Hardening Solaris Systems in Production When you’re running enterprise workloads on Solaris — databases, application servers, web fronts — the gap between “it works” and “it’s secure” is a lot wider than most people expect. I spent a good chunk of time working through hardening procedures for a fleet of Solaris boxes, and what follows is the procedure we landed on. The scope covered four server types: database, web, application, and utility. Every one of them got the same four security layers, regardless of role. ...

Vendor Assessment Type: Vendor Assessment Project Information Field Description Value Name Enter the name TPA: Project Name Whirlpool project name requesting third party or service provider connection TPA: Project Owner Whirlpool project owner requesting third party or service provider connection TPA: Business Area Whirlpool business area or process supported by the third party or service provider TPA: Service Provider Name Service provider company name TPA: Service Provider Contact Service provider or third party contact TPA: Target Implementation Date Target implementation date TPA: CISO Vendor Chief Information Security Officer (CISO) or equivalent TPA: User Directory Choose the user directory used to manage security and provisioning of access on your internal network TPA: OS and database List the operating system and database used to manage Whirlpool data TPA: Datacenter location List the location of the datacenter that hosts Whirlpool data OS/Database options: Mainframe, Unix, AS400, Windows, Oracle, DB2/UDB, MS SQL, Other ...

Mozilla announced Firefox OS back in 2011 under the codename Boot2Gecko, and since then the project has gone from a concept to something you can actually run on your desktop. I’ve been following it closely and finally got around to setting it up on my Ubuntu machine. Here’s how. What is Firefox OS? Firefox OS is Mozilla’s attempt at building a mobile operating system entirely from web standards. There’s no Java, no native SDK, no proprietary frameworks. The entire user interface – called Gaia – is built in HTML, CSS, and JavaScript. The rendering engine underneath is Gecko, the same one that powers Firefox. And at the bottom, it runs on a Linux kernel. ...

I’ve been staring at my iPhone all day and I got tired of how every WordPress blog looks the same – flat headers, generic sidebars, the whole deal. So I spent the evening building a theme that actually looks like iOS, and I’m putting it up for anyone who wants it. The whole thing is built around that familiar iOS table view look. Striped background, rounded white cells with the little chevron arrows, a search bar at the top that matches the system aesthetic. It’s not trying to be a 1:1 copy of the iPhone – it’s just borrowing enough of the visual language that people who spend their days in iOS will feel at home. ...

Release Engineering I’ve been thinking about how we get changes from a laptop into production without someone having to SSH in and type things by hand. The answer, as it turns out, is a pipeline. Nothing fancy. Just a chain of steps that each do one thing and pass the result to the next. Here’s what we’re building. Git Everything starts in a Git repository. Puppet manifests, config files, deployment scripts — all of it. If it’s not in Git, it doesn’t exist. This is the part that matters most and the part people resist the most, because Git means your changes are visible. ...

I picked this up a while back and it’s been sitting in my notes ever since. It’s a risk assessment checklist for software projects — the kind of thing you’d run through before committing to a contract or kicking off a big engagement. The original is a ten-page Word document with checkboxes. I’ve reorganised it here so it’s easier to scan. The categories are roughly in order of how you’d work through them: start with requirements, move through design and implementation, then look at process, people, and external pressures. ...

I ran into a situation recently where I needed a Perl script to launch another program, wait for it to finish, and move on. Nothing fancy. A simple spawn-and-wait. But doing it the naive way — backticks, pipe reads, polling — felt like overkill for what should be a two-liner. That’s where the Expect module comes in. It’s been around since the 90s, originally ported from the Tcl expect tool, and it does exactly what you’d expect: it spawns a process, talks to its stdin, reads its stdout, and waits for specific patterns. For simple cases it’s overkill. For anything that involves an interactive prompt or a non-trivial exit condition, it saves you from writing your own state machine. ...

There was a period, roughly 2004 to 2008, when phone manufacturers decided that phones could be fashion accessories. Not phones that looked like fashion accessories. Actual fashion accessories that happened to make phone calls. I collected a few of them, or at least got close enough to handle them, and I still think some of the best phones I’ve ever held had nothing to do with specs or benchmarks. Nokia 8800 Sirocco This was the one that started it for me. Stainless steel body, a sliding mechanism that felt like opening a luxury watch case, and a weight to it that told you it was built from something real. The Nokia 8800 Sirocco wasn’t trying to be a smartphone. It was trying to be a thing you pulled out of your pocket and knew, immediately, was expensive. It worked. ...

I prebooked an Aakash Ubislate tablet on its first day of availability. Two months later, I’m still waiting, and the email chain with Datawind’s support team tells the whole story. The booking confirmation Dear Shafiq, Your Booking ID is : xxxxxxxxx Someone from our sales team would get in touch with you and provide you with the payment and delivery options. The commercial version of the UbiSlate would be launched in early weeks of December. ...

I’ve been thinking about continuous delivery a lot lately, and the thing that keeps coming back to me is how much of a pain it is when someone logs into a server and makes a change by hand. You know the type. Production is down, someone jumps in, tweaks a config file, restarts a service, and everything works again. Great. Except now that server has a configuration that exists in no repository, no documentation, and no one else’s head. Next time something breaks, you’ll spend hours chasing a difference that nobody bothered to record. ...