List of Open Source Security Tools
As a founder of a security company, I’m constantly looking for open source tools to either incorporate in our offering, or get inspiration from, or provide integration with. And thereContinue reading
Always Name Your Thread Pools
Our software tends to use a lot of thread pools – mostly through java.util.concurrent.ExecutorService implementations (Created via Executors.new…. We create these for various async use-cases, and they can be seenContinue reading
Connecting to Kibana Within an AWS VPC
When you use the managed Elasticsearch service on AWS, you usually choose an encrypted connection (via KMS-managed keys), which means you can’t use just any tool to connect to yourContinue reading
Elasticsearch – Scalability and Multitenancy [slides]
Last week I gave a talk in a local tech group about my experience with Elasticsearch at LogSentinel, and how we achieve multitenancy and scalability. Obviously, the topic of scalabilityContinue reading
Content-Security-Policy Nonce with Spring Security
Content-Security-Policy is important for web security. Yet, it’s not mainstream yet, it’s syntax is hard, it’s rather prohibitive and tools rarely have flexible support for it. While Spring Security doesContinue reading
Releasing Often Helps With Analyzing Performance Issues
Releasing often is a good thing. It’s cool, and helps us deliver new functionality quickly, but I want to share one positive side-effect – it helps with analyzing production performanceContinue reading
Syntactic Sugar Is Not Always Good
This write-up is partly inspired by a recent post by Vlad Mihalcea on LinkedIn about the recently introduced text blocks in Java. More about them can be read here. Now,Continue reading
Creating a CentOS Startup Screen
When distributing bundled software, you have multiple options, but if we exclude fancy newcomers like Docker and Kubernetes, you’re left with the following options: an installer (for Windows), a packageContinue reading
My Advice To Developers About Working With Databases: Make It Secure
Last month Ben Brumm asked me for the one advice I’d like to give to developers that are working with databases (in reality – almost all of us). He publishedContinue reading
Discovering an OSSEC/Wazuh Encryption Issue
I’m trying to get the Wazuh agent (a fork of OSSEC, one of the most popular open source security tools, used for intrusion detection) to talk to our custom backendContinue reading