zaitanz

A X.509 Certificate lifecycle management, and secrets management SaaS designed from the ground up for home labs all the way up to enterprises. Built in PHP/Laravel and Rust.

https://www.zaita.com

So this confuses me slightly and I am keen to know the advantage of using this. I work on projects that heavily use auto-differentiation for complex models. The models are defined by user input files at run-time, so the state and execution pathway of the model is unknown at compilation time. Would this help?

Given that all auto-differentiation is an approximation anyways. I've found existing tooling (CppAD, ADMB, ADOL-C, Template Model Builder (TMB)) work fine. You don't need to come up with a differentiable problem or re-parameterize. Why would I pick this over any of those?

The platforms I work on function solely on user defined input files. For unit tests we have example configuration files stored in the application as strings (and #ifdef'd away for non unit test builds). Then we split the file loading to allow loading from memory (string/stream).

This works so well, we actually package a library with our binary that contains the unit tests so the end user can run them locally without having to download/build anything. This has been super useful in identifying calculation differences between Linux/Windows/MacOS and processors. When a user reports an issue, we can ask them to run the unit tests just by running (./binary --test) and then give us the results.

If you have cronjobs/scheduled tasks running every day to try and renew the certificate (as recommended), then you'd not have any issues with them revoking. Any certificates that are going to be revoked will be renewed before then; this is how LE works. They gave 5 days notice, and during that 5 day period any certificates that will revoked would be renewed.

For multiple servers running the same domain, you can configure them all the same and they will get certificates fine. If required, they will get a new certificate from LE; if this is not required then LE will provide the current certificate to the server. There maybe a short time where the actual certificate on two servers maybe different, but both would still be considered valid. So there really shouldn't be any plumbing required. (edit: This is dependent on you having a sensible way to load balance them. If you're just running IP round-robin then it's going to be difficult, but that is what scp and custom routes are for).

I use LE for multiple domains, on multiple systems. Internal and external with no issue. I've even had certificates revoked by LE and it's never had any operational impact.

In general, we will always start from a position of considering a developer machine to be infected. This is part of the Zero trust approach to security. We work with defense in depth. If the developer machine isn't trustworthy, and the developer isn't trustworthy, how do we best protect our systems and client data?

As you move through from code to production we have multiple stage gates and steps.

- From a code perspective, we use dependency and code scanning (yarn audit, sonarcloud, sonarcube etc). Sonarcloud has nice IDE integrations.

- Code is pushed and is picked up by a pipeline, further scans are done looking for vulnerabilities/CVEs etc. If any significant ones are found, the pipeline fails (yarn audit, sonarcloud, sonarcube, Palo Alto container scanner, docker bench etc)

- The pipeline deploys to test and does automated checking

- Prior to a production deployment, the pipeline must be manually approved.

- Once in production, we use further scanning and monitoring (Security Hub/Centre, Tenable, SIEM)

Our developers have no direct ability to change the production systems in any way. But, they can write code and commit to our Git repository as much as they want. Everything from that point is automated (except for manual approvals).

Oh that's really interesting and an area I hadn't considered writing about. But forced breeding in animals and the villagers is very much part of setting up the farms and villager professions.

Ahhh yes. The chicken farms where the chickens are flushed down a hole and automatically killed and cooked for you.

Thank you for your reply. I'm going to just lift your explanation as it's much better than my own.

Most likely. You can check with the pastebin code https://pastebin.com/thTapSgn . Local and Thread outputs should be the same.

This is very true. Once upon a time -o3 would enable fast-math. We're very careful to ensure we use test models to verify the outputs of release binaries. Enabling fast-math as you have said optimises the equations in a way that produces different results.

TBH. I had no idea this was a thing either. I was incredibly confused when I identified a single piece of code that was producing an variation in result.

Yes this is technically true, but it manifests itself through use of the MinGW compiler. When I first noticed the problem, there was very little indication as to the cause.

TBH I accredit dumb luck more than anything to finding the cause of this. It took many hours.

Op here. There is a huge amount of scientific code written in C++. Just have a look through https://www.coin-or.org/

This code was specifically C++ because we had the intention of integrating with libraries like CppAD and ADOL-C.

Op here. Yea this only occurs on Windows with MinGW. Visual C++ and Clang do not have this issue. None of the Linux compilers I tested also had this issue.

And yea you're right on the associative mistake. Will correct this :)

Op Here. Yes you are correct. Been very sleep derived when I wrote this (newborns eh). I'll update this.

I didn't want to go too far into the background of floating point math in the post as it wasn't ultimately the issue, just something I was mindful of.

For me, it's always about focusing on proving my idea correct as fast as possible.

I think X would be cool. - How quickly can I test if X is cool with quick and dirty tactics. I tend to use notepad and make notes along the way, so I can flesh it out into something reproducible later. If the idea doesn't work, at least I have a text file of my process and thinking during that time.

If it does work, I find being able to scaffold your projects quickly is key. Build a script that creates a common set of folders and a new git repository. Things like (notes, source, libraries, docs, archives etc). From here, you can just add things to your git repository as you develop/test/build your idea. It doesn't have to be a project that involves code, as you can manage any files from a git repository. They key is having that scaffolding.

Location: Wellington, New Zealand

  Remote: Yes, 10 years experience

  Willing to relocate: No

  Technologies: Cyber Security Architect, Solution Architect or Software Architect.

  - PCI-DSS, Anti-money Laundering, Privacy Act/GDPR, Public Records Act

  - NIST, ISO27001, ISO31000, CIS

  - Automating security compliance and risk assessments (risk modeling)

  - C++, Python, C#, Delphi, Javascript, 

  - SQL Databases, all kinds

  - Networking, TCP/IP, IOT

  - Linux

  Résumé/CV: https://github.com/Zaita/Public/raw/master/Scott%20Rasmussen%20CV%202020.10.pdf

  Email: scott[at]zaita.com