TechBlog

In January I wrote about moving our frontend from AngularJS to Angular. That migration is still running — we are on Angular 4 now, which shipped in March and turned out to be a painless bump from 2.4. The bigger shift landed on the backend: our APIs used to live in Laravel, and we are rewriting them in Java with Spring Boot 1.5.3. This is my first real Java project. I have years of PHP — mostly Laravel — and a few months of TypeScript from the Angular work. I also wrote C# in college, which turns out to matter more than I expected. Java does not feel like learning a foreign language. It feels like meeting someone who speaks a dialect you half understand. ...

How it started A few days ago I just decided to give my Ubuntu a new look and experience. I thought KDE is not in a good situation and maybe Gnome 3 is a better option than Unity. The easiest option to try Gnome on Ubuntu (Without a clean install of OS) is to install it as a package: 1 sudo apt-get install ubuntu-gnome-desktop During the install process it asks for Display Manager, you have options to choose, gdm and lightdm, since I want to try Gnome, I select gdm: ...

Angular 2.0 shipped in September. We are on 2.4 now, and the release train is already moving — Angular 4 is being talked about openly. I have been building with it since October, migrating a medium-sized internal dashboard that lived in AngularJS for three years. This is not a tutorial and not a verdict. It is a field report from someone who still dreams in $scope sometimes. The context nobody warns you about If you spent years on AngularJS, you did not “upgrade.” You rewrote. Google offers ngUpgrade to run both frameworks side by side, and we tried it for two weeks before giving up. Our app had too many directives, too much implicit magic, and too many $watches buried in places nobody remembered. We picked a greenfield module, scaffolded it with the CLI, and started porting feature by feature. ...

Here’s how security vulnerabilities are supposed to be handled. One, a researcher discovers an issue. Two, the people who make the software find a solution. And three, the solution is then made available, ideally by automatic update. That’s what Windows does, and what Apple does. It isn’t always as fast as it should be, but at least once the fix exists it’s available almost instantly. Here’s how it works with Android. ...

Facebook has set the date: on September 30, the ancient and creaking SHA-1 hashing algorithm will make its tumbril trip and get the chop. SHA-1, designed by the NSA in 1995, is a one-way algorithm: a block of data is turned into a message digest. The digest can’t be turned back into the original message, but serves as a digital signature confirming the authenticity of (for example) the software you’ve downloaded. ...

The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations. The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites. ...