🪼
NASA
h
i don't do bad sauce passes
Misplaced Lens Cap
RMH
cherry valley forever
Product Placement
Stranger Things
Not today Justin
TVSTRANGERTHINGS
Mike Driver
Cosmic Funnies
almost home
Acquired Stardust
Discoholic 🪩
❣ Chile in a Photography ❣
JVL
No title available
ellievsbear
seen from T1
seen from Malaysia
seen from T1
seen from United States
seen from United States
seen from United States
seen from United States
seen from United States
seen from United States
seen from United States
seen from Australia
seen from Canada
seen from United States
seen from Malaysia
seen from United States
seen from Germany
seen from United States
seen from Japan
seen from Türkiye
seen from Indonesia
@bfcamara
Since the dawn of time (before software, there was only darkness), there has been one constant: businesses want to build software cheaper and faster. It is certainly an understandable and laudable goal – especially if you’ve spent any time around software developers. It is a goal that every engineer should support wholeheartedly, and we should... Read more »
Very good blog post about software complexity nowadays.
It’s about time! Two command-line tools added to the Windows toolchain: curl and bsdtar.
This article is a chapter from my new book Explain the Cloud Like I'm 10 . The first releas...
Interesting article explaining how Netflix has evolved its infrasctructure, and how it is today highly distributed all over the world.
It's finally time: it's time the pendulum swings further towards the "secure by default" end of the scale than what it ever has before. At least insofar as securing web traffic goes because as of this week's Chrome 62's launch, any website with an input box is now
Excellent blog post explaining how to upgrade a web site to HTTPS safely. Includes also a lot of links to good resources on web apps security.
One of the most useful features of any version control system is the ability to "undo" your mistakes. In Git, "undo" can mean many slightly different things. When you make a new commit, Git stores...
For future reference, for those git situations we need some help to undo some mistakes.
Great post explaining the new TFS/VSO Build system (vNext), particularly the improvements regarding build infrastructure management, when compared with the older approach.
I'm totally stoked!!! Why? Because I finally get to share Aurelia with the JavaScript world. What is it you might ask? It's a next generation JavaScript client framework unlike anything else available today. Cut to The Chase Several months ago...
I think we were all expecting this announcement from Rob Eisenberg after he had announced in November last year that he was leaving Angular 2.0. Aurelia is the new JavaScript client framework. I watched the video, and it looks really good. The comparisons to Angular are inevitable, at least for me, because Angular is my framework of choice to develop rich web applications.
I'm very curious to check how the community will embrace Aurelia. I believe that Aurelia is arriving at the right moment after all the controversy about Angular 2.0. It seems obvious that those developers not very happy with the future of Angular 2.0, will embrace Aurelia (or at lest they will try it for sure). Let's start to check Aurelia in Google Search Trends.
The importance of setting goals: half-marathon finished
We are at that time of the year when people typically do a retrospective on how good/bad was the year that is ending. Well, I'm not writing this post to do that kind of reflection, instead I want to show how important is to set goals in our lives.
Last Dec. 7, I finished my first half-marathon, 21 Km (13.1 miles), in 2 hours and 7 minutes.
I would like to write this post telling you how strong I've cut the finish line, but the truth is that it was very hard, particularly the final 3 kilometers. I confess that I spent many minutes thinking to quit, and how absurd I was being in craving for this goal, especially when I don't take any pleasure in running. Let me explain why I did it.
In June of 2012 I did a surgery to my heart. Before the surgery I had strong limitations which didn't allow me to practice sports. With the aorta aneurysm already removed and an aortic prosthesis placed in my heart, a few months later, my surgeon told me that I was ready to do what I want freely except weight lifting. To be honest, I didn't believe him 100%. I decided to make some tests. So, In 2013 I set the following goals for me:
By the end of 2013 I'll run 10 Km. Nice to have: complete it less than an hour
By the end of 2014 I'll run a half-marathon (21 Km). Nice to have: complete it less than 2 hours
By the end of 2015 I'll run a marathon (42 Km). Nice to have: complete it less than 4 hours.
So, I started running in 2013. I was very excited, I bought some shoes, I started to train during the morning, etc. After 2 weeks, I had to stop because my knees couldn't support all this kind of effort (I weighed to much by that time). I stopped for 2 weeks, and then I started gradually. And here are the results:
I achieved the first goal very well: by the end of 2013 I run 10Km in 52 minutes.
The 2nd goal was achieved as well, I run a half-marathon by the end of 2014, however I took 2 hours and 7 minutes to complete it . So, I'd say that I completed the goal.
But when I was cutting the finish line, my first thought was: "hey Bruno, do you think you could handle to run more 21 Kms?". My answer was a big "NO". I have now many doubts if I should go with the 3rd goal at all. It is a lot of pain. It's not just the pain on the day you run a marathon. It's all the pain of the training sessions. Currently. I'm not prepared to run a marathon. In fact I'm wondering if I should drop the goal at all.
The moral of this all story is that if I hadn't set any goal I wouldn't even run 10 KMs. I'm sure about that. This last 3 months, every Sunday, I woke up to run to be prepared to the half-marathon. And the only thought that I had in my mind was "I have to achieve my goal".
On the other hand, it's the goals theirselves that allows us to understand if a goal is realistic or not. And that's why I'm really evaluating if I'll run a marathon or not.
Happy new year 2015.
Evolving JavaScript with TypeScript: great talk from Anders Hejlsberg where he presents an overview of Typescript.
The recent Microsoft .Net announcements: now what? What's the next complain?
From time to time I discuss with some colleagues, whom I met in university and we graduated together, about the career path in software development that each of us have chosen. I think most of us have chosen the path in an organic way, mostly influenced by the technologies that our first employers had adopted by that time. At least, in my case, it was what happened, and what influenced me the most to have chosen to be a Microsoft .Net developer. However, the majority of my friends have chosen non Microsoft development stacks. Every time we discuss this topic I always have to listen some critics:
".Net is not open source!"
.Net is limited to Windows!
"Developers can't influence the future of .Net"
etc.
Even when I try to explain the Mono project, or how Microsoft encourages developers to participate and vote in UserVoice, the response from them is always the same:
"Mono is a small initiative just to entertain some guys"
"Voting features is not the same as contributing to sources as it happens in OSS projects"
I think most of this behavior of being anti Microsoft have historical reasons. We graduated all in the end of the 90s, and the majority of our projects were developed using the C language targeting Unix systems, with Emacs or vi as the preferred editor. By that time, it was not very fashion to be a Microsoft developer, programming in Basic or C++, COM, MFCs, etc. Therefore, for these guys whom didn't follow the .Net life, it's natural that they still have some issues with Microsoft.
Well, these last two days were made many announcements in the Connect event. To all my those colleagues:
Microsoft open sources .Net
Microsoft .Net will have official distributions for Linux and Mac OS.
So guys, what is your next complain now? I'm looking forward to meet up with all of you to check what are your reactions.
Personal advice to someone starting a software development career
My personal advice to someone that is starting his career in software development is to choose mainly one development stack: Microsoft, Java, Ruby/Rails, PHP, Node, etc. When choosing the stack, don't forget to look at what market is demanding in terms of skills to be sure that what you offer is something that the market needs.
Don't loose sight of what's happening on those different stacks: you'll conclude that typically the trendy practices will be available sooner or later in all development stacks and that the fundamental concepts won't differ too much.
Finally, and especially if you're doing web development where JavaScript is omnipresent, if node is not your main development stack, I suggest to look at it and try to have some knowledge and practice with node (and the frameworks available like expressjs).
It's very hard to follow close what happens in a given development stack, so imagine what needs to be done to excel in various development stacks. But nobody said that it was easy. Everyday there is something new out and it's very hard to know in detail everything. However, be aware that we need to stay close of what is new, otherwise you'll be obsolete soon.
Working with isolated scope in directives can be a bit confusing so I wanted to take this opportunity to try to explain how to interact with isolated scope
Check what's coming with Angular 2.
RIP:
Controllers
Directives object definition
$scope
angular.module (no more discussions on how to structure your app in terms of modules)
jqLite
Consuming VS Online REST API using a Service Account
One of the great things about the VS Online REST API is that you no longer need to have installed Visual Studio or Team Explorer, or just the TFS Object Model to integrate with TFS. It's just a normal REST API we can consume by making HTTP calls.
Following the documentation on VS Online site, it seems that we are limited to consume the REST API using alternate credentials (basic authentication with username and password) or using OAuth (bearer access tokens).
This is not perfect if we're developing some integration work in VS Online and we want to use a Service Account to perform some tasks such as queue a build, create work items, etc.
Well, if it's possible to use service accounts when using TFS Object Model, there should be a way to use them as well with VSO REST API . In fact there is a way to use a service account in the REST API, and this post aims to show you how to do it.
First and foremost, we need to get a Service Account in VS Online. For that we can use the tool TFS Service Credential Viewer provided by Martin Hinshelwood from naked ALM. You can even watch a video explaining how to do it.
Next, in order to use these credentials with REST API, we need to understand what TFS Object Model does and try to replicate the same behavior in REST API and check if we succeed. Basically TFS OM uses OAuth WRAP Protocol to get an access token from Azure Access Control Service (ACS).
With the help of Fiddler, here are the interactions we got when using TFS OM:
Hit VS Online unauthenticated to get a redirect 302 response where there are some headers that contain federation data, namely, realm and issuer
Request a token from ACS via the OAuth WRAP Protocol passing the Service Account username and password
Use the returned token in the Authorization header with a WRAP scheme when invoking TFS services.
Let's try to code this in C# and see what we got. If you want a full gist we can grab it from here.
Let's start with Step 1 to get federation data.
Having the federation Realm and Issuer, we can now request an access token
And finally we can use the access token to consumer our REST API, to get the list of team projects for example.
Here is the result for my account
It works!
As a side note, this method of consuming the REST API is not documented in VS Online site which means that we have no guarantees that it will still working in the future.
I hope it helps.
Worth reading. There is no doubt how important customer service is and the impact it has when trying to thrive a company. The same is true for freelancers.
Hubot security considerations
I'm currently working in a project that integrates Hubot with an external system. If you don't know anything about Hubot you can read more here. It's definitely a very endearing project commissioned by Github.
In this small post, I would like to make some security considerations that I thought being useful for someone who needs to install Hubot in production
DIE command
The default Hubot installation (the one that is created by hubot --create mybot) exposes a DIE command, included in the ping.coffee file in the scripts folder. Any user in the room can invoke it as 'hubot DIE'. This command just simply terminates the current hubot instance. A possible mitigation for this risk could be just remove the ping.coffee file from the scripts folder or modify it commenting the command. You could also add an if clause to check if the user running the command has a given role.
Show Storage command
Another command available by default is the 'show storage' command, included in the storage.coffee file. This command shows all the data stored in brain (well, not all data since it's just showing the brain JSON object at a maximum of a depth 4). This command is available for everyone, so be aware of what kind of information you're storing in brain. If you are going to install custom scripts that store sensitive information in brain, you should consider remove this command or add some restrictions on running it. You could also encrypt the data before saving in brain.
Auth vs Roles scripts
The default Hubot installtions loads two scripts to manage roles in hubot
auth.coffee - Only users registered in HUBOT_AUTH_ADMIN env variable can manage roles (kind of secure mode). In this mode only the instance admins can do 'hubot user1 has god role'.
roles.coffee - Everyone in the room can manage roles (kind of a free mode). In this mode everyone can do 'hubot user1 is god'
These modes are mutually exclusive. If env variable HUBOT_AUTH_ADMIN is defined and has values (comma separated list of admin user IDs) then hubot uses the auth script, otherwise hubot uses the roles script. Make sure you define the variable HUBOT_AUTH_ADMIN with the list of user IDs that will be the hubot admins.
HTTP Endpoint secured
You can expose HTTP endpoints inside Hubot which will run hubot commands. Hubot uses internally the Express framework. By default, Hubot exposes these endpoints without any kind of security enabled. We can enable basic authentication by setting the enviroment variables EXPRESS_USER and EXPRESS_PASSWORD. It's strongly recommended to user strong passwords.
Finally I would like to recommend the book Automation and Monitoring with Hubot from Tomas Varaneckas. I bought the book when I started to work with Hubot and I have to say that it helped me a lot to enter quickly inside the world of Hubot.
How much RESTful is your API
We all have a tendency to say and assume that our API is RESTful as soon as we expose our services using HTTP with JSON/XML and applying some conventions around the HTTP verbs (GET, POST, PUT, DELETE, etc.). However, this assumption is not correct. I don't want to dig in the REST architectural style to show why this assumption is incorrect; instead I want to share something that I learned recently while I'm preparing for my MCSD certification in Web Apps, in particular while studying for exam 70-487: The Richardson Maturity Model.
The Richardson Maturity Model describes four levels of maturity for services
Level 0. Use HTTP as a transport protocol by ignoring the capabilities of HTTP as an application layer protocol. Level 0 services use a single address, also known as endpoint and asingle HTTP method, which is usually POST. SOAP services and other RPC-based protocols are examples of level zero services.
Level 1. Identify resources by using URIs. Each resource in the system has its own URI by which the resource can be accessed.
Level 2. Uses the different HTTP verbs to allow the user to manipulate the resources and create a full API based on resources.
Level 3. Although the first two services only emphasize the suitable use of HTTP semantics, level 3 introduce Hypermedia, an extension of the term Hypertext as a means for a resource to describe their own state in addition to their relation to other resources.
Martin Fowler has a great post in his blog describing in detail these four levels.
I would risk to say that most of us, when using the Web API project template provided in Visual Studio and following the typical recipes, or using the scaffolding generated code, most of the time we are building services at level 2. If we want our services at level 3, we need to introduce Hypermedia elements in our payloads. Maybe we should look to HAL - Hypertext Application Language, which is a simple format that gives a consistent and easy way to hyperlink between resources in our API.
Roy Fielding, the author of the doctoral dissertation that describes REST, considers that level 3 is required in a REST architectural style. However, I think I'll continue to say that "our API is a RESTful API", even though my services are at level 2.
From the video introductions I'd say that it seems an enjoyable way to learn Angularjs.