Daily Tech Digest - May 14, 2026

---

Quote for the day:

“You may be disappointed if you fail, but you are doomed if you don’t try.” -- Beverly Sills

---

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 20 mins • Perfect for listening on the go.

CIOs are put to the test as security regulations across borders recalibrate

The European Union’s Cyber Resilience Act (CRA) marks a transformative shift in global cybersecurity, forcing Chief Information Officers to transition from traditional process-oriented compliance toward a rigorous focus on tangible product safety. Unlike previous frameworks, the CRA extends the CE mark to digital systems, mandating that software, firmware, and internet-connected devices be "secure by design" and "secure by default." This recalibration requires organizations to implement robust vulnerability reporting mechanisms by September 2026 and provide minimum five-year support lifecycles for security updates. CIOs now face the daunting task of overseeing the entire product ecosystem, which includes performing continuous risk assessments and actively managing open-source dependencies. They can no longer remain passive consumers of open-source technology; instead, they must contribute back to these communities to ensure the integrity of their own supply chains. While the regulation introduces significant administrative burdens—such as the creation of Software Bills of Materials and decade-long documentation retention—it also provides a strategic lever. Savvy IT leaders are leveraging these stringent mandates to secure board-level buy-in and the necessary budget for critical security improvements. Ultimately, the CRA demands a fundamental shift in responsibility, where CIOs are held accountable for the end-to-end security of the final products their organizations deliver to the market.

The Mathematics of Backlogs: Capacity Planning for Queue Recovery

The article "The Mathematics of Backlogs: Capacity Planning for Queue Recovery" explains that queue backlogs in distributed systems are predictable arithmetic challenges rather than random mysteries. At the heart of recovery is surplus capacity, defined as the difference between total processing power and arrival rate, meaning systems provisioned only for steady-state traffic will never naturally drain a backlog. A critical insight is the non-linear relationship between utilization and queue growth; as utilization approaches 100%, even minor traffic spikes cause exponential backlog accumulation. To manage this, the author highlights Little's Law for calculating queue delays and provides a clear formula for sizing consumer headroom based on specific Recovery Time Objectives (RTO). The piece also warns of "retry amplification," which can trigger metastable failure states where recovery efforts generate more load than they can actually resolve. In complex, multi-stage pipelines, identifying the true bottleneck is essential to avoid scaling the wrong component. Furthermore, engineers are encouraged to implement load shedding when drain times exceed message TTLs to prevent wasting expensive resources on stale data. Ultimately, by measuring specific metrics like peak backlog size and retry amplification factors after incidents, teams can transition from gut-based guesswork to data-driven operational intuition, ensuring significantly more resilient and predictable system performance during unforeseen failures.

Closing the gap between technical specs and business value through storytelling

Jay McCall’s article explores the critical necessity for infrastructure-focused software companies to pivot from technical specifications to value-driven storytelling. For businesses dealing with backend systems like APIs or security middleware, value is often defined by the absence of failure, making the product essentially invisible to non-technical executives. To bridge this gap, companies must stop relying on abstract metrics like uptime percentages and instead articulate the business outcomes and peace of mind their technology provides. The article advocates for the use of experiential demonstrations, such as AI-driven simulations, which allow prospects to engage with the software and witness its problem-solving capabilities firsthand. Additionally, visual workflows should prioritize the user’s journey over technical architecture, humanizing the product and placing it within a recognizable business context. Grounding these concepts in real-world "before and after" case studies further builds trust by offering tangible templates for success. Ultimately, crafting a repeatable narrative not only accelerates the sales cycle for internal teams but also empowers channel partners to communicate value effectively. By mastering the art of storytelling, technical organizations can translate complex backend sophistication into compelling business cases that resonate with decision-makers and facilitate sustainable scaling in a competitive market.

The Critical Fork: How Leaders Turn Failure Into Better Decisions

In the Forbes article "The Critical Fork: How Leaders Turn Failure Into Better Decisions," author Brent Dykes explores the pivotal moment leaders face when project results fail to meet expectations. He introduces the "Critical Fork" framework, which highlights a fundamental choice between two distinct paths: to deflect or to inspect. Deflection involves shifting blame toward external circumstances or team members, effectively shielding a leader's ego but simultaneously obstructing any potential for organizational growth or objective learning. In contrast, the inspection path encourages leaders to treat disappointing outcomes as valuable data points rather than personal setbacks. By choosing to inspect, organizations can uncover hidden root causes, challenge flawed underlying assumptions, and refine their future strategies with greater precision. Dykes argues that the most effective leaders cultivate a culture of psychological safety where failure is viewed not as a source of shame but as a vital catalyst for deeper analysis. This systematic approach transforms setbacks into "actionable insights," a hallmark of Dykes’ broader professional work in data storytelling and analytics. Ultimately, the article posits that leadership quality is defined less by initial successes and more by the ability to navigate these critical forks. By institutionalizing an inspection mindset, businesses foster resilience and ensure every failure becomes a stepping stone toward more robust and informed strategic choices.

From Bottlenecks to Breakthroughs, Enterprises Are Rethinking Analytics in the Lakehouse Era

The article "From Bottlenecks to Breakthroughs: Enterprises Are Rethinking Analytics in the Lakehouse Era" examines the transformative shift in data management as organizations transition from fragmented architectures to unified platforms. It highlights the immense pressure on centralized data teams to deliver reliable insights at high speed while supporting the complex integrations required for generative AI. Historically, enterprises have faced significant bottlenecks caused by the siloing of data and AI, privacy concerns, and a heavy reliance on highly technical staff. To overcome these hurdles, the article advocates for the lakehouse architecture—pioneered by Databricks—as an open, unified foundation that merges the best features of data lakes and warehouses. By integrating these systems into a "Data Intelligence Platform," companies can democratize access across various skill sets through low-code solutions, such as those provided by Rivery. This evolution enables breakthrough efficiencies, including a reported 7.5x acceleration in data delivery and substantial cost reductions. Ultimately, the piece emphasizes that the winners in the modern era will be those who effectively harness unified governance and seamless orchestration to move beyond operational sprawl. By adopting these integrated strategies, enterprises can finally turn data chaos into actionable intelligence, fostering a proactive environment where AI and analytics thrive in tandem to drive competitive advantage.

Most Remediation Programs Never Confirm the Fix Actually Worked

The article titled "Most Remediation Programs Never Confirm the Fix Actually Worked" argues that despite unprecedented environment visibility, cybersecurity teams struggle to ensure that remediation efforts effectively eliminate underlying risks. Highlighting a stark disparity between exploitation speed and corporate response time, the piece references Mandiant’s M-Trends 2026 report, which identifies a negative mean time to exploit, contrasting sharply with a thirty-two-day median remediation period. The emergence of advanced AI-driven tools like Mythos has further compressed exploitation windows, making traditional "patch and pray" methods increasingly dangerous and obsolete. Many organizations mistakenly equate closing an administrative ticket with resolving a vulnerability; however, vendor patches can be bypassable, and temporary workarounds often fail under evolving network conditions. This critical issue is exacerbated by organizational friction, where security teams identify risks but rely on separate engineering departments to implement fixes, leading to fragmented communication and delayed technical actions. To address these systemic gaps, the article advocates for a fundamental shift from measuring activity to focusing on outcomes. Instead of simply verifying that a specific attack path is blocked, modern programs must incorporate rigorous revalidation to confirm the total removal of the exposure. Ultimately, true security is achieved not through ticket completion, but by creating a self-correcting feedback loop that measures risk closure.

What CISOs need to land a board role

As cybersecurity becomes a critical pillar of organizational stability, Chief Information Security Officers (CISOs) are increasingly pursuing board-level positions to bridge the gap between technical defense and strategic governance. To successfully land these roles, security leaders must shift their focus from operational execution to high-level oversight. The article emphasizes that boards are not seeking another technical operator; rather, they prioritize strategic insight, calm judgment, and the ability to articulate cybersecurity through the lenses of risk appetite, value creation, and long-term resilience. Aspiring CISOs should start by gaining experience in governance-heavy environments, such as non-profit boards or industry committees, to refine their understanding of organizational stewardship. Furthermore, investing in formal governance education, such as NACD or AICD certifications, is highly recommended to build credibility. Networking remains a vital component of the process, as many opportunities arise through established relationships. Effective candidates must also cultivate a "board bio" that highlights their expertise in financial management, regulatory navigation, and crisis response. By reframing cyber issues as matters of trust and corporate strategy rather than just technical threats, CISOs can demonstrate the unique value they bring to a board, ultimately helping companies navigate complex digital landscapes with confidence and strategic foresight.

Everything you need to know about how technology is changing business

Digital transformation is the strategic integration of technology to fundamentally overhaul business operations, efficiency, and effectiveness. Rather than merely replicating existing services in a digital format, a successful transformation involves rethinking core business models and organizational cultures to thrive in an increasingly tech-centric landscape. Key technological drivers include cloud computing, the Internet of Things, and the rapid evolution of artificial intelligence, particularly generative and agentic AI. While the COVID-19 pandemic accelerated adoption, today’s initiatives are fueled by the need to compete with nimble startups and navigate macroeconomic volatility. However, the process is notoriously complex, expensive, and risky, often requiring a shift in mindset from simple IT upgrades to comprehensive business reinvention. Despite criticisms of the term as industry hype, it represents a critical shift where technology is no longer a secondary support function but the primary engine for long-term growth. Experts emphasize that the foundation of this change is a robust, secure data platform that enables trustworthy AI operations. Ultimately, digital transformation is a continuous journey of innovation that enables established firms to adapt, scale, and deliver enhanced customer experiences. By prioritizing outcomes over buzzwords, organizations can bridge the gap between innovation and execution, ensuring they remain relevant in a global economy where every successful company is effectively a technology business.

Intelligent digital identity infrastructure for GenAI

The article explores the transformative convergence of the Modular Open Source Identity Platform (MOSIP) and Generative Artificial Intelligence (GenAI) to build a sophisticated, intelligent digital identity infrastructure. As a foundational digital public good, MOSIP offers a vendor-neutral framework that preserves national digital sovereignty while ensuring secure and scalable citizen identity systems. By integrating GenAI, these platforms move beyond static registration to become intuitive, human-centric service hubs. Key benefits include the deployment of multilingual conversational assistants that assist underserved populations with enrollment, the automation of legacy record digitization through intelligent document processing, and enhanced fraud detection capable of identifying sophisticated AI-generated deepfakes. Furthermore, GenAI empowers administrators with natural language tools to derive actionable insights from complex demographic data. However, the author emphasizes that this integration must adhere to strict principles of privacy by design, explainability, and human oversight to prevent data exploitation and surveillance risks. By utilizing technologies like container orchestration, vector databases, and localized small language models, nations can create a modular and sovereign ecosystem. Ultimately, this synergy aims to transition identity from a mere database record to a dynamic "Identity as a Service," fostering global digital inclusion by bridging literacy and language barriers for citizens everywhere.

73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation

The article titled "73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation" explores the widening performance gap between modern attackers and traditional security defenses. It highlights a startling reality where AI-driven threats can breach a network in just 73 seconds, while organizations typically require 24 hours or longer to deploy critical patches. This vulnerability is deepened by the fact that the median time from a CVE publication to a working exploit has plummeted to only ten hours as of 2026. According to the piece, the core challenge is not a lack of security software but the "spaghetti handoff"—the fragmented, slow communication between different teams and disconnected security tools. To address this, the article champions the transition to autonomous security validation, a strategy that merges Breach and Attack Simulation with automated penetration testing. By creating a continuous, AI-powered loop for alert triage, simulation, and remediation deployment, companies can eliminate manual bottlenecks and respond at machine speed. Ultimately, this shift is framed as a mandatory evolution for surviving the "Post-Mythos" era of cybersecurity, where defenses must become as proactive, dynamic, and rapid as the sophisticated, automated exploits they seek to prevent.

Daily Tech Digest - April 15, 2020

Weekly health check of ISPs, cloud providers and conferencing services

Outages for ISPs globally were down 9.13% during the week of March 30 from the week before, whereas U.S. outages were down 16.7%, dropping from 120 to 100. Worldwide the outages were also down, from 252 to 229. Public cloud outages rose worldwide from 22 to 25, and in the U.S. there was one outage, up from zero the previous week. Outages for collaboration apps rose dramatically, increasing more than 260% globally and more than 500% in the U.S. over the week before. The actual numbers were an increase from eight to 29 worldwide, and up from 4 to 25 in the U.S. ... During the week April 6-Apri 12, service outages for ISPs, cloud providers, and conferencing services dropped overall. They went from 298 down to 177 globally (40%, a six-week low), and in the U.S. dropped from 129 to 72 (44%). Globally, ISP outages were down from 229 to 141 (38%), and in the U.S. were down from 100 to 56 (44%). Cloud provider outages were also down overall from 25 to 19 (24%), ThousandEyes says, but jumped up from one to six (500%) in the U.S., which saw the highest rate of increase in seven weeks. Even so, the U.S. total was relatively low. “Again, cloud providers are doing quite well,” ThousandEyes says.

A Smattering of Thoughts About Applying Site Reliability Engineering principles

Google has a lot more detail on the principles of “on-call” rotation work compared to project-oriented work. Life of An On-Call Engineer. Of particular relevance is mention of capping the time that Site Reliability Engineers spend on purely operational work to 50% to ensure the other time is spent building solutions to impact the automation and service reliability in a proactive, rather than reactive manner. In addition, the challenges of operational reactive work and getting in the zone on solving project work with code can limit the ability to address the toil of continual fixes. Google's SRE Handbook also addresses this in mentioning that you should definitely not mix operational work and project work on the same person at the same time. Instead whoever is on call for that reactive work should focus fully on that, and not try to do project work at the same time. Trying to do both results in frustration and fragmentation in their effort. This is refreshing, as I known I've felt the pressure of needing to deliver a project, yet feeling that pressure of reactive work with operational issues taking precedence.

Coronavirus: Zoom user credentials for sale on dark web

Analysis of the database found that alongside personal accounts belonging to consumers, there were also corporate accounts registered to banks, consultancies, schools and colleges, hospitals, and software companies, among many others. IntSights said that whilst some of these accounts only included an email and password, others included Zoom meeting IDs, names and host keys. “The more specific and targeted the databases, the more it's going to cost you. A database of random usernames and passwords is probably going to go pretty cheap because it's harder to utilise,” Maor told Computer Weekly. “But if somebody says they have a database of Zoom users in the UK the price is going to get much higher because it's much more specific and much easier to use.” Whilst it is not uncommon at all for usernames and passwords to be shared or sold, Maor said that some of the discussions that followed had been intriguing, with the sale spawning a number of different posts and threads discussing different approaches to targeting Zoom users, many of them focused on credential stuffing attacks.

Remote work will be forever changed post-COVID-19

The problem with these two competing visions is that they assume we'll return to an extreme version of a pre-COVID-19 scenario, either doubling down on traditional remote working arrangements, or spending even more time traveling and sitting in offices, working the way we always did before the virus. I believe that the key lessons many of us will take from this period of enforced remote work are less about location, and more about time and work management. One thing I noticed and confirmed with several colleagues early in my COVID-19 experience was that productive video conferences were mentally more exhausting than an equivalent in-person meeting. A two-hour workshop over videoconference had the same mental drain as an all-day affair in an in-person meeting, especially for the presenters and facilitators. The medium seems to force more intense interactions, and more planning to successfully orchestrate. Collaborating in the same physical space was the pre-COVID-19 norm since it was easy.

Comparing Three Approaches to Multi-Cloud Security Management

IaC is a second approach to multi-cloud management. This approach arose in response to utility computing and second-generation web frameworks, which gave rise to widespread scaling problems for small businesses. Administrators took a pragmatic approach: they modeled their multi-cloud infrastructures with code, and were therefore able to write management tools that operated in a similar way to standard software. IaC sits in between the other approaches on this list, and represents a compromise solution. It gives more fine-grained control over cloud management and security processes than a CMP, especially when used in conjunction with SaaS security vendors whose software can apply a consistent security layer to a software model of your cloud infrastructure. This is important because SaaS is growing rapidly in popularity, with 86% of organizations expected to have SaaS meeting the vast majority of their software needs within two years.  On the other hand, IaC requires a greater level of knowledge and vigilance than either CMP—or cloud-native approaches.

DevOps implementation is often unsuccessful. Here's why

The primary feature of DevOps is, to a certain extent, the automation of the software development process. Continuous integration and continuous delivery (CI/CD) principles are the cornerstones of this concept, and as you likely know, are very reliant on tools. Tools are awesome, they really are. They can bring unprecedented speed to the software delivery process, managing the code repository, testing, maintenance, and storage elements with relatively seamless ease. And if you’re managing a team of developers in a DevOps process, these tools and ​the people who use them are a vital piece of the puzzle​ in shipping quality software. However, while robots might take all our jobs and imprison us someday, they are definitely not there yet. Heavy reliance on tools and automation leaves a window wide open for errors. Scans and tests may not pick up everything, code may go unchecked, and that presents enormous quality (not to mention, security) issues down the track. An attacker only needs one back door to exploit to steal data, and forgoing the human element in quality and security control can have disastrous consequences.

Videoconferencing quick fixes need a rethink when the pandemic abates

A tier down from its immersive telepresence big brother is the multipurpose conference room. Inside offices, companies have designated multipurpose rooms, equipped more minimally with videoconferencing equipment. Instead of spending big bucks on devoting an entire room, with all of the bells and whistles, to an immersive telepresence system, why not outfit a conference room with enough cameras, screens and microphones to offer a good virtual meeting experience, while still leaving the room to be used for general meetings? These multipurpose rooms generally cost a few thousand dollars to outfit with a camera, a microphone array and maybe some integrated digital whiteboards, and a PC or iPad as a control mechanism, Kerravala says. It's a lot more affordable, but a multipurpose conference room still is bandwidth intensive. And it's likely to be tapping bandwidth on the shared network – instead of having its own pipe, as an immersive room would – and that needs to be taken into consideration in network capacity planning.

Information Age roundtable: Harnessing the power of data in the utilities sector

When it comes to data usage across the company, a major aspect to be considered is the trust that is placed in employees. For Graeme Wright, chief digital officer, manufacturing, utilities and services at Fujitsu UK, “data is only trusted with certain people. “Sometimes, it goes across organisational boundaries, because of the third-party suppliers that people are using, and I don’t know if people have really been really incentivised to exploit the value of that data.” Wright went on to explain that the field force “need a different method of interacting to make sure that the data flows freely from them into the actual centre so we can actually analyse it and understand what’s going on”. Steven Steer, head of data at Ofgem, also weighed in on this issue: “This is really central to the energy sector’s agenda over the last year or so. The Energy Data Task Force, an independent task force, published its findings in June, and one of the main findings was the presumption that data is open to all, not just within your own organisation. 

How Does Low-Code Fit Into the Cloud-Native World?

At first glance, low-code and cloud-native don’t seem to have much to do with each other — but many of the low-code vendors are still making the connection. After all, microservices are chunks of software code, right? So why hand-code them if you could take a low-code approach to craft your microservices? Not so fast. Microservices generally focus on back-end functionality that simply doesn’t lend itself to the visual modeling context that low-code provides. Furthermore, today’s low-code tools tend to center on front-end application creation (often for mobile apps), as well as business process workflow design and automation. Bespoke microservices are unlikely to be on this list of low-code sweet spots. It's clear from the definition of microservices above that they are code-centric and thus might not lend themselves to low-code development. However, how organizations assemble microservices into applications is a different story. Some low-code vendors would have you believe that you can think of microservices as LEGO blocks that you can assemble into applications. Superficially, this LEGO metaphor is on the right track – but the devil is in the details.

Graph Knowledge Base for Stateful Cloud-Native Applications

As a rule, stateless applications do not persist any client application state between requests or events. “Statelessness” decouples cloud-native services from client applications to achieve desired isolation. The tenets of microservice and serverless architecture expressly prohibit retention of session-state or global-context. However, while the state doesn’t reside in the container, it still has to live somewhere. After all, a stateless function takes state as inputs. Application state didn’t go away, it moved. The trade-off is that state, and with it any global-context, must be re-loaded with every execution. The practical consequence of statelessness is a spike in network usage, which results in chatty, bandwidth and I/O intensive, inter-process communications. This comes at a price – in terms of both increased Cloud service expenditures, as well as latency and performance impacts on Client applications. Distributed computing had already weakened the bonds of data-gravity as a long-standing design principle, forcing applications to integrate with an ever-increasing number of external data sources. Cloud-native architecture flips-the-script completely - data ships to functions.

---

Quote for the day:

"Leaders must be good listeners. It's rule number one, and it's the most powerful thing they can do to build trusted relationships." -- Lee Ellis

---

Daily Tech Digest - April 01, 2020

Providers address capacity, supply-chain challenges brought on by COVID-19

In terms of physical infrastructure, Netflix had to overcome some supply-chain obstacles. "We have had multiple fires at this point with our supply chain," Temkin said. For example, the primary server manufacturer for Netflix is located in Santa Clara County, Calif., where residents have been ordered to shelter in place. "We had 24 hours to figure out how to get as many of the boxes out of there as we possibly could," he said. Netflix has resolved those supply issues, for the most part, by sourcing elsewhere. "By and large, we've been able to use most of the infrastructure we have deployed. Partners like Equinix have been great about getting cross-connects provisioned quickly where we need them in order to get interconnects beefed up in certain markets," Temkin said. On the content-production side, there's not a lot happening – at Netflix or anywhere else – as studios halt film and TV production to avoid further fueling the outbreak. "One of the big challenges we are trying to figure out is: what parts of it can we restart?" Temkin said.

Key risk governance practices for optimal data security

From cyber security standards to policies around articulating data handling processes and providing transparent updates, the organization needs to clearly understand all of the compliance standards relevant to it. In addition, it needs to make sure its regulatory readiness processes extend to not just internal compliance and risk management but also to compliance with regulations like General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). This is especially important for heavily regulated industries such as banking, financial services, technology, where many of the organizations’ business models are rooted in customer data To support the two elements above, the organization needs to undertake a sustained effort to seamlessly map out its data handling process across the stages of acquisition, storage, transformation, transport, archival, and even disposal. 

Lay the groundwork for a SecOps team structure

The overriding factor that separates IT and security teams is organizational misalignment; the two teams often report up through different management structures. The executives leading each faction -- the CIO and CISO, respectively -- typically have different goals, which are measured and rewarded by disparate key performance indicators (KPIs). In addition, the CIO is often perceived as being higher in the executive pecking order. To create a culture of shared security across the organization, give the CISO and other IT security leaders more status and authority. Include them in the strategy, planning and early development phases of new IT and application projects and treat them as a trusted partner. Shared authority at the executive level requires shared goals. IT operations and security teams will likely continue to have separate budgets and distinct projects, but hold managers in each organization accountable for common -- or at least comparable and tightly related -- objectives and KPIs.

COVID-19 puts new demands on e-health record systems

IT staffers are also required to update EHR systems as additional clinical workers are drafted for duty. “Some health providers have reported that they're being kept very busy with setting up processes for quickly onboarding new staff and changing their role within the system,” said Jones. “That requires a change in configuration of the EHR in terms of their role-based access, and in some cases it is creating new user accounts.” As workflows are updated to deal with the COVID-19 response, it is important that EHR systems don’t impede clinicians’ work, are straightforward and seamlessly integrate with existing care delivery processes. “The EHR workflow really needs to disappear into the background as providers ramp up to address COVID-19 capacity surges,” said Jones.  “At a fundamental level, all EHRs need to be working as intended — now more than ever,” said Bensinger. “And not only clinical workflows and features. You want to be sure that the registration and billing components are also collecting accurate and complete information.

Who’s responsible for protecting personal information?

Americans are split on who should be held most responsible for ensuring personal information and data privacy are protected. Just over a third believe companies are most responsible (36%), followed closely by the individuals providing their information (34%), with slightly fewer holding the government most responsible (29%). Half of Americans don’t give companies (49%) and government (51%) credit for doing enough when it comes to data privacy and protection. Notably, compared to the other countries surveyed, Americans are most likely to put the burden on individuals—in fact, it’s the only country where the individual consumer outranks government as most responsible. “Americans are outliers compared to other countries surveyed in that they are willing to accept a lot of the responsibility in protecting their own data and personal information,” says Paige Hanson, chief of cyber safety education, NortonLifeLock. “This could be the year Americans truly embrace their privacy independence, particularly with the help of new regulations like the California Consumer Privacy Act giving them control over how their data is used.”

Can cloud computing sustain the remote working surge?

Currently, cloud providers are still doing a good job in distributing resources among tenants, but at some point rationing measures may need to be implemented to respond to overwhelming demand. Not all cloud services are going to drown though. Matthew Prince, co-founder and CEO of Cloudflare, said that providers may have “individual challenges spurred by the pandemic” – their ability to cope with the shift in usage is highly dependent on their IT architecture. Major cloud providers such as Amazon have expressed confidence in meeting customer demand for capacity. By and large, public cloud providers seem to be coping well with the skyrocketing demand – there has yet to be any issues of major cloud crashes just yet. What providers should really be concerned about is the challenges that will come post-pandemic. By then, enterprises would have already recognized the unquestionable value of cloud, and will double down on cloud migrations. Cloud providers must make sure that their data infrastructure is prepared to support data at unprecedented scales. Warren Buffet once remarked: “you will only find out who is swimming naked when the tide goes out.”

Writing Microservices in Kotlin with Ktor—a Multiplatform Framework for Connected Systems

Ktor (pronounced Kay-tor) is a framework built from the ground up using Kotlin and coroutines. It gives us the ability to create client and server-side applications that can run and target multiple platforms. It is a great fit for applications that require HTTP and/or socket connectivity. These can be HTTP backends and RESTful systems, whether or not they’re architectured in a microservice approach. Ktor was born out of inspiration from other frameworks, such as Wasabi and Kara, in an aim to leverage to the maximum extent some of the language features that Kotlin offers, such as DSLs and coroutines. When it comes to creating connected systems, Ktor provides a performant, asynchronous, multi-platform solution. Currently, the Ktor client works on all platforms Kotlin targets, that is, JVM, JavaScript, and Native. Right now, Ktor server-side is restricted to the JVM. In this article, we’re going to take a look at using Ktor for server-side development. ... routing, get, and post are all higher-order functions. In this case, we’re talking about taking functions as parameters. Kotlin also has a convention that if the last parameter to a function is another function, we can place this outside of the brackets.

Get ready for the post-pandemic run on cloud

Business seems to change around pain. In the past weeks companies that had already migrated to public cloud had a strategic advantage over those still operating mostly in traditional data centers.  Traditional data centers are the responsibility of enterprise IT, and as such they are run by human employees who have to deal with mandatory lockdowns or even self-quarantine and may not be able to operate remotely. I have a CIO friend of mine who has a down physical storage system and a direct replacement sitting next to it, shrink-wrapped and ready to be installed. So far, he can’t get enough qualified staffers physically in the data center to make the swap. As a result, a major system is not operating, and they are losing millions a week. Those who have migrated to public clouds don’t have to deal with such things. The virtual and ubiquitous nature of cloud computing that scared so many IT pros during the past several years is actually one of the major reasons to move to public cloud. The weakness for enterprise IT recently has been the inability to support a physical set of systems that need physical fixes by humans.

Using Zoom while working from home? Here are the privacy risks to watch out for

Privacy experts have previously expressed concerns about Zoom: In 2019, the video-conferencing software experienced both a webcam hacking scandal, and a bug that allowed snooping users to potentially join video meetings they hadn't been invited to. This month, the Electronic Frontier Foundation cautioned users working from home about the software's onboard privacy features. Here are some of the privacy vulnerabilities in Zoom that you should watch out for while working remotely. ... Employers, managers and workers-from-home, beware. Zoom's tattle-tale attention-tracking feature can tell your meeting host if you aren't paying attention to their meticulously-composed visual aids. Whether you're using Zoom's desktop client or mobile app, a meeting host can enable a built-in option which alerts them if any attendees go more than 30 seconds without Zoom being in focus on their screen.  If you're anything like me, your Zoom meetings rarely consume your full screen. Jotting down notes in a separate text file, adding dates to calendars, glancing at reference documents or discreetly asking and answering clarifying questions in a separate chat -- these key parts of any normal meeting are all indicators of an engaged listener.

Neural computing should be based on insect brains, not human ones

Marshall is referring to a form of deep-learning computing for which developers are creating electronic architectures that mimic neurobiological architectures that could replace traditional computing. Deep-learning computing falls within artificial intelligence in which computers learn through rewards for recognizing patterns in data. A difference is that in deep learning neural processes are used. Variations include neuromorphic computing that I wrote about here that can analyze high- and low-level detail such as edges and shapes. Bees “are basically mini-robots,” says Marshall, quoted in the Daily Telegraph. “They’re really consistent visual navigators, they can navigate complex 3-D environments with minimal learning and using only a million neurons in a cubic millimeter of the brain.” That size element could grab the attention of developers who are working toward tiny robots that communicate with each other to self-organize and could be used, for example, to move objects in factories.

---

Quote for the day:

“When I look at...great experiences, it’s often more to do with the DNA than the MBA.” -- Shaun Smith

---

Daily Tech Digest - March 28, 2020

Coronavirus transforms peak internet usage into the new normal

"We've been watching the network very closely," said Joel Shadle, a spokesman for Comcast. "We're seeing a shift in peak usage. Instead of everyone coming home and getting online, we're seeing sustained usage and peaks during the day." AT&T reported Monday that on Friday and again on Sunday it hit record highs of data traffic between its network and its peers, driven by heavy video streaming. The company also said it saw all-time highs in data traffic from Netflix on Friday and Saturday with a slight dip on Sunday. And the company reported that its voice calling traffic has been way up, too. Wireless voice calls were up 44% compared to a normal Sunday; Wi-Fi calling was up 88% and landline home phone calls were up 74%, the company said in its press release Monday.  AT&T also said it has deployed FirstNet portable cell sites to boost coverage for first responders in parts of Indiana, Connecticut, New Jersey, California and New York. Cloudflare, which provides cloud-based networking and cybersecurity services and which has been tracking worldwide data usage, noted in a blog post last week that it had seen network usage increase as much as 40% in Seattle, where the coronavirus first broke out in the US.

The Ecommerce Surge: Guarding Against Fraud

As more consumers shift to online shopping during the COVID-19 pandemic, retailers must ramp up their efforts to guard against ecommerce payment fraud, says Toby McFarlane, a cybersecurity expert at CMSPI, a payments consultancy. "Retailers should have in place already tools to monitor fraud and approval rates" so they can be benchmarked, McFarlane says in an interview with Information Security Media Group. "If you see a spike in fraud, for example, you want to know if that's a general industry trend or if that is something specific to your business." The shift toward ecommerce in recent weeks presents opportunities to gain a competitive advantage, McFarlane says. "We've seen average transaction values are increasing online, so if merchants can ensure their online infrastructure and experience is set up to handle that, then we could see certain merchants taking market share from non-optimized merchants," he says.

How to refactor the God object antipattern

It's not good enough to simply write code that works. That code must be easily maintained, enhanced and debugged when problems happen. One of the reasons why object-oriented programming is so popular is because it delivers on these requirements. But antipatterns often appear when developers take shortcuts or focus more on the need to get things done instead of done right. One of those common antipatterns is the God object. One of the main concepts in object-oriented programming is that every component has a single purpose, and that component is only responsible for the properties and fields that allow it to perform its pertinent functions. ... Good object-oriented design sometimes takes a back seat to a need to get things done, and the single responsibility model gets thrown out the window. Then, out of nothingness, the God object emerges. In simple terms, the God object is a single Java file that violates the single-responsibility design pattern because it: performs multiple tasks; declares many unrelated properties; and maintains a collection of methods that have no logical relationship to one another, other than performing operations pivotal to the application function.

What’s Next in DevOps?

DevOps is aimed at "actualizing agile" by ensuring that teams have the technical capabilities to be truly agile, beyond just shortening their planning and work cadence. Importantly, DevOps also has Lean as part of its pedigree. This means that there is a focus on end-to-end lifecycle, flow optimisation, and thinking of improvement in terms of removing waste as opposed to just adding capacity. There are a huge number of organisations and teams that are still just taking their first steps in this process. For them, although the terminology and concepts may seem overwhelming at first, they benefit from a wide range of well-developed options to suit their development lifecycle needs. I anticipate that many software tools will be optimizing for ease-of-use, and continuing to compete on usability and the appearance of the UI. Whereas most early DevOps initiatives were strictly script and configuration file based, more recent offerings help to visualise processes and dependencies in a way that is easily digested by a broader segment of the organization.

Tips for cleaning data-center gear in response to coronavirus

Dell has come up with some guidance for cleaning its data center products. It's well timed, as data-center operators are tasked with implementing access and cleaning procedures in response to COVID-19. It's a real issue. The two biggest data center and colocation providers, Equinix and Digital Reality Trust, are restricting visitors to their facilities for the time being. Since the hardware in colocation data center is owned by the clients, they have every right to visit the facility to perform maintenance or upgrades – but not for now. Meanwhile, data-center staff have been declared essential and are exempt from California's "stay at home" order, so like grocery store and banking staff, data center workers can go to work. Right off the bat, Dell acknowledges that its data center products "are not high touch products," and that data centers should have a clean room policy where people are required to sanitize their hands before they enter. If your gear does need sterilization, Dell recommends engaging a professional cleaning company that specializes in sterilizing data center equipment. If that's not possible, then you can do it yourself as a last resort.

States of shock: Recovering our tech economy after COVID-19

Segal says the effects of the current economic downturn may be compounded by crises of confidence throughout the world, and reactions to the uncertain nature of the virus' transmissivity path — particularly in those countries where uncertainty preceded action. But that uncertainty, being a psychological factor, could be remedied in short order, giving her optimism that the global economy, including technology, could resume its previous course by the end of 2020. "We've certainly had at least a pause," remarked ZDNet contributor Ross Rubin, principal analyst with Reticle Research. He noted Apple's warning of supply chain disruptions for components for iPhone and other devices. As a supplier itself, it first closed its retail outlets inside China, and later as infection cases within China subsided, reopened those stores at roughly the same time it closed its retail outlets outside China. "The reports that we're getting back now is that the factories are starting to gear up again," Rubin continued. For example, Apple has announced product refreshes for iPad, still on schedule for May. "There seems to be some confidence there that, while those products do not ship in anywhere near the same volumes as iPhones — particularly the iPad Pro, which is a more premium product — they are introducing new, cellular-enabled products."

Aisera: The Next Generation For RPA (Robotic Process Automation)

A good way to look at this is as a simple equation: AI + RPA = Conversational RPA. When you converge AI and RPA, you get Conversational RPA. AI provides a human-like dialogue interface for users providing similar consumer-like application experiences, like those of Alexa, Whatsapp, Instagram, and Snapchat. This simple natural human-like interface interacts and performs the duties, tasks, IT workflows, and business workflows. RPA is used to automate simple and complex workflows that are highly repetitive that are typical of back-office functions. Most of these should not require humans to manage, monitor or execute them. Conversational RPA’s self-learning ability reduces the barrier for user adoption and lends itself to expediting complex challenges like cloud and application integrations, compliance, audit trail creation, and user experience analysis that require complex workflows. Conversational RPA supports new workflows, existing workflows and provides a way to customize workflows to meet business needs.

Automate security testing and scans for DevSecOps success

Automated security testing analyzes environments to make sure they meet expectations. Organizations mandate particular environment configurations to meet security and performance goals, but you don't know that the configuration is as expected without testing. Processes like white box and black box testing can help QA engineers pinpoint potential vulnerabilities before it's too late. If configuration is out of specification, the software team can halt the release and remediate the security deficiencies themselves, or alert the security team. Remediation on the fly might be the better option if automation is in place, such as declarative configuration management, to handle configuration drift. If you have both red teams -- aggressive fake attackers -- and blue teams -- their counterparts enacting defenses -- in security, this is also the phase in which you should launch real attacks against your code. If the app can't handle it, it's time to go back to the drawing board with the developers to make the product more resilient. If the app passes, push to production with peace of mind.

Quantum entanglement breakthrough could boost encryption, secure communications

Generating photons at two micrometres had never been demonstrated before. A major challenge for the researchers was to get their hands on the appropriate technology to conduct their experiment. "You need detectors that are able to see single photons at two micrometres, and we had to develop the right technology for these measurements," says Clerici. "And on the other side, you also need a specific piece of technology to generate the photons." In partnership with technology manufacturer Covesion, Clerici and his team engineered a nonlinear crystal that was suitable for operating at two micrometers. Photons are generated when short pulses of light from a laser source pass through the crystal. In theory, the entangled photons generated at the new wavelength should be able to travel as far as the photons generated through existing methods, and used for satellite communication. But the new experiment is still in its early stages, and Clerici said that the team hasn't yet identified how much information the new technology can communicate, or how quickly.

Google's MediaPipe Machine Learning Framework Web-Enabled with WebAssembly

The browser-enabled version of MediaPipe graphs is implemented by compiling the C++ source code to WebAssembly using Emscripten, and creating an API for all necessary communications back and forth between JavaScript and C++. Required demo assets (ML models and auxiliary text/data files) are packaged as individual binary data packages, to be loaded at runtime. To optimize for performance, MediaPipe’s browser version leverages the GPU for image operations whenever possible, and resort to the lightest (yet accurate) available ML models. The XNNPack ML Inference Library is additionally used in connection with the TensorflowLite inference calculator (TfLiteInferenceCalculator), resulting in an estimated 2-3x speed gain in most of applications. Google plans to improve MediaPipe’s browser version and give developers more control over template graphs and assets used in the MediaPipe model files. Developers are invited to follow the Google Developer twitter account.

---

Quote for the day:

"Leadership is the other side of the coin of loneliness, and he who is a leader must always act alone. And acting alone, accept everything alone." -- Ferdinand Marcos

---

Daily Tech Digest - March 23, 2020

You Need to Know SQL Temporary Table

We have been warned to NOT write any business logic in databases using triggers, stored procedures, and so on. It doesn’t mean we don’t need to know database systems. Being competent in database systems could save us a lot of work. For example, managers or customers often send us an email or a short notice asking for some one-off reports. Then we need to quickly log into the database servers and generate reports with either a list of parameters or a CSV file from requesters. ... There are two types of temporary tables: local and global temporary tables. Both of them share similar behaviors, except that the global temporary tables are visible across sessions. Moreover, the two types of temporary tables have different naming rules: local temporary tables should have names that start with a hash symbol (#); while the names of global temporary tables should start with two hash symbols (##). All temporary tables are stored in System Databases -> tempdb -> Temporary Tables.

Remote work tests corporate pandemic plans

IT leaders across the country are shifting gears from accommodating short-term remote work strategies for snowstorms, hurricanes and other natural disasters to how to help workers plan for and remain productive in a longer-term remote work environment. Due to the duration of the pandemic, Miami-based ChenMed, an operator of 60 senior health centers in the eastern U.S., intends to offer the small number of 2,500 users who don't have a laptop, such as front desk staff, the opportunity to take home their desktops so they can continue to answer patient calls and conduct other business. "Yes, it creates a lot more complexity in helping users set that up, but we want them to have a great experience versus trying to use an old computer at home," CIO Hernando Celada said. This strategy gives him confidence that the machines will be secure when the time comes for workers to be sent home, which will be at the first sign of community spread of the virus because ChenMed's patient population is the most vulnerable.

Private cloud reimagined as equal partner in multi-cloud world

Forrester's Gardner argues that repatriation is not a broad trend. "It's simply not true," he says. There may be some companies moving a specific application back to the private cloud for performance, regulatory or data gravity reasons, but repatriation is a relatively isolated phenomenon. The latest Gartner thinking on repatriation is in agreement with Gardner. "Contrary to market chatter that customers are abandoning the public cloud, consumption continues to grow as organizations leverage new capabilities to drive transformation. Certain workloads with low affinities to public cloud may be repatriated, largely because the migrations were not sufficiently thought through. But few organizations are wholly abandoning the public cloud at any technology layer," reads a 2019 Gartner report from analysts Brandon Medford, Sid Nag and Mike Dorosh. Warrilow says flatly, "Repatriation in net terms is not happening." He adds that there will always be a small number of workloads that go back to the private cloud as part of an organization's ongoing evaluation of the best landing spot for specific workloads.

What’s New in SQL Monitor 10?

SQL Monitor does the best job it can, out of the box, of setting up a useful core set of metrics and alerts, with sensible thresholds. However, the right alerts and the right thresholds are 100% dependent on your systems. A group or class of servers may all need the same alert types with the same thresholds, but these may well be different from those for other classes of server. Also, your group of VMWare-based servers, for example, may need different thresholds than your bare-metal servers for the same set of memory-related alerts. Configuring all this in the GUI, server-by-server, can be time consuming and it’s easy to introduce discrepancies. This alert configuration task, just like any other SQL Server management or maintenance task should be automated. With the PowerShell API, you now write PowerShell scripts to set up the alerts on a machine in a way that is exactly in accordance with your requirements. You then use that as a model to copy all the settings to other machines, or just groups of machines.

Can APIs be copyrighted?

The law is very clear about copyright. If a programmer writes down some code, the programmer owns the copyright on the work. The programmer may choose to trade that copyright for a paycheck or donate it to an open source project, but the decision is entirely the programmer’s. An API may not be standalone code, but it’s still the hard work of a person. The programmers will make many creative decisions along the way about the best or most graceful way to share their computational bounty. ... APIs are purely functional and the copyright law doesn’t protect the merely functional expressions. If you say “yes” to a flight attendant offering you coffee, you’re not plagiarizing or violating the copyright of the ancient human who coined the word “yes.” You’re just replying in the only way you can. Imagine if some clever car manufacturer copyrighted the steering wheel and the location of the pedals. The car manufacturers have plenty of ways to get creative about fins and paint colors. Do they need to make it impossible to rent or borrow a car without a lesson on how to steer it? The law recognizes that there are good reasons not to allow copyright to control functional expressions.

From Zero to Hero: CISO Edition

With new attacks forming faster than the technologies to fight them, holding CISOs to an entirely unrealistic standard doesn’t actually serve anyone. The truth is that no matter how many technologies are deployed or how good the security posture is, 100% protection from cyberattacks is simply not possible. Perhaps senior leadership and boards of directors are finally starting to acknowledge this fact, or perhaps they're starting to realize that a successful response to an attack, along with actions by other parts of the organization, contribute to the ultimate scale and scope of the event. CISOs are uniquely capable of gauging cyber-risk and how to reduce it. Experienced CISOs understand the threats their companies face and know how to deploy the optimal mix of people, processes, and technologies, weighed against threats, to provide the best possible level of protection. Organizations that understand this are leading the charge in shifting the perception of the CISO from technical manager to strategic risk leader.

Most common cyberattacks we'll see in 2020

By convincingly impersonating legitimate brands, phishing emails can trick unsuspecting users into revealing account credentials, financial information, and other sensitive data. Spear phishing messages are especially crafty, as they target executives, IT staff, and other individuals who may have administrative or high-end privileges. Defending against phishing attacks requires both technology and awareness training. Businesses should adopt email filtering tools such as Proofpoint and the filtering functionality built into Office 365, said Thor Edens, director of Information Security at data analytics firm Babel Street. Business-focused mobile phishing attacks are likely to spread in 2020, according to Jon Oltsik, senior principal analyst for market intelligence firm Enterprise Strategy Group. As such, IT executives should analyze their mobile security as part of their overall strategy. "Spam filters with sandboxing and DNS filtering are also essential security layers because they keep malicious emails from entering the network, and protect the user if they fall for the phishing attempt and end up clicking on a malicious hyperlink," said Greg Miller, owner of IT service provider CMIT Solutions of Orange County.

Las Vegas shores up SecOps with multi-factor authentication

Las Vegas initially rolled out Okta in 2018 to improve the efficiency of its IT help desk. Sherwood estimated the access management system cut down on help desk calls relating to forgotten passwords and password resets by 25%. The help desk also no longer had to manually install new applications for users because of an internal web portal connected to Okta that automatically manages authorization and permissions for self-service downloads. That freed up help desk employees for more strategic SecOps work, which now includes the multi-factor authentication rollout. Another SecOps update slated for this year will add city employees' mobile devices to the Okta identity management system, and an Okta single sign-on service for Las Vegas citizens that use the city's web portal. Residents will get one login for all services under this plan, Sherwood said. "If they get a parking citation and they're used to paying their sewer bill, it's the same login, and they can pay them both through a shopping cart."

Coronavirus challenges capacity, but core networks are holding up

Increased use of conferencing apps may affect their availability for reasons other than network capacity. For example, according to ThousandEyes, users around the globe were unable to connect to their Zoom meetings for approximately 20 minutes on Friday due to failed DNS resolution. Others too are monitoring data traffic looking for warning signs of slowdowns. “Traffic towards video conferencing, streaming services and news, e-commerce websites has surged. We've seen growth in traffic from residential broadband networks, and a slowing of traffic from businesses and universities," wrote Louis Poinsignon a network engineer with CloudFlare in a blog about Internet traffic patterns. He noted that on March 13 when the US announced a state of emergency, CloudFlare’s US data centers served 20% more traffic than usual. Poinsignon noted that Internet Exchange Points, where Internet service providers and content providers can exchange data directly (rather than via a third party) have also seen spikes in traffic. For example, Amsterdam (AMS-IX), London (LINX) and Frankfurt (DE-CIX), a 10-20% increase was seen around March 9.

7 ways the tech and services industry could be transformed

With a large segment of the population confined to their homes having to consume bandwidth, the internet free-for-all we have enjoyed to date is all but done. Emergency legislation or an executive order needs to be enacted to limit video content streaming to 720p across all content services, such as from Netflix, Hulu, Apple TV, Disney+, YouTube, and other providers. Traffic prioritization and shaping need to be put in place for core business applications during prime hours, which includes video conferencing for business and personal use. This would effectively be the opposite of net neutrality, as an emergency measure. Internet video streaming traffic should be prioritized for essential news providers, and the government should provide incentives for them to broadcast their content (and for home-bound citizens to consume it) over-the-air (OTA) so that additional bandwidth can be freed up. Remember the antenna and devices with built-in tuners? It may be an appropriate time to shift some programming back to the airwaves, and even bring back the DVR, so that programming can be transferred to devices during off-hours when networks aren't saturated.

---

Quote for the day:

"Individual commitment to a group effort - that is what makes a team work, a company work, a society work, a civilization work." -- Vince Lombardi

---