zalmoxes

I'm neither an employee nor a customer, just someone who was following the project on twitter because it looked very intriguing. I just want to say that the comments on this thread are absolutely ridiculous and I expected better. Does anyone actually think the customers would find out at the last minute? That the company would leave its users without any support? It's baseless speculation and my guess is it's totally wrong. - The company is founded by Blake Mizerany https://twitter.com/bmizerany?lang=en an engineer known for Sinatra and a bunch of other well respected projects. - The users adopting an early stage startup's product are likely friends/former colleagues who are putting personal trust into the team. Does anyone really think nobody got a heads up, or possible support deals while they migrate?

Second, Backplane really looked like great tech https://www.youtube.com/watch?v=43wFJBRTHG0

You must buy your devices through the enterprise store, and then it is automatically linked to DEP.

Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed?

Because once you know the serial number of a DEP device you can enroll into the MDM. There is virtually no security. See https://duo.com/labs/research/mdm-me-maybe

they should be the same, yes. You can compare the .mobileconfig file with the spec from the PDF.

That's all commercial vendors do, push these XML files to your device.

Anyone can use DEP, just need a DUNS number to enroll into the program, and then to purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased.

DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentation/Configu...

MDM push notifications require to be signed by a special certificate, which is only available upon request.

Hi, I'm the author(along with several other developers). MicroMDM is used in some enterprise environments and was recently mentioned in a number of security presentations regarding Apple's MDM and Device Enrollment Program services.

https://duo.com/labs/research/mdm-me-maybe https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Dee...

The server is only meant for enterprise deployments. It would be pretty hard to do this on a personal level because you need to apply for an enterprise account with Apple, and request a very specific push certificate option.

At [Kolide](https://kolide.com/) we're heavy users of Go Kit, and as a result have also adopted a lot of the style Peter recommends here. We've been slowly expanding on it with a style guide and company specific set of common libraries [here](https://github.com/kolide/kit#kolide-kit). My coworker also wrote a [blog post](https://blog.kolide.com/using-go-for-scalable-operating-syst...) on how Go has been fantastic for us and references the above style guide.

The code from go kit and [oklog](https://github.com/oklog/oklog) are great examples of idiomatic Go. Unfortunately the community at large doesn't really follow the "no init"/"no package global vars", which can sometimes lead to bad experiences importing opensource Go libs.

RIP

I have a few services which were using Go’s acme/autocert package. I now need to update them to the HTTP challenge.

As a makefile pragmatist (they’re awful but easy to get started with/most know them) I’m debating between mage and Bazel.

I like mage because it would eliminate a lot of make and bash silliness, but I also want to get into Bazel because of all the things it promises.

Francesc Campoy’s Just for Func series is much better https://m.youtube.com/watch?t=420s&v=mTd3hHUy9OU

Also by a Google engineer and using Google Cloud products, but it’s actually a lot of fun to watch.

Yes that's true. But Docker did popularize it, at least that's how I initially read about it.

It's exciting to see that TUF is now a CNCF project.

We did use cobra in fleet, and worked hard not to use globals https://github.com/kolide/fleet/blob/f909f4808b17ffd5616c6c8...

It's doable, but it was hard and while cobra is a nice library, it's probably overkill unless you're a project like kubernetes.

Most projects in Go are very small in terms of configuration surface, and something like https://github.com/kolide/launcher/blob/9dcf149957b9e9757a24... is much cleaner IMO.

If you haven't already, join the MacAdmins Slack. https://macadmins.herokuapp.com It's an open-invite slack team with over 12000 users - sysadmins, MDM developers, security researchers and so on.

We have various ongoing efforts to document and improve the macOS experience for users. If you have a macOS question, you'll likely find the answer there.

Seconding the Hashicorp projects. I learned a lot about HTTP from reading the Vault code.

go-kit and oklog are also fantastic. Peter Bourgon has written a good article about Go best practices and his open source projects really aim for clean, readable code.

Also join the go slack if you haven't yet.

Osquery also runs on windows now :)

Which package manager? :P

No it's not. In this case 1Password wouldn't be compromised, since having access to the system doesn't mean you can decrypt the passwords.

With OS X keychain(and browser) unfortunately, if your system is compromised, you can decrypt the password store.

If you have Gatekeeper enabled(which it is by default), the system prevents the user from running random unsigned apps.

This could have been prevented by hosting downloads on a reputable site(Github), instead of developer's own PHP backend.

Software like https://github.com/google/santa can help, especially if you're doing IT in a large enterprise.

The feed used by the software's autoupdate framework(sparkle) was signed, so that would've prevented bad downloads through autoupdate.

In case the site goes down: http://imgur.com/a/I6gpB

It does and it's documented on the wiki. I've written a few plugins privately, like implementing SCEP into caddy and adding a few other features.

Due to the nature of the plug system, you'll have to build caddy yourself if you add customizations like that.

Might be a good time to plug my writeup of parsing webhooks in Go https://groob.io/tutorial/go-github-webhook/

It really depends. You might want to test something that requires days/weeks expiration.

I would agree that the Clock interface is a bit large. In personal projects I prefer to just have something simple like timer func() time.Time

Great point about time. At work we've adapted github.com/WatchBeam/clock and it's helped a lot.

Thanks for blogging about your work on juju! Despite Go already being five years old, many of the patterns around building large applications are only emerging now.

Thanks for being so transparent and sharing your learnings! Good luck with your future project.

I really enjoyed that episode :)

Curious, since it was just you writing the backend, what was the reasoning behind doing microservices + react SPA. Both of those require a lot of commitment, and coordination. Microservices especially are something I'd be more likely to consider with a very large team/many teams instead of a single developer.

Would you choose a microservice architecture again?

Their Go services definitely read like a very beginner or prototype project. There are no tests, lots of global state, and little separation of concerns between request/response business logic etc.

Very nice! I remember talking with you regarding some of this in k8s slack when I was trying to figure out how to wire it all up.

Thank you for all the work you do on the ingress project by the way.