivering clear value no longer works. For example, one way we add value is by being equally invested in the client's product because we see a commercially viable opportunity for both of us. Another example is helping to significantly reduce the client's overall capital expenditure. We've put together a list of strategies that can assist engineering teams from different firms. You can find the link in my first comment. Please feel free to share your experiences to help us or others in the community.

34

1 Comment

I've been terrified to share this. Doing a #RubyConf Australia talk is scary enough, but having your nerves, jitters and slightly quaking voice encoded to video is something else. 😬 But the subject is something I'm really passionate about: helping developers build their own products, and then—the hardest part—actually get users for them. I've shared the talk below (*gulp*), but here are the main takeaways I want to get across: 1. I think every software dev has the learning and problem-solving ability needed to take their own product to market. 2. Devs are great at building and launching stuff. But the marketing side... not so much! 3. That's because as developers, we have a lot of negative biases toward marketing: that it's pushy, scammy, interruptive, bad. 4. But this is actually because most marketing is bad, not because marketing is inherently bad. 5. A helpful mindset shift: marketing can mean simply providing free value to people that you'd like to become users or customers of the thing you've built. There's nothing evil about that. 6. A great way to start doing this is to "build in public". Share your journey, learnings, and struggles as you build your thing. People love to follow someone working hard towards a goal. 7. But even when developers do some marketing, they tend to do far too little. The balance that feels right to us as builders is usually 90-100% coding, 0-10% marketing. After all, we don't want to be a spammer! 8. But the balance that is most effective is around 50% coding, and 50% marketing. Finding users/customers is just as important as building the thing. As a side note: Jon Yongfook Cockle, a developer (and successful founder of Bannerbear) came up with this hack: work on coding one week, and marketing the next. Then repeat! He calls it "Marketing week, coding week". I love this idea. Another wonderful free resource on this topic is the blog post and accompanying e-Book "Start Marketing the Day You Start Coding" by software dev, successful founder and bootstrapping community stalwart Rob Walling. (If you Google it, it's the first result.) So if there's one thing you take away from this post, it's this: Spend half your time coding. And half your time providing free value to people you want to become your customers. It doesn't come naturally to us. But it's the best way, as a solo developer, to launch something that actually gets customers. And that could change your life. *** I had a wonderful experience speaking at RubyConf for the first time thanks to Ruby Australia and the folks who keep it so darn nice: Nick Wolf, Lee 🥕 Sheppard, Tarun Mookhey, Mark Glossup, Benjamin Greig, Daniel Nguyen, Claire Fernandes and Sophie Daley. 💖

46

16 Comments

In recent years, vulnerable legacy enterprise networks have migrated to full cloud solutions to improve security, scalability, and functionality. However, this shift has often come at the cost of data sovereignty and data lifecycle ownership. I am confident that, eventually, we will need to consider a mix of data sovereignty solutions and offshore computer processing. A likely return to edge computing, which emphasises local data storage and enhanced protection, is on the horizon. I look forward to helping our customers diversify their computing storage and processing capabilities by shifting from cloud computing to edge computing. Let’s see how this plays out!

19

1 Comment

Thanks to everyone that came to see my talk at ServerlessDays ANZ yesterday! Here are the slides. For those that missed it, here are the main lessons I shared: ✨ LLMs are not magic, they're just another useful tool in a builder's toolkit ✨If you want to be build with LLMs quickly and cheaply, see how far you can go with prompts and RAG. ✨If you need more control than you can achieve with those, you'll likely need to do fine-tuning, tuning or even training, all of which are much more expensive comparably. ✨Plan for your models to change all the time - use Artificial Analysis to navigate the changes ✨Plan for your prompts - version your prompts and construct them independently of inference ✨Getting LLMs to behave consistently for your use case is super challenging, but there are tools like the Seed and Temperature features to help ✨Hacking LLMs to behave outside the intended behaviour is easy, but you can architect around this using techniques like prompt proxies (thanks to Tomasz Tunguz for sharing great design patterns) If you have any questions about building using these tools, feel free to reach out!

31

3 Comments

Google's Cloud CEO Thomas Kurian has weighed in on the UniSuper fiasco. The multi region setup accidentally deleted... These incidents are possible, always ask the "What if question....?" "How do we recover...?" #cloud #privatecloud #dr #businessplan #gcp #google #aws #microsoft #azure https://lnkd.in/er_MNmEh

8

In a time of an increasing volume cyber-attacks, the Bureau of Meterology an Australian Government website still doesn't support HTTPS. 🔓 Sure most of the weather information is non-sensitive but is this acceptble for a government website in 2024? Who knows what backdoor API, or authentication data in plain text is lurking deep within our treasured rain-radar . . . 🤔 🌧 💻 To read up on the differences and security gaps between http and http-ssl/tls, have a read of this article: https://lnkd.in/gy7M7WZF

10

10 Comments

This is going to be a game-changer. The cat's finally out of the bag😮‍💨 🛡️ AMARU and Google Cloud have teamed up to bring cutting-edge security solutions to businesses in Australia and New Zealand. 🇦🇺🇳🇿   Leveraging Google SecOps powered by Mandiant (part of Google Cloud), you'll be equipped with the latest AI-driven tools to protect your data and keep your business safe. 🔒 Don't let cyber threats hold you back. Read more about this groundbreaking partnership and how it can benefit your organisation: https://lnkd.in/epMAXeMs   Google Cloud Security Google Cloud Partners #googlecloud #googlecloudpartners #amaru #cybersecurity

21

3 Comments

If you've built with low-latency data in the past, it may have come at the expense of weak consistency guarantees. But some real-life use cases require always-correct results: ❌ You don't want your auth service intermittently giving access to the wrong users. ❌ You don't want to shut down a user's credit card unless you're sure they're the target of an account takeover attack. ❌ And, you don't want to tell users a package has been delivered when it's still on its way. The ✨ good news ✨ is that there are stronger consistency models that we can layer over streaming systems. If you're trying to build real-time applications that need always-correct data, check out my talk at Current this September: "Consistency and Streaming: Why You Care Should About It." For more details, see: https://lnkd.in/gvBMRHSW

24

You cant ignore your last line of defence, your customers. Tools like New Relic and Datadog are great for when your team ships a bug and you need to hear about it fast. But what happens when someone else ships a bug? At the end of the day things will fall through the cracks. This was expressly highlighted when CrowdStrike went down wreaking global havoc. Unfortunately for many teams, their systems quietly errored and their customers are the ones that brought the issue to their attention. Qvasa found out about the issue 4 minutes after it happened. Our AI tags and reads tickets in realtime and alerts you when things go awry. There is a wealth of data to be extracted from your customers, you just need to start listening easy with Qvasa!

17

Welcome to all new connections in my network and hello to existing connections I haven’t yet talked to. MHP is a team of 5 people working across New Zealand. Here are the 5 things we work on all the time: ⚡️ New Wordpress Websites, Design & Development: - Beautiful Wordpress websites with Elementor. - Complex development of Design elements, Product showcases and other specialist industry needs. ⚡️Maintain, extend or re-platform existing websites - Review existing websites for bloat, security, user interface improvements,  or any other change you can think of. - Add landing pages for ad campaigns, implement A/B testing and separate service pages to achieve greater clarity and SEO improvements. ⚡️Add or Create E-Commerce: - E-Commerce is available for any website budget in 2024 and easy to implement. If you sell someone else’s or your own product, you might as well sell it self-service on your website. - Configure your web-shop for multi-currency pricing or add a product customiser for easier selling of add-ons. ⚡️Search Engine Optimisation (SEO): - Our Jumpstart SEO package is the ideal way to get your Wordpress or Shopify website in order to be ranked better and optimise it with a content pillar strategy. - The package includes local citation building, speed optimisation and is customised to each website’s requirements. ⚡️Web Hosting with security updates: - Hosting of both small and very large Wordpress websites on a simple, stable and secure hosting stack, constantly optimised by us. - Scheduled and batched security updates with review on a staging site for business owners and digital agencies alike. - Features like CDN, WAF, Virus scanner and unlimited disk space all included without add-on charges.

13

1 Comment

If you want to learn about DevSecOps, join us for breakfast 8th of August. DevSecOps is essential to maintaining application security in today’s world, but it doesn’t have to make software development any harder or more expensive. In this session you will be able to learn how to DevSecOps without breaking the bank.

3

An article The Australian today from Edward Chung CEO of TechnologyOne is well worth a read - 75% of technology projects fail. What I find surprising is that while the Government has spent billions of dollars on failed IT projects, they don't seem to have spent money on how to create successful IT projects. I think this points to a fundamental misunderstanding of and disinterest in people. IT is not about the vendor, product or technology, its about people: 1. how you have people excited to be part of a changing environment 2. how you have people willingly give up control of how its done and 3. how you have people excited to discover something new 4. understanding that very few people are expert at the above. The 75% failure rate says that 1-3 are not being addressed.

8

4 Comments

Next year is starting to take shape. I’ve got two new talks I’m working on, and I’m thrilled to be giving one of them at NDC Melbourne at the end of April. I see a lot of discussion about serverless or containers. When actually many modern apps have use cases for both. In this talk I’ll dive into patterns for modern application architecture. Where to use containers, where you might want to reach for more reactive functions and how use both together with little to no infrastructure overhead. https://lnkd.in/ekQ7h5PF

46

1 Comment

Building an enterprise-grade, multi-tenant auth platform is a lot like making the perfect brisket. 🥩 ▶️ It’s tough to get it right. ▶️ It takes patience. ▶️ It takes precision. There’s no shortcut to transforming a tough cut of meat into something tender and irresistible. A great brisket takes time, and rushing it leads to disaster. Every step matters. From trimming the brisket 🔪 to adjusting the smoker’s temperature. 🌡️ You’ve got to carefully plan, season with the right tools, and let it smoke low and slow until all those tricky parts come together. But when it's done? People are lining up to get a bite of those tasty burnt ends. 😍 The same goes for an auth platform. There’s no shortcut to building a secure, scalable platform from scratch. You need the right foundation. 🔒 But the end result? Companies are eager to sink their teeth (and their code!) into something that protects each customer’s data and drives revenue growth. Now if you'll excuse me... I made myself hungry. Comment below: Team Ribs or Team Brisket? #Enterprise #Security #MultiTenant #Authentication #ProductDevelopment #DataProtection #RevenueGrowth #TexasBrisket #BurntEndsAndAuth

9

11 Comments

Everyone, AI security might just be another software issue to tackle! 📢 if you are Building an AI system? It's crucial to consider responsible AI practices from the start. Check out the Responsible AI Pattern Catalogue from CSIRO (I like how they illustrated it as a pattern) : Why it's a game-changer: • Guides you through critical questions at every development stage • Supports creation of RESPONSIBLE system architecture, sequence diagrams, and user stories • Helps integrate responsible AI principles into your UML and overall design • Promotes a "secure by design" approach • Minimizes technical debt related to AI compliance • Ensures your AI system is responsible and adaptable This catalog is like having an AI ethics expert on your team, prompting important considerations as you build! ❗ Remember: Addressing AI responsibility after development can be incredibly challenging or even impossible. The technical debt is immense. Start right, start responsibly! #responsibleAI #aiethis #softwareengineer #aicompliance #UML https://lnkd.in/gqchazFk

20