Testing Philosophy
Tests provide confidence. They provide confidence during development, in new deployments, and continuously in production (monitoring). Flaky tests, on the other hand, fail or pass for the same configuration, and
Itai Frenkel' Post
Security 101 for SaaS Startups
Things I wish my first boss had told me
So you are working at a startup, and you have been wondering at what point should you start looking into security considerations and compliance? Which technical debt should be postponed for a later stage, and which systems should be hardened this instant? What are the main considerations?
Technical debt gets piled up, and in many cases it is easier to pay later rather than now. For example, if you are using ElasticSearch without username/passwords, you should double check your firewall settings. After round-B your startup would probably have the manpower and budget to properly secure the ElasticSearch cluster.
Startup culture is a bit more difficult to change "later". Let's take a trivial example. Developers that are used to pushing code without code review, would complain that peer review would bog down the development, and it might even smell "too corporate" for them.
So which security considerations are relevant at an early stage?
What security concerns were raised by customers willing to pay for your product?
What are the security expectations in your industry (Medical, Finance, Enterprise)?
What are the target market (country) regulations (Data Privacy, Data Residency)? Europeans are known to have tougher regulations. Different US States have different regulations.
Which tools and policies would not hurt your team's morale.
How long would it take you to prepare a security risk plan (see example at the bottom of this document)?
What is the impact of Intellectual Property theft, business plans theft, bitcoin/ec2 theft, losing all your data ? How would it affect your sales, customers, investors?
How can you protect against a data breach?
How can you reduce the exposure after a data breach?
We grouped together the expected security recommendations by the different phases a start-up goes through. The more money and data the startup handles, the bigger the investment in security:
9.5 Low Latency Decision as a Service Design Patterns
A few hundred milliseconds latency is achievable for a complex fraud prevention system, but with very little wiggle room. In the past two years, we have selected a few design patterns that have helped us achieve our latency goals, using standard technologies used by most SaaS companies (load balancers, queues,
Comparing Message Queue Architectures on AWS
In Forter, we crunch multiple data streams each with its own different requirements. In order to choose the right tool for the job we mapped different event dispatching architectures that suit our needs.
For transaction processing we require durable job queue and for event processing we require high throughput event queue.
Can we agree on Dependency and Version Management ?
Purpose of the game
Get your team engaged in a heated debate about an opinionated subject
(in this case Versioning and Dependency management)
Setup
- Two groups of developers sitting around a table.
- A Judge that is very opinionated about the subject. The more controversial the better.
- A Host that can handle a raging crowd.
- A cellphone
23 percent of Software Developers are Addicts
If you haven’t seen the Software Architecture Addict website. Enjoy! 
The video was shot with a Nexus 5 mobile phone, a tripod and iStablizer Mount XL and edited with Windows Movie Maker – nothing fancy. The dark scenes were shot