Schlomo Schapiro

My company sold old laptops to employees and I decided to use the chance to get an affordable and legally licensed Windows 10 system - a Dell Latitude E6420 . Unfortunately the system has a Broadcom Wifi card and also ships with an NVidia graphics card which require extra work on Ubuntu 16.04 Xenial Xerus . After some manual configuration the system works quite well with a power consumption of about 10-15W while writing this blog article. Switching between the Intel and the NVidia graphics card is simple (with a GUI program and requires a logout-login), for most use cases I don't need the NVidia card in any case. Windows 10 also works well, although it does not support all devices. However, the combined NVidia / Intel graphics systems works better on Windows than on Linux. In detail, I took the following steps to install an Ubuntu 16.04 and Windows 10 dual boot system. Step-by-Step Installation Requirements Either a wired network connection or a USB wifi dongle that ...

Summary:  Use digital identities, trust relationship and access control lists instead of passwords. In the cloud, this is really easy. I strongly believe that static credentials are one of the biggest hazards in modern IT environments. Most information security incidents are somehow related to lost or leaked or guessed static credentials, Instagram's Million Dollar Bug is just one very nice example. Static credentials can be used by anyone who has them - friend or foe are typically very short and can even be brute forced or guessed for machine or service users have to be stored in configuration files from where they can be leaked are hard to remember for humans so that they will write them down somewhere or store them in files typically stay the same over a long period of time don't include any information about the identity of the bearer or user are hard to rotate on a regular base because the change has to happen in several places at the same time All th...

The CoreOS Fest 2016 in Berlin impressed me very much: A small Open Source company organizes a 2 day conference around their Open Source tools and even flies in a lot of their employees from San Francisco. A win both for Open Source and for Berlin. And CoreOS also announced that they got new funding of $28M : Alex Polvi , CEO of CoreOS More interesting for IT people everywhere is the message one can learn here: Container technologies are ready for production. There is a healthy environment of Open Source solutions: Kubernetes , Mesosphere DC/OS , containerd , even OpenStack and others. Commercial editions with vendor support like Tectonic  (CoreOS), Mesosphere Enterprise or Hashicorp Atlas 3rd party tools solving common problems like persistent storage: StorageOS  and  Quobyte In fact, choosing the "right" platform starts to become the main problem for those who still run on traditional Virtualization platforms. On the other hand, IT companies who don't ...

The Open Source Data Center Conference 2016 is a good measure for how the industry changes. Compared to 2014 Cloud topics take more and more space. Both how to build your own on-premise cloud with Mesos , CoreOS or Kubernetes but also how to use the public Cloud. Maybe not surprising, I used the conference to present my own findings from 2 years of Cloud migration at ImmobilienScout24 : After we first tried to find  way to quickly migrate our data centers into the Cloud we now see that a hybrid approach works better. Data center and cloud are both valued platforms and we will optimize the costs between them. Hybrid Cloud - A Cloud Migration Strategy Do you use Cloud? Why? What about the 15 year legacy of your data center? How many Enterprise vendors tried to sell you their "Hybrid Cloud" solution? What actually is a Hybrid Cloud? Cloud computing is not just a new way of running servers or Docker containers. The interesting part of any Cloud offering are mana...

Everywhere there is some data that is relevant either for all applications or for many applications in different parts of the platform. The "obvious" solution to this problem is to make such data internally public or world-readable , meaning that the entire platform can read it. The "obvious" solution to security in this case is actually having no security  beyond ensuring the "are you part of us?" question. Common implementations of this pattern are world-readable NFS shares, S3 buckets readable by all "our" AWS accounts, HTTP APIs that use the client IP as their sole access control mechanism etc. This is approach is really dangerous and should be used with care. The risks include: You most likely don't know who actually needs the data and who not. If you ever need to restrict access you will have a very long and tedious job ahead of you. You don't know who accessed the data for which purpose. After a data leak, yo...

At the microXchg 2016 last week Fred George - who takes pride having been called a hand grenade - gave a very inspiring talk about how all the things that we do right now have one primary goal: Go Faster Reducing cycle time for deployments, automation everywhere, down-sizing services to "microservices", building resilient and fault-tolerant platforms and more are all facets of a bigger journey: Provide value faster and find out faster what works and what not. DevOps DevOps is seen by most developers as beeing an Ops movement to catch on with developers before their jobs become obsolete. Attending various DevOps Days in Germany and the USA, the developers who where also there always complained about the lack of developers and the lack of developer topics. They observed that the conference seems to be by and for Ops people. Consequently, DevOps conferences usually have two tracks: Methods and Tools. Methods teach us how to do "proper" software develop...

Day two at the microXchg 2016 conference. After listening to yet another talk detailing the pitfalls and dangers of "doing it wrong" I see more and more similarities between the Cloud migration at ImmobilienScout24 and the microservices journey that most speakers present. The Cloud migration moves us from a large data center into many smaller AWS accounts. A (legacy) monolithic application is cut into many smaller microservices. Internal data center communication becomes exposed communication between different AWS accounts and VPCs. Internal function calls are replaced with remote API calls. Both require much more attention to security, necessitate an authentication framework and add significant latency to the platform. A failed data center takes down the entire platform while a failed AWS account will only take down some function. An uncaught exception will crash the entire monolith while a crashed microservice will leave the others running undisturbed. Interna...

Today I was attending the Microxchg 2016 conference in Berlin. I suddenly realized that going to the cloud allows to ask completely new questions that are impossible to ask in the data center. One such question is this: What is the optimum size for a data center?  Microservices are all about downsizing - and in the cloud we can and should downsize the data center! In the world of physical data centers the question is usually goverened by two factors: Ensuring service availability by having at least two  physical data centers. Packing as much hardware into as little space as possible to keep the costs in check. As long as we are smaller than the average Internet giant there is no point to ask about the optimum size. The tooling which we build has to be designed for both large data centers and for having more than one. But in the "1, 2, many" series "2" is just the worst place to be. It entails all the disadvantages of "more than 1" without any o...

Docker provides a convenient way to package entire applications into runnable containers. OTOH in the data center we use RPM packages to deliver software and configuration to our servers. This wrapper build a bridge between Docker appliances and Linux services by packaging a Docker image as a Linux service into an RPM package. The resulting Linux service can be simply used like any other Linux service, for example start the service with service schlomo start . See the GitHub repo at  https://github.com/ImmobilienScout24/docker-service-rpm for code and more details and please let me know if you find this useful.

Photo: A. Reinkober / pixelio.de I recently met somebody who had a signet ring and suddenly realized that this is a very early form of 2-factor-authentication (2FA): Signet Ring 2FA Unique Unique Difficult to copy Supposedly impossible to copy Seal proves personal involvement of bearer 2FA token proves personal interaction of owner The main difference is of course that 2FA is commonly available to everybody who needs it while signet rings where and remain a special feature. But it is still nice to know that the basic idea is several thousands years old.

As ImmobilienScout24 moves to the cloud a recurring topic is the question about the exit strategy. An exit strategy is a plan for migrating away from the cloud, or at least from the chosen cloud vendor. Opinions range from "why would I need one?" to "how can we not have one?" with a heavy impact on our cloud strategy and how we do things in the cloud. When talking about exit scenarios it is worth to distinguish between a forced and a voluntary exit. A forced exit happens due to external factors that don't leave you any choice when to go. A voluntary exit happens at your own choice, both when and how. Why would one be force to have an exit strategy? Simple because running a business on cloud services carries other types of risks compared to running a business in your own data center: Cloud accounts can be disabled for alleged violation of terms Cloud accounts can be terminated There are no guaranteed prices. Running costs can explode as a result of a n...

Is Amazon good for DevOps? Maybe yes, maybe no. But for sure the new Berlin office is good for a Berlin DevOps Meetup . Jonathan Weiss gave a short overview over the engineering departments found here: AWS OpsWorks, AWS Solution Architects, Amazon EC2, Machine Learning. Michael Ducy (Global Partner Evangelist at Chef Software ) talks about DevOps and tells the usual story. Michael uses goats and silos as a metaphor and builds his talk from the famous goat and silo problem . He sees the "IT manufacturing process" as silos (read  History of Silos  for more about that) and DevOps minded people as goats: Multi-purpose, versatile, smart and stubborn at reaching their goals. The attendees of the DevOps event probably did not need much convincing, but the talk was nevertheless very entertaining. Michael has an MBA and also gave some useful insights into how organisations evolve into silos and how organisational "kingdoms" develop. The talk is available as video...

Today I went to the GRIPS Theater  ( English ) instead of the office. Once a year ImmobilienScout24 donates the work force to social projects, called Social Day . I used the opportunity to catch a glimpse behinde the stage. The theater in turn got a workshop from us about their web site and social media channels. But first we watched a very nice children show ( Ein Fest bei Baba Dengiz ) about a German guy who learned respect for foreigners - from another German with Turkish background. The show was well adapted to the school-age audience. The theater follows a somewhat unusual concept and places the stage in the middle of the audience: Foto mit freundlicher Genehmigung des GRIPS Theaters This was my first visit to the GRIPS Theater, but not the last. Besides a rich children programme the theater also offers shows for adults and is most famously known for the show Linie 1 .

This week was my Meetup Marathon: Microservices Meetup Berlin about  Software Memories and Simulated Machines by  William Louth . Berlin DevOps about Scaling Logstash: A Collection of War Stories  by  Pere Urbon-Bayes and "Continuous development with Nix" by  Rok Garbas . Sadly there was no time for the traditional fish bowl discussion. AWS User Group Meetup about  STUPS tools & components platform by Henning Jacobs and Distributed Log Refinement Discussion  by  Christian Kniep . Software Memories and Simulated Machines was above my head. Scaling Logstash made me wonder how many engineers you actually need to run that "properly". Nix is something we hopefully don't need, Rok actually said that if you package everything you don't need it. STUPS  is the "Cloud Ops" stack from Zalando , nicely published on GitHub : The STUPS platform is a set of tools and components to provide a convenient and audit-compliant Platform-...

Yesterday was the first OpenTechSummit in Berlin, a new conference that came partially in place of the LinuxTag . The conference squeezed a large amount of talks into a single day. The talks where either 10 or 20 minutes long and covered many non-technical topics related to open knowledge or open technology. One thing impressed me especially: All day long there where workshops for children and youth. While some kids took their first steps in coding, others came to work together on advanced programming or hardware projects. The date (a German state holiday) made sure that children had time to attend, many IT people came together with their children. The organizers where actually surprised by the large amount of children who registered for a free kids ticket. I gave my " DevOps, Agile and Open Source at ImmobilienScout24 " talk and put up some ImmobilienScout24 posters for our sponsoring. Tweets about @schlomoschapiro #ots15