From Build Engineering to DevOps

Executive Summary

This document is for Build Engineers, DevOps Developers, and the people who hire them: Software Development Manager, VP Software Development, Director of Software Development. The goal of this document is to show how to improve a software environment using modern tools, such as those used in a DevOps environment.

First is a description of Build Engineering, next, how Build Engineering can be modernized with today’s tools and processes, then a discussion of how DevOps relates to a modern Build Engineering system.

The conclusion is that much of DevOps tools and processes are required by modern Build Engineering and can be used to improve any software development environment.

Password security officially becomes easier

The NIST* has modernized the password rules for US Government Department, specifically the “minimum requirements for federal information systems”. This is supposedly where every IT department gets their rules from, so maybe these better rules will be used, “soonish”, in bank machines and corporate workplaces.
– (Yeah, I said “soonish”. In this case, “soonish=”probably years from now”.)

What the NIST said:

I will summarize and link to the parts of the draft Guidelines that make passwords easier.

“Draft NIST Special Publication, 800-63B – Digital Identity Guidelines”:

• Section 5, Authenticator and Verifier Requirements
  • Section 5.1.1.1 – Don’t make the password artificially hard to remember by requiring “complexity rules”: UPPER, lower, numeric, special characters. (Rationale in Appendix A)
• Appendix A, Strength of Memorized Secrets
  • Why complex passwords are bad: “analyses of breached password databases reveals that the benefit of such [complexity] rules is not nearly as significant as initially thought, although the impact on usability and memorability is severe.”
  • Services should disallow passwords found in a list of commonly used passwords, such as “Password1!”, and “123456”.

For a longer explanation, see Slava Gomzin’s article on Venture Beat.

*  NIST = National Institute of Standards and Technology – part of the U. S. Dept. of Commerce)

CAPTCHA defined

Well! I thought it was a company name, so I never looked it up. As Ian says, “That’s my story, and, I’m gonna stick to it.”

Turns out CAPTCHA means:

• Completely Automated Public Turing test to tell Computers and Humans Apart

Source: nist.gov On that page, look under Definitions and Abbreviations.

Ottawa news: ITO 2.0, Technata, Docker

ITO 2.0 still exists!

ITO 2.0 is a specialized support service for high tech workers who are unemployed. They offer online training, workshops, career transition help, the works. When I was laid off in Sept, I tried to find it, couldn’t, and assumed it had disappeared. The staff at my local IE office did not connect me to it.

How to I show my SSH fingerprint with colons?

The newer version of ssh-keygen uses SHA256 hash to generate the fingerprint, whereas the older ones used an MD5 hash, which has the “cute widdle colons” between every pair of characters in the hash/fingerprint.

Probably your favorite web service shows the MD5-style hash, with the colons in it. To generate this for your SSH key, use this command line:

ssh-keygen -l -E md5 -f ~/.ssh/id_rsa.pub

Key:

• -l means generate the fingerprint
• -E means choose the type of hash to use for the fingerprint. You can choose md5, or sha256. sha256 is the default now.
• -f means choose the file to operate on

DevOps and cloud related Meetups

Site: Meetup.com
To find these meetups and similar ones, search for common keywords, like DevOps, AWS, and Cloud. You may need to search for the name of a particular group, or some subset of the name, and then click “Groups”.

DevOps Ottawa

Focusing on telling how real companies use DevOps, and where they are now in their journey.

Take (version) control of your network systems

Do you use a tool to record the current settings of your network devices, and compare them to older states?

Apparently RANCID does this.

– Shrubbery Networks, Inc. – RANCID

My fave IT guy didn’t know about this. I assume there are similar tools that are newer, RANCID has been around for a while.