gsoltis

This is cool. I wonder if your VM could work in conjunction with an LLM? Have you tried making this optimizer available as an MCP, or maybe some of the calculated invariants could be exposed as well?

This matches my experience with AI agents. Wiring up the correct feedback and paying attention to ensure they use it is important. Tests and linters are great, but there's usually much more that human devs look at for feedback, including perceived speed and efficiency.

I agree, it is absolutely a matter of judgment and is heavily dependent on the stage and specific threats a particular organization faces. It is difficult to balance product velocity with the need to protect a growing "something to lose" that the company is accumulating.

I think one of the best things we can do as security professionals is to identify or work to create security measures that have outsized ROI and advocate for those. Using battle-tested software is one, as are, I believe, measures like MFA.

Good suggestion! The underlying tech actually does support diffing resources over time, so it would be very possibly to generate a delta report.

Hey all, we wrote rpCheckup after seeing the Endgame (https://news.ycombinator.com/item?id=26154038) post the other day. A lot of the issues it surfaces are things we routinely check for with our customers, but we are unaware of any open source tools that help AWS customers check on their own.

We would love to get your feedback and we hope you find it useful.

Hmm, maybe. Can you provide more details about what specifically you are trying to accomplish?

My company, Gold Fig(https://goldfiglabs.com), is working on something just adjacent to annotating webpages: we enable you to annotate changes you make on the web. Since so much of our work is powered by online platforms, we wanted a way to keep track of changes we were making in the tools we were using. Similar to how you would annotate a code change with a commit message, you should be able to annotate a CMS change, a platform settings change, or anything else you might be tweaking as you go about your work.

We'd love feedback from anyone who is interested in adding annotations, and especially those working on teams who could benefit from being able to share annotations.

We definitely understand that a lot of data is currently siloed, so to that end we're also interested in the annotation formats that we should be looking at. We currently export our own json format, but we would love to work well with existing tools.

To be clear, at Firebase, we held these kinds of discussions in addition to the technical assessment. A portion of my section of the interview process was usually to do a deep dive on a recent interesting project that the candidate had worked on, either sourced from their resume or just by asking. You're right that you can often tell their level of involvement by seeing how quickly the well of details dries up.

There are tradeoffs, but I found it to be an overall net positive in addition to the technical assessment. Doing this effectively requires that the interviewer have a pretty broad exposure to lots of different technology, otherwise you can't distinguish between someone BSing their role vs something you just don't know a lot about / can't ask intelligent questions about. It's also incredibly subjective, which would make me hesitant to rely on it without more objective criteria.

That is what we're aiming at. We're starting by capturing deltas, but we'll eventually be able to backfill the entire existing configuration, whether it has changed or not. That can then live alongside the configuration for your other services. This is where you get a lot of power: you'll be able to write tests or constraints across different services, for instance requiring DNS settings include ownership markers for your GSuite domain.

Currently, any changes made without the extension won't be tracked. For some services, we will eventually be able to capture the delta anyways, if they have API access to their own configuration. This, however, is still sub-optimal because you lose out on the commit message and the opportunity to capture the intent behind the change at the time that it's being made.

Our hope is that much like policies around code review, where often you can commit to master, but by policy you don't and request a review first, your coworkers will see the value in everyone contributing so that everyone is kept aware and the log is maintained.

Yup, that is definitely on the roadmap! You're right that it won't always be possible, but for many of the more popular tools, it can be done.

Thanks, and good suggestion!

I put together a gist with the currently supported services: https://gist.github.com/gsoltis/302b3e60d385854a9a5158d0c071...

For sure! Infrastructure as Code is great. However, there are plenty of instances where services you depend on cannot be configured with Terraform. Additionally, we have found that there are lots of companies who have a wide variety of setups across all of their teams (internal dashboards, engineering teams that are not focused on infrastructure, etc.). Some teams may be fully automated, while others are not. For some, it just isn't a priority. We hope that Gold Fig will work for them. We think that being able to represent the changes in the way that they are already used to making them will provide a stepping stone towards automating more of their setup.

Interesting. What are you using for object marshalling on iOS? And which json processor are you using on your android benchmark? The referenced library?

Surely the size of the JSON payload matters for this benchmark. Just saying you can parse json in under 1 ms is somewhat meaningless unless you're comparing similar sized json documents, as well as marshalling into a user-supplied class.

One data point, but sonic.net is great. Friendly service and consistently given top marks by the EFF on privacy concerns. Also, it's reasonably cheap and you can get a static ip with your service.

Edit: I'm not affiliated in any way.

I've been prototyping some bindings to make Firebase work with RxJava / RxJS, since the model seems like a good fit.

If anyone has the time and inclination, I'd love some feedback.

RxJava: https://gist.github.com/gsoltis/86210e3259dcc6998801 RxJS: https://gist.github.com/gsoltis/ee20138502a4764650f2

Also, is ReactiveCocoa what most people would use to do this in ObjC? https://github.com/Reactive-Extensions/Rx.ObjC doesn't seem particularly active.

Git integration is on our roadmap. However, you can also set this up yourself now by adding your own git hook that calls 'firebase deploy' on push. For more information, see the documentation for the commandline tool here: https://www.firebase.com/docs/command-line-tool.html

Ruby is on the list. In the meantime, you can use the REST API from any language. If you need the realtime aspects on your server, we have a node client as well.

Correct. There's a quickstart guide for using the Node SDK here: https://www.firebase.com/docs/nodejs-quickstart.html

You can also use the REST API (https://www.firebase.com/docs/rest-api-quickstart.html) to interact with Firebase from any platform.

Firebase engineer here. For things like chron jobs / emails / any logging you want to do, you can run a node server that uses the javascript SDK. That lets you do things like, "any time a user writes to this location, send an email with the contents of the data".

You can also observe arbitrary data changes and log any info that is relevant to you.

As for passwords, we have a few details here at the bottom of the page here: https://www.firebase.com/docs/security-quickstart.html

The short answer is that we use bcrypt for password storage.

Hope that helps!

Leading up to my current job, virtually none. However, at my current job (Firebase), it now makes up a significant percentage of what I do. The way I've described it to friends is: "You know how most companies ask you tree traversal/sorting/search questions in an interview, then when you show up for work the first day, your job turns out to be 'add this button to this web form'? We actually work on those algorithm problems." It helps that we are an infrastructure company and that our user interface is an API.

If this is something you're looking for, my recommendation is to look at either large companies that have large infrastructure needs (Google, Facebook, Twitter, Amazon, LinkedIn, etc.) or small infrastructure-related startups, depending on your preferred working environment. If the hard parts of your job are offloaded to the database/language runtime/middleware, look for companies that work on databases, language runtimes or middleware. And in the interview, ask them for examples of hard problems that they have solved.

Also, I have absolutely nothing against the companies that don't do this kind of work. In fact, Firebase exists so others don't have to do this kind of work. This is just an observation that occasionally, the skillset tested in these interviews is not in line with the responsibilities a successful candidate will end up having, so make sure you ask.

Hi, I'm one of the Firebase engineers working on keeping clients connected.

We use a mix of different methods to maintain a connection. We normally start with our custom long polling implementation and move to websockets when they are available. We do not currently make use of any flash sockets.