Engineering blog

Filter by tag

blogs · 6 min

How to find and fix memory leaks in Go applications

Imagine one day you prepare a proof of concept application. You quickly write some code that shows your idea, add tracing and metrics so you can see how it performs, deploy the application to test environment and boom, after running for 1 hour the application restarts with Out Of Memory error. This screams "memory leak", but you look into the code and see nothing obvious. You may start thinking that overall restart every hour isn't that bad. If you are thinking like that, I encourage you to keep reading as I'm going to guide you on how to debug and fix memory leaks in Go applications.

November 24, 2022

blogs · 4 min

.tech Podcast - Flexible remote working at Form3

Jordan Van Dyk is Form3's first Canada based engineer. He joins us to share why he chose to work at Form3, what his interview experience was and what a typical day looks like for him on the Tooling team. Then, he shares how his team works and makes recommendations for how highly distributed teams can successfully work together.

November 17, 2022

blogs · 6 min

NACLS? Ain't nobody got time for that!

In this blogpost, Adam will try to convince you to implement AWS NACL as additional layer of network protection. He will go through some basics, present some best practices that you could leverage and in the end show how easy it is to implement NACLs in Terraform.

November 10, 2022

blogs · 7 min

Buckle Up Your mTLS With OAuth 2.0 Client Authentication and Certificate-Bound Access

Application security is a persistent hot topic in the technology industry. It is quite common to use mTLS in a business-to-business application, where security is incredibly important, and which uses the zero trust security model. mTLS is also popular with microservices and service mesh to ensure that sensitive resources are not accessible to unauthorised services in the network. mTLS is a transport layer authentication protocol. In this article, Milap Neupane explains: the basics of the mTLS and OAuth 2.0 protocol, the potential drawbacks with mTLS and how OAuth 2.0 Client Authentication and Certificate-Bound Access help improve security.

October 13, 2022

blogs · 7 min

Exploiting Distroless Images

Daniel Teixeira, Lead of Offensive Security at Form3 discusses exploiting Distroless images, covering the topics of:

  • Google Container Tools Distroless Base Image
  • Attack Surface
  • Abusing OpenSSL functionalities
  • Attack scenario

September 22, 2022

blogs · 5 min

.tech Podcast - Kubernetes as a cloud operating system

Natan Yellin joins us to his insights on the challenges of running software at scale, which now involves maintaining more complex system architecture than ever. Then, he walks us through the open-source tool Robusta Dev and how it can make running systems on Kubernetes easier!

September 15, 2022

blogs · 4 min

.tech Podcast - Measuring the success of engineering teams

Evelina Vrabie joins us to share her insights into measuring the success of engineering teams. She tells us about the role of an engineering manager as well as the four types of success. Then, she walks us through how to measure productivity and high performance through research-based frameworks.

August 16, 2022

blogs · 6 min

PKI certificate management

 I have a rough understanding of PKI certificates, how they work, and what TLS is in general. However, I've always struggled to understand the details, particularly from the point of view of an operator. How do I check if a certificate is valid? How do I check who issued it? What does it even mean to "issue" a certificate? To make matters worse, I'm frequently confounded by the variety of different file types used for certificates. Is it a pem, or a crt, or a pub? Speaking of pub, what's the difference between the TLS certificate my server uses to encrypt traffic, and the certificates I use for SSH authentication? In this post, I will answer these questions and then walk though a practical example of using certificates for TLS via a local nginx proxy, modeling the client/server TLS you often see on the web.

August 5, 2022

blogs · 5 min

.tech Podcast - Supporting diversity in tech

Leah Cohen from School of SOS joins us to share her insights into how tech leaders can support diversity in tech. She tells us about what diversity in tech is and why we should care about it. Then, she explains two key solutions to improving diversity: target the next generation and support transitioning into careers in tech.

July 27, 2022

1 of 4

left arrow right arrow