15 Year Blog Anniversary


Today is the 15th anniversary of this blog.  As most of you know, 15 years in technology is forever.  15 years on the web is even more so.  Here are a few highlights to give you a perspective:

  • First post dates back to October 26th 2001.  It wasn’t my first blog post ever.  It’s just that the earlier history wasn’t migrated into the current archives.
  • Archives page provides access to posts of every month of every year, except April and May of 2009, which were lost during a major outage at a hosting company at the time.
  • The blog survived a multitude of migrations between blogging applications and their versions (static HTML diary, Nucleous CMS, Blog:CMS, WordPress), design changes (a dozen or so WordPress themes), and hosting companies (from a home server to the current Amazon AWS setup).
  • Way over 8,000 posts written.  Hundreds of comments, pingbacks and trackbacks received.  These varied across a large number of topics, anything from personal, work, technology, movies, photography, Cyprus, and more.
  • Millions of page views.  Hundreds of thousands of unique visitors.
  • Millions of blocked SPAM comments.  Millions of (mostly automated) attacks, varying from SQL injections and dictionary password attacks to a some more advanced techniques targeting particular pages or WordPress and its plugins vulnerabilities.
  • A variety of content reorganizations – posts, pages, categories, tags, short codes, templates, plugins, widgets, links, etc.
  • A variety of integrations – web services, social networks, automated postings, aggregations, etc.
  • A variety of monetization options – from “this is not for profit”, to ad spaces, to contextual ads, to sponsored content.

Have a look at some versions saved by the Internet Archive, dating back to 2004.

So, what have I learned about blogging in the last 15 years?  Quiet a bit, it turns out.  Here are a few things that I think are important enough to share:

  • If you don’t have your personal blog yet, go and start now.  It’s well worth it!
  • Make sure you own your content.  Social networks come and go, and when they go, chances are, all your content goes with them.
  • Don’t stress too much about the format, styling, and scheduling of your blogging.  If you do it long enough, everything will change – the topics you write about, how much and how often you write about them, how your site looks, etc.  Start somewhere and iterate.
  • Don’t go crazy with features of your blogging platform.  Sure, there are thousands of plugins and themes to choose from.  But all of these change with time.  When they go away, you will have to either support them yourself, move to newer alternatives, or loose them.  Neither one of those options is pleasant.
  • Things die.  They disappear and then they are no more.  That’s life. This happens.  Don’t worry about it.  Do your best and then move on.
  • Have fun!  It’s your personal place on the web after all.  Try scheduled posts to get into the habit.  Try planning to get a better idea of what you want to do.  But if it doesn’t work or becomes too difficult, move on.  As I said, it’s your personal place and you don’t owe anybody anything.  Do it for yourself.  Others will come and go.

Here is to the next 15 years! :)


Using tables with Markdown in Redmine

We use Redmine for our project management needs in the office.  It works pretty well, but there are, as with anything, a few rough corners.  One thing in particular that I was trying to figure out is how to use tables in Wiki pages, issues, etc.

The official documentation says that tables are not supported and you need to use HTML.  Yuck.  I do, of course, know how to mark up tables in HTML, but that’s definitely not the most pleasant of experiences.  Especially if you need to modify them later.  So I dug deeper.

It turns out that the documentation is outdated.  Modern Redmine versions (we are on 3.3.0) use the redcarpet library for parsing Markdown, which supports tables just fine.  Here is an example of the Markdown that you can use in pretty much any textarea field:

| Header 1     | Header 2     |
| ---          | ---          |
| Row 1 Cell 1 | Row 1 Cell 2 |
| Row 2 Cell 1 | Row 2 Cell 2 |

And it’ll render as a table just fine. The dashed line separating headers should have at least 3 dashes for the parser to understand it correctly. But you can extend the dashes for the whole width of the column.

tagbar-phpctags : Vim plugin for PHP developeres


If you are using Vim editor to write PHP code, you probably already know about the excellent tagbar plugin, which lists methods, variables and the like in an optional window split.  Recently, I’ve learned of an awesome phpctags-tagbar plugin, which extends and improves this functionality via a phpctags tool, which has a deeper knowledge of PHP than the classic ctags tool.

Once installed, you’ll have a more organized browser of your code, with support for namespaces, classes, interfaces, constants, and variables.

PHP: array_merge_recursive() vs. array_replace_recursive()

Here is a nice blog post describing the important differences between array_merge_recursive() and array_replace_recursive() functions in PHP.  These are often overlooked when testing new developments with simpler data structures.  Troubleshooting for it later is not too obvious.

Yet another bit on security

Here are a couple of interesting articles from the last few days on Slashdot.

First, comes in a very non-surprising survey saying that “40 percent of organizations store admin passwords in Word documents“.  Judging from my personal experiences in different companies, I’d say this number is much higher if you extend the Word documents to Excel spreadsheets and plain text files.  I think pretty much every single company I’ve worked at used such common files for admin password storage (at least at some point).

“Why or why?!!!”, the security concerned among you might scream.  Well, I think there are two reasons for this.  The first one is that password management is complicated.  There are tools that help with this, but even those are rarely easy to use.  Storing the passwords in a secure, encrypted storage is one thing.  But, how do you share them with just the right people? How do you trust the tool? What happens if the file gets corrupted, the software updates, the license expires, or the master password is lost?  The risk of losing admin access to all your equipment and accounts is scary.  On top of that, there is the issue of changing passwords (especially when people leave the company) – not a simple job if you have a variety of accounts (hardware, software, services, etc) and a lot of people who have a varying degree of access.  Or automation scripts that need access to perform large scale operations.  Personally, I don’t think this problem has been solved yet.

The second reason is in this other Slashdot post – “Sad Reality: It’s Cheaper To Get Hacked Than Build Strong IT Defenses“.  This is very true as well.  A simple firewall and a strong password policy is often more than enough for many organizations.  The risks of compromise are low.  In those cases where it does happen, you’d often get some script kiddie consequence like a Bitcoin mining app or affiliate links spread across your website.  Both are quite easy to detect and fix.  Is it worth investing hundreds of thousands in equipment and personnel to prevent this? For many companies it is not.

The fact of the matter is that a lot of people don’t really care about security or privacy on the personal level, and that then translates into the organizational mentality as well.

Just think about people leaving in all those high crime areas.  Some of them think the risk is worth it – maybe then can make more money there or have a more exciting life.  Some of them simply can’t afford to move anywhere.  That’s very similar to the digital security, I think.  Some don’t care and prefer to run the risk, saving the money on protection. Some simply can’t afford to have a decent level of security.

Rundeck – Job Scheduler and Runbook Automation


Rundeck is yet another one of those services that I want to get my hands on but haven’t yet got the time to.  The simplest way to describe it is: cron on steroids.

Rundeck allows one to define the commands and then allow for execution on those commands manually, periodically or based on a certain trigger.  Imagine, for example, a deployment command that needs to run across some servers to which you are not comfortable giving access to developers, or even non-technical users.  You can create a command in Rundeck and give access to certain users to execute it, via clicking a button or two in a user friendly web interface.

A side benefit to using Rundeck versus cron are the metrics.  Rundeck collects metrics like successful and failed executions, execution times, etc.  So it makes it easier for you to see that certain jobs are getting progressively slower or fail on specific weekdays, etc.

The best part is that Rundeck is Open Source and self-hosted, so you don’t need to give sensitive access to some external web service.

Amazon Linux AMI 2016.09

amazon ami 2016.09

AWS Blog lets us know that Amazon Linux AMI 2016.09 is now available.  It comes with a variety of updates, such as Nginx 1.10, PHP 7, and PostgreSQL 9.5 and Python 3.5.  Another thing that got quite a bit of improvement is the boot time of the Amazon Linux AMI instances.  Here’s a comparison chart:


Read about all the changes in the release notes.

P.S.: I’m still stuck with Amazon AMI on a few of my instances, but in general I have to remind all of you to NOT use the Amazon AMI.  You’ve been warned.

Vim 8.0 Released!

The team behind the greatest text editor of all times has release the new major version – Vim 8.0.  It’s the first major release in 10 years!  Brief overview of the changes:

  • Asynchronous I/O support, channels, JSON
  • Jobs
  • Timers
  • Partials, Lambdas and Closures
  • Packages
  • New style testing
  • Viminfo merged by timestamp
  • GTK+ 3 support
  • MS-Windows DirectX support

For a more complete list and details, have a look here.

The TL;DR summary: Vim provides a lot more power now to plugin developers, so we’ll be seeing a boost in both new functionality and old ways getting better.

Here is a mandatory Slashdot discussion with your usual Vim vs. Emacs flame.

P.S.: Emacs has recently released a major update too …

Top 13 Amazon Virtual Private Cloud (VPC) Best Practices

Cloud Academy Blog goes over top 13 Amazon VPC best practices – particularly good for those just starting up with the platform.  The article discusses the following:

  1. Choosing the Proper VPC Configuration for Your Organization’s Needs
  2. Choosing a CIDR Block for Your VPC Implementation
  3. Isolating Your VPC Environments
  4. Securing Your Amazon VPC Implementation
  5. Creating Your Disaster Recovery Plan
  6. Traffic Control and Security
  7. Keep your Data Close
  8. VPC Peering
  9. EIP – Just In Case
  10. NAT Instances
  11. Determining the NAT Instance Type
  12. IAM for Your Amazon VPC Infrastructure
  13. ELB on Amazon VPC

Overall, it’s a very handy quick list.