Nov 7, 2015 - 1 minute read - Security

Apple ID password rant

The theatrical demand from OSX and iOS for constantly re-entering the Apple ID password is a substantial enemy of security. I just upgraded two laptops, a server, an iPhone, and restored an iPad. I think I had to enter the same passwords six times per device. In general use they’re no better, regularly nagging for a password for piddling tasks like updating an app or downloading a song. For me with separation-of-concern accounts and 20+ character generated passwords this is a major annoyance, especially on a tablet keyboard.

Sep 8, 2015 - 2 minute read - Development

Using URL helpers in Rails ActiveJob background jobs

I’ve just moved some of our code to run asynchronously and found that URL helpers aren’t available inside ActiveJob jobs; at least, not the way they are within Rails views, controllers and mailers. We can fix this; read on for how. I wanted to simply write: 1 2 3 4 5 class NotificationJob < ActiveJob::Base def perform(object, message) NotificationService.send(url_for(object), message) end end … but invocation threw a NoMethodError because jobs don’t have url_for available.

Aug 24, 2015 - 3 minute read - Security

Privilege escalation

Back in the dim & distant past – late 1999, although no records capture the exact date – I was asked to compromise a server and gain root access. I said yes. This is the first and only time I have deliberately cracked a live, production server. This was not as questionable an undertaking as it sounds. I knew of the machine in question, and I knew its operator, and he still had a working secure shell login.

Jul 23, 2015 - 3 minute read - DevOps

Health checks with Stethoscope behind an SSL Elastic Load Balancer

I am rather fond of the Stethoscope gem for monitoring, since it lives inside the runtime Ruby process and can directly check on Rails without being subject to it. Returning HTML or JSON as required it also makes a nice responder for health checks from Nagios and AWS Elastic Load Balancers. Using Stethoscope is as simple as adding the gem in your Gemfile and installing an initializer in e.g. config/initializers/stethoscope.rb:

Jul 13, 2015 - 1 minute read - DevOps

Hook AWS notifications into Slack with a Lambda function

We have AWS RDS instances that send lifecycle notifications to an SNS topic. This was ending up in email, but I prefer to receive notifications in a Slack channel. Fortunately they are easy to integrate using AWS Lambda and Slack’s webhooks. Here’s the Lambda function I’m using[1], which parses the message object (if it can) and formats the notifications before posting. Note: the following links will require both AWS and Slack logins.

Jul 12, 2013 - 4 minute read - Development

Using arrays of hstore with Rails 4

UPDATE: The patch below has now been merged into edge rails and should appear in the 4.1 release as well as, hopefully, a backport into 4.0.3. One of the attractive new things in Rails 4 is the enhanced support for PostgreSQL array and hstore column types, amongst other things. There are quite a few articles describing their use – here’s a clear one – and there are subtleties with strong parameters.