ukigumo

Well, at least this one was technically challenging. My favourite bank robbery happened in London a couple of years ago and it used social engineering 3G modems and KVMs. More info here:http://arstechnica.com/tech-policy/2014/04/bank-robbers-use-...

Now, I feel a discussion like this one would be the perfect place for me to introduce myself and... try to sell my services but I think I'm too late to the party so I'll keep it short.

Banks are the archetype of the company that suffers through technology. They make huge investments in IT year on year, but often they end up buying overly complex solutions from 1MM consultancy companies that never get fully implemented and, worse, cause high levels of frustration that then backfire onto projects that could actually make a difference.

With every department (or vertical or region) running their own IT, many of the core functions being outsourced offshore, and innovation (ie: BYOD, Shadow IT) being ignored, some pretty serious gaps are opened in the way security is handled despite best intentions, processes or even regulatory compliance we end up with local desktop machines having direct and unrestricted access to sensitive systems _and_ the internet.

Of course, all this is very nice but at the end of the day if someone can just walk in to your office to "fix your computer" and no one bothers to check their credentials... there's only so much one can do for you.

Hi, IT Architect with a history of several major financial institutions here.

Defence in depth is a placebo. Separation of concerns, principle of least privilege, honeypots, SIEM, file integrity monitoring, host intrusion detection, IDS/IPS on all your ingress and egress points, WAF, content filtering and a responsive and empowered SOC capable of acting on auditing events will get you half way to not showing up on the front cover of NY Times.

The problem is that it takes money to keep money safe and too much security is often not secure at all, so putting everything together in a way that you doesn't motivate your users to find new and exciting ways to bypass your controls is an art in itself.

Would love to discuss some of these things with you, any chance I can interview you for my blog?

This is actually a very good point. If only there was a system of public ledger for fiat currency :-)

I'll be reading more into unikernels because it does seem like an interesting topic.

However, I strongly advise you to read up on how production environments are done in security conscious enterprises (banks, payment providers, etc) as you seem to make some assumptions in your comment. To give you some idea of the environments I've designed in the past:

A WAF worth it's name won't pass any request back to a webserver if it matches a known signature, method, payload, etc. This is a functionality commonly called virtual patching. SSH is usually only allowed on internal vlans and often requires some sort of external authentication mechanism like a centralised jumpserver or ldap.

Also, if using Solaris with OVM for SPARC you wouldn't boot up a new server but a non-global zone (think Docker but 2 years from now) which can be started in ~1 second and offer full isolation from the host system. AIX also does something similar and I've seen several different approaches used on Linux from LXC to VMware + F5 irule based auto-scaling groups.

Thank you, I'm going to read through those carefully.

Exactly! No architecture, no structure, no process, no documentation and with some luck, no money either.

Because it has a good suite of tools that work out of the box. There's LDAP, webmail, webDav/calDav/cardDav, admin interface, antivirus, anti-spam, etc. It integrates well with OwnCloud too which is a nice plus.

When I was looking to move away from gmail, my requirements where security and privacy and Kolabsys was one of the first services that popped up as a viable alternative.

The thing is, I was also looking for a reason to try out AWS and get back to using linux after years of powerpoint and archimate _poisoning_ so everything came together like that.

I highly recommend it, even if it took me about 5 working days to get spamassassin, openDKIM, ciphermail and TLS working for all components. But hey, now I get a 94% grade on www.emailsecuritygrader.com and a A+ on SSL Labs's test so hurray for me.

Nice find. I setup a Kolab + Ubuntu server based email for myself and family a few months ago and it has been running great. If anyone would be interested in a writeup let me know.

I liked this article but I couldn't stop thinking "you would do well in investing in a project manager" at every bullet point.

Imagine you are developing inside a VM but use the browser on the host OS to check the results. If the bind address was localhost then you would need to tunnel your connection from host to guest to be able to reach your server.

By binding to 0.0.0.0:PORT the guest OS will make your service available on all enabled interfaces:PORT combinations which, hopefully will "just work" in most use cases.

not all addresses but all interfaces, which can have one or more addresses plumbed in.

At enterprise level AppDynamics kicks ass.

I think their pre-sales pitch is that it was built thinking of production use first and then adapted to run in dev/test environment while the competition did it the other way around. Not sure if that is the case, but I assure you it's lightweight and has some nice security/confidentiality configuration options which makes it easy to deploy even in highly regulated envs.

If you are running a java environment then I would point you at Azul Systems because it's just the dog's bollocks :-)

(I'm not in any way associated with AppDynamics or Azul btw, just a happy client)

That's a though question as there are always exceptions to the rule but generally I would be cautious in investing (money) in a company that is growing slower than its sector would allow for. However I would happy to invest time in such companies, but that's because I'm a consultant :-)

hopefully without the typo :-)

I would suggest some changes to your resume, mainly to bring out your programming skills and expertise and then to highlight that you have significant work experience with system engineering so you are not a neophyte and can actually add something "else" to your team.

Starting with the Summary, I would change from "Expert Systems Engineer with a passion for programming seeking an entry level development position in a fast paced environment that will leverage my existing self-taught skills and provide and opporunity to grow as a developer." to

"Passinate programmer with a history of custom software development and systems engineering ...etc"

Good luck!

Are you sure? I'm usually very careful with my usage of figures of speech but I'm no language major so maybe I should clarify that I meant that I could see edge cases but not a general purpose one.

Did this clarify my point or in any other way contribute to your undestanding?

Ok, but that would only be true if I was going to spin up a new vm to join the load group / cluster but even then no one would do that unless behind a reverse proxy / waf load balancer so the attack vector angle is covered.

I'm not saying MirageOS doesn't sound neat, I'm just not yet convinced it has a general purpose use case.

I have a bit of a problem understanding why this would be a good thing to be honest.

Capacity demand is handled by resource concurrency thresholds so why would spinning up a new OS (no matter how lightweight) be better than having non-blocking IO threads on a single kernel?

I think this rule is a nice generalization overall but for my money I would discount natural segment growth from the company's year on year.

So, if the market (ie mobile payments) is growing 50% YoY and the company is only growing at a rate of 25% that's actually pretty bad.

From the original article: "If you are doing better than the 40% rule, that’s awesome."

Tarsnap is doing awesome. Keep up the good work!

I really liked the profile article, and I think it's a great idea to showcase the people you have working for you! But as an Architect myself, I tend to object to the misuse of the title for pre-sales positions. It's just a pet peeve.

Good luck to David and to Peak Hosting!

Like etherpad, but social?

Well, yes.. but the person giving you paper money in exchange for BTC will make their own exchange rate based on the capital risk incurred in transacting volatile goods, which is very different than transacting gold or jade figurines. Unless of course you meet a BTC collector who has no immediate plans on capitalizing on his investment.

Looks very interesting, I'll have a better look at the product tonight.

Because the local currency would have to go trough the banking systems and if the seller's account is in any other country, then exchange restrictions are applied just the same.

If your worry is with data at rest, then owncloud already supports it (http://doc.owncloud.org/server/7.0/user_manual/files/encrypt...).

I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

...or not. It's actually a good example that you can't "cloud" yourself into high availability.

I wrote about the different worlds of people that form the bulk of the CHAOS study and what seemingly is the crowd on HN and Reddit at https://blog.ukigumo.eu/3-types-of-company/

In short, most projects fail because many companies either don't understand IT well enough to take advantage of it or are too focused on IT to understand business.

I have to say yes!

I was born in Portugual, so Portuguese and Spanish was all I heard growing up. But then I went into a german school and picked up German and English. Later I picked up French and finally Dutch.

My wife has a pretty similar language history so it's quite fun to speak our own version of Esperanto to our daughter and see what language she'll pick up first!

Workwise, I would be miles behind where I am right now if I hadn't picked up English at an early age. I've read somewhere that people who reason in a non-native language are able to maintain a more rational (less emotional) train of thought and that certainly seems to be the case with me, but if for no other reason, I suggest you should pick up a second language because it will increase your potential earnings! (see the economist's article below).

http://www.economist.com/blogs/prospero/2014/03/language-stu...

Portuguese ladies are also quite something. I should know, I'm married to one :-)