Skip to content
EN

Back to the catalog

blog.scaledcode.com
jsonEnglish

Scaled Code

blog.scaledcode.com · English

I am writing about my experiences as a software engineer.

json

Open the feed

https://blog.scaledcode.com/feed/feed.json

Last post
Mar 7, 2025
Posts in 24 h · 7 days · 30 days
0 · 0 · 0
Our last check
Answering
Served from
United States
Text score at discovery
10,610
Format
json

Posts

What our queue read from this feed. Open one to read it here, or go to the site that published it.

  1. The Confusing Case of Git Signatures on GitHub
    Mar 7, 2025 · original
    Git has supported signing for some time (version 1.7.9 released in 2012). As git's own documentation says, git is cryptographically secure but not foolproof . By cryptographically secure it means that every commit has a hash value and all future values are built on top of previous values. This makes tampering with the history of a repository extremely difficult without detection. By not foolproof it refers to the identity part of git which, by default, is very trusting. When you set up git you provide it with your name and email address and there is nothing stopping you from putting someone else's name and email address in. To solve this second problem git signing was added. Why is git signing still not that popular # Signing of commits, while it has been available for over 10 years, is still not that prevalent. Why would that be? The issues come down to two reasons: Added complexity Lim
  2. When NTP Interactions Go Wrong
    Aug 24, 2024 · original
    In the complex software development environment that we are in there are countless layers of abstraction that we build upon. This is part of what enables development to be so productive in this day and age. Most of the time this is helpful. For the average developer to not have to worry about CPU registers, page size, TCP routes, etc allows focusing on what makes the software you build different and useful. This is a good thing. That said, when abstractions we build upon don't meet the expectations that we have it can have significant impacts. One such expectation that we often expect to be there is having an accurate clock on the machine. While we shouldn't expect all clocks within a distributed system to have identical clocks (although some modern advancements are making this closer to a reality ) we do expect the clocks on our machines to be reasonably accurate. This is thanks to prot
  3. Microsoft Gets A Firm Reprimand From the Cyber Safety Review Board
    Apr 15, 2024 · original
    On March 20, 2024, the Cyber Safety Review Board (CSRB) published its findings about the summer 2023 Microsoft Exchange Online intrusion by Storm-0558. The CSRB is a relatively new organization that, to this point, has produced two major reports on specific security incidents. The first was published in July 2022 and covered the vulnerability known as Log4Shell. The second review was this one about the Microsoft event. The CSRB is fashioned after the National Transportation Safety Board (NTSB) and is set to meet in cases of significant cyber security incidents. The review of the Microsoft Exchange online intrusion is enlightening, shocking at times, concerning, and informative. It is extremely useful to read such a report from the board as they were given deep access to interviews all related to this event. Technologists would be wise to review the findings in this report, and, as the CI
  4. Modern Methods for Cross Site Request Forgery (CSRF) Protection
    Feb 16, 2024 · original
    Security is a constant battle in modern development. While there are always new exploits and things to protect against, we must not forget about the exploits and the security concerns that we have needed to protect against for years. This is why even after all of these years we still have SQL injection in the OWASP top 10. Recently I have had the opportunity to once again dig into the concerns and mitigation methods for Cross Site Request Forgery (CSRF). What is Cross Site Request Forgery (CSRF)? # Before we can protect against an attack, and to better understand why the mitigations work, we need to understand what CSRF is. CSRF (sometimes written XSRF and pronounced sea-surf ) is a type of exploit where an attacker uses the fact that a user is logged into another site to make malicious requests on their behalf without the user's knowledge. These attacks can be facilitated via many metho
  5. The Next.js Conf Picture That Blew People's Minds
    Oct 28, 2023 · original
    The image above has taken over the software development internet by storm over the last day. Particularly on Twitter/X, it seems to be about all people are talking about. Just twelve lines of code on a slide and you would have thought it was the craziest thing anyone had ever seen. So why are people freaking out? The reactions seem to fall into three different groups. Those who think this is the best thing they have ever seen. Those who think people who want this are horrible developers and are coding in an extremely insecure manner. And those undecided people straddling the middle. I will say right off the bat, I don't have a strong understanding of how this pattern is working under the hood but I have researched it some and looked at what the true experts in this are saying. Let's take a look at each stance. Those That Think This is the Greatest Thing Ever # There is definitely a group
  6. Building a FIPS-140 Compliant HTTPD Server
    Oct 21, 2023 · original
    Occasionally you will find yourself given the opportunity to work within a new set of constraints in the technology field. I find it is almost always beneficial to embrace these situations as there is always something interesting to learn from them even if you don't need to develop within those constraints for long, the learnings from that environment can help you in other, seemingly unrelated, areas. One of these constraints I have had to work within recently is needing to meet compliance with FIPS 140 requirements. What is FIPS 140? # The National Institute of Standards and Technology (NIST) issues the 140 series of FIPS (Federal Information Processing Standards) as a collection of standards related to computer security standards. There are two accepted levels of these standards at the time of writing, 140-2 (valid until September 21, 2026) and 140-3 (which started accepting applicatio
  7. McKinsey Has Solved Developer Productivity Measurement
    Aug 23, 2023 · original
    Recently MicKinsey came out with an article titled " Yes, you can measure software developer productivity ". After so much research by so many in software development including some of the biggest players such as Google, Meta, Microsoft, etc. McKinsey has come in and solved it for us. I of course am kidding. This piece is, unsurprisingly, just a marketing fluff piece aiming to drum up consultant engagements for them. Trying to get business is of course their right but to me, the hubris of this article is just too much. That said, there are things we can learn from their article. The Good # Although there are some fundamental problems with this article there are some good things. The main good thing is its reference to the DORA and SPACE metrics. These are not items that have come out of McKinsey. DORA (DevOps Research and Assessment) is a legitimate research organization that performs re
  8. Mechanical Sympathy in Software Development
    May 2, 2023 · original
    Modern software development spends the vast majority of its time at an extremely abstract level. Gone are the days of the majority of developers having to worry about registers, manual memory management, and pointers. This has undoubtedly led to an improved velocity of the creation of software. We can now spend more of our time focused on delivering value to the users of the software we are building rather than meeting the demands of the computer. Looking towards the future with the promise of AI assistance with tools such as GitHub Copilot, Chat GPT, and countless other tools on the horizon, the future seems to continue to be marching up the stack. That said, there are still benefits in understanding the details of how the internals work behind all the abstractions. A phrase I have always found interesting is that of "mechanical sympathy". It is said to have originated from British race
  9. When Proof of Concepts Become Production Code
    Apr 17, 2023 · original
    Often when embarking on the implementation of a new piece of functionality or a new product entirely a common first step is to build a proof of concept (POC). Proof of concepts are a valuable tool in software development and provide various benefits. These benefits include the ability to test out new technology, validate ideas, gain stakeholder buy-in, and fail quickly. There is a reason that they are so widely used. For all their benefits they do come with their own risks. Unfortunately, in today's fast-paced development environment, there can be a push to take your POC code and push it to production. To help avoid falling into this trap let's consider some of the reasons it may happen. Often POCs are developed to present to others. Many times you are testing out a product idea and then presenting it to stakeholders. When others see these seemingly working solutions they may think the w
  10. The Transition to a Cloud-Native Developer
    Mar 16, 2023 · original
    To me, one of the allures of software development is what Fred Brooks famously labeled as working "only slightly removed from pure thought-stuff. [Software developers] build [their] castles in the air, from air, creating by exertion of the imagination." This starting from nothing and building up something of value is enjoyable. Put simply, software engineers want to write software. This thought will often come up when discussing supporting activities a developer needs to do to facilitate their work such as documentation, meetings, etc. This also can be applied to the behavior of software developers where they will often rather write their own code to solve a problem before they reach for an outside solution. Historically this avoidance of using “someone else’s code” was mostly seen in not using external libraries. More recently we have probably seen a bit of the opposite of this (looking
  11. ArchUnit: Testing the Design of Your Library
    Jan 29, 2023 · original
    A common issue that is experienced in software development is the disconnect between how the software is described as working and how it works in reality. This often can be caused by a well-meaning developer coming before you and either misunderstanding how the system works and documenting that misunderstanding as truth or documenting the reality at the time but the documentation has fallen out of sync with the system as the software has evolved. Along those same lines, what is defined as the standards in the system can be disconnected from reality. This may happen even without the developer knowing they are disconnecting the code from the standards. Without something confirming and verifying that the code is working and structured the correct way, we can never be sure without extensive work. Thankfully, to verify that the software solves the business requirements it is supposed we can d
  12. Coding is Not Enough: The Importance of Investing in Domain Knowledge
    Jan 17, 2023 · original
    As technologists, we spend much of our time learning the latest technologies, development practices, and tools. These are very important to the work that we do and thus we rightfully give them a lot of our attention. There are many resources from which to learn this information whether they be blog articles, conferences, certifications, videos, etc. Understanding the technology is only half the battle though. Software is built for a reason, to solve problems in the real world and, in order to do that, knowledge of how the real world works is necessary. This knowledge about a particular industry or field is commonly referred to as domain knowledge. Domain knowledge, although not discussed often when explaining what is necessary to succeed as a developer, is critical to being effective in your work. Without domain knowledge, a developer simply is a coder that takes in information and trans
  13. The Different Types of Software Architects
    Jan 12, 2023 · original
    Software architecture can be a hard thing to pin down. While at times architecture may feel intimidating, anyone writing any code is participating in software architecture. From simple scripts to sprawling distributed systems there is always a software architecture whether planned or not. While every person that writes code participates in architecture, there are some that have the distinct role of shepherding the software architecture of a system. Depending on what kind of system you are working on and the business structure that surrounds it there can be different types of software architects you will encounter. The Accidental Architect # Either because someone doesn't have the distinct role of architect or because there is a need for this person they knowingly or unknowingly step up. The people that end up as accidental architects weren't looking to take this step in their career but
  14. Comparing Different Ways to Build Proxies In Java
    Dec 13, 2022 · original
    One of the commonly used techniques used by popular Java frameworks and libraries is object proxies. Even though it is a popular pattern used in many of the libraries that developers use daily, many developers have never directly built a Java proxy in their own code. While the use case may not come up commonly in everyday code, its usage makes sense in some cases and understanding how the dependencies of our code generally accomplish their tasks is always worth your time. What is a proxy? # In this context, a proxy is an object that has access to intercept calls into a particular class. I like to think of it as a layer around an existing object. This doesn't mean that every method or interaction with a proxy will be intercepted but it has the ability. The original method may still be invoked when the proxy is called, the original code may be entirely ignored, or a combination of both. Wh
  15. DynamoDB And Incomplete Result Sets
    Nov 10, 2022 · original
    In a recent project I worked on DynamoDB was used as the data store. The project was an internal utility that would get spiky utilization. It would go from zero traffic to a non-insignificant amount of usage in a short time. Combined with the almost zero operational overhead of managing a DynamoDB table and it was a solid choice as the data store for this tool. The Problem # After several months of usage, the users of the application would occasionally report that the "details" page of the tool would not populate with data. This was weird because the existence of the record was proven by its existence in the overview list but when navigating to the details page it acted like it didn't exist. Also, strangely, sometimes the system would fix itself. The Investigation # Upon digging into the issue we were able to confirm that the data for the details records did exist in the database. We als
  16. Steps to Fast Track Your Growth As a Software Engineer
    Oct 25, 2022 · original
    Being a software engineer presents a great opportunity in the current job market. There is a great need for software professionals which creates many opportunities for software engineers. At the same time, many motivated and passionate individuals work in the field. Given this, how does one stand out from others and fast track their growth as a software professional? Let us dig into a few ideas. Volunteer to dig into something # At one of my early professional programming jobs, we had several guilds (sometimes called "communities of practice") where like-minded people gathered to share and discuss topics (inspired by the Spotify guild concept ). There were UI/UX, architecture, security, and data guilds. I started attending the architecture guild and one day the idea came up to investigate a tool to see if it would be useful for us. I was the most junior in the room but decided to volunte
  17. Programmer’s Writer Block: Make It Work, Make It Right, Make It Fast
    Sep 25, 2022 · original
    Designing software is often a daunting task. We often confront problems that we may not initially know how to solve. Staring at a blank IDE with no clue where to start can lead to a programmer's version of writer's block. Similar to what is suggested to get over writer's block, simply writing something down and starting the process can be a great way to overcome this obstacle. This relates to a common mantra in the software industry "Make it Work, Make it Right, Make it Fast" attributed to Kent Beck. One of my early mentors shared this mantra with me and it still is often quoted in my mind as I work today. Pair programming with this mentor he would even occasionally vocalize what step in this process we were in. "OK, so let's just make it work for this case", "Now that we got that working let's refactor it and make it more maintainable", "Now that our code is clean, is there something th
  18. Understanding The Dates Through the Julian and Gregorian Calendars
    Sep 12, 2022 · original
    The natural world has only given us two units of time determined by the cosmos, that is the year and the day. Months, hours, minutes, and seconds are all human inventions that have no basis in the natural world. Days and years are not this way though. A day, of course, is one complete rotation of the earth and a year is one rotation around the sun. The unfortunate part about this is that these two time periods are not actually related and don't fit within each other cleanly. Our current year takes 365 days, 6 hours, 9 minutes, and 10 seconds. We often simplify this to 365 1/4 days. So what is the problem with ignoring that last 1/4 of a day? It would simplify things if we didn't have to worry about it. The problem comes in the expected relationship between the time of the year and the season. If we didn't account for that additional 1/4 day we would end up changing when seasons happened
  19. The Story Of The System, Discovering the “Why” Behind The System
    Aug 30, 2022 · original
    Software development can be a fast-paced world, different fads come and go through the industry, many times what was old becomes new again and there are no less than three dozen vendors vying for you to build your system using their technology. This is just the nature of the industry. One of the many problems with this; however, is that often multiple fads or competing technologies can be found in the same system. Is it just a failed or abandoned migration? Are certain technologies to be used for certain use cases and others not? The way X was built seems wrong, why was it built that way? These very well might have been questions that you have asked yourself before. Having clear answers to these questions can have a profound impact on how effective you are within a system and thus are worth exploring. No matter the age of the system, every system and application has a story. Some systems
  20. Java Virtual Threads, Millions of Threads Within Grasp
    Aug 23, 2022 · original
    Virtual threads in Java have been a long-awaited feature in the Java language and we are finally getting to play with it in as a preview feature of Java 19. Virtual threads were added in JEP-425 as part of Project Loom. The goal of Project Loom is to enable a high-throughput, lightweight concurrency model in Java, virtual threads are a core part of enabling that goal. Why are virtual threads important? # In the early days of Java, the original threading model was similar to virtual threads in that the threads were managed in user space and did not use OS threads directly. However, in version 1.2 of Java this was changed. The modern concurrency model is that java.lang.Thread objects are simply a thin wrapper around OS threads. This honestly has served the language well for many years. However. it does come with its issues. The most common modern server threading model today is called "thr

Discovered by the rss-feed-index crawler, which checks each feed at most once a month.

Same record as JSON: https://api.agentalog.com/api/feeds/fd_blog_scaledcode_com_c434e53a30d4b29c. More from this site: blog.scaledcode.com in the Feeds tab.