You’re probably not doing DevSecOps so stop saying you are

I was a security consultant for 6 years, and I’ve been working in security for 10 years and if there’s one thing I’ve learned its this: IT and the rest of the business really doesn’t like or even understand security. We get in their way and we demand things of them that only help us, and the business never sees…

Moving away from Gitlab

A few years ago I switched my “business” code from Github to Gitlab. The reason for this was… well, I was bootstrapping a business. Every dollar counts, and Github’s private repos were $5/mo while Gitlab was free. Unfortunately almost immediately after I switched everything, Microsoft bought Github and started offering free private repos. I should have switched back immediately. But…

Do we still need dedicated security teams?

Dating back for decades now, most major companies and enterprises have had “security” teams. Sometimes called “IT Security” or “infrastructure security” or something along those lines. This group was responsible for everything from security policies to risk reviews to approving firewall changes. Sometimes they’d own things like IDS/IPS, anti-virus, and often strictly security tools like a SIEM, a WAF, or…

Inexpire – Personal Inventory Management

Recently I launched a new web app called Inexpire. It’s something I’ve been kicking around for about a year but finally got it out the door. Since I’m a fan of “build in public”, let’s walk through the app. What is Inexpire? Inexpire.com is a web application designed to track expiration dates and inventory numbers of things in your house.…

A serverless meme maker: Memendous

Adding text to an image… how hard could it be? Turns out not that hard, but still quite complicated. Here‘s the story behind Memendous.com. Concepts used:AWS Lambda/API Gateway/S3A custom Lambda LayerServerless FrameworkPython 3.x with Pillow (for the backend Lambda)Vanilla JS/HTML for the front endAWS Amplify for hosting I‘ve been looking for more serverless projects to get under my belt, and…

Lambda Layers

AWS Lambda ships with some software packages pre-installed, depending on which language runtime you pick. But what if you need something else? Typically in a serverfull environment you would install the package (or add it to your Cloudformation/Terraform/etc scripts) and be done with it. But in Lambda your options are a bit more limited. You can‘t just install something and…