Chris Moyer

Three videos every AWS Developer needs to watch (from ServerlessConf)

2017-05-18T06:15:00.003-07:00

I'm certainly not a fan of Google or Microsoft when it comes to Cloud Computing, in my opinion both are very far behind the curve from where Amazon is, and they both tried jumping in a little bit too late only after Amazon proved it as a viable business model. I'm an AWS Fanboy, and proud of it.

That being said, I know that sometimes my passion for AWS can blind me to other great opportunities. My Fanboy-ness blinded me into thinking CloudSearch was a good idea (hint, it's not, use Algolia instead). It also lead me down the rabbit hole thinking I should use Cognito, instead of the much better and easier integration that Auth0 has. I like AWS for many of my production workloads, but it's actually slightly behind in some neat developer features that other cloud providers are now offering in the Serverless space.

I'm not jumping ship, however it's important for anyone in the Serverless space to get an understanding of what else is out there. There are two videos from ServerlessConf Austin that illustrate just how much Google and Microsoft love developers (and we all remember how much Microsoft loves developers right?).

Microsoft Azure Functions Keynote

Microsoft's Azure Functions are interesting, essentially they bring something like an IFTTT (If This then That) functionality but for developers. Easy drag-and-drop support to build visual pipelines of your workflows.

Of course, this is very flashy, but in practice probably not that useful without a really simple way to model it in code.

Google Firebase

Very flashy, very slick, and very simple for any developer to get started with. Of course there's a lot of hand-wavy magic, and I know for a fact that they have issues figuring out billing (I'm still occasionally charged for a service I disabled 2 years ago). That being said, this type of developer experience is something AWS really needs to strive to produce.

If AWS offered this kind of solution on top of DynamoDB and Lambda, imagine how quickly you could get apps built... For now though it might just be prototyping.

FaaS Lang with StdLib

StdLib is probably the smartest of the "competitors" to AWS Lambda. They're intelligent in that they realized their platform isn't going to be better than AWS Lambda, more scalable, or even something that last long into the distant future. What they did instead was build something on top of existing FaaS providers. Building on the success of some of the alternatives like Azure Functions and Google Cloud Functions, FaaS Lang attempts to be a standards library that will run on any existing FaaS provider. It provides a unified way to build applications that will run anywhere.

Of course, it's still yet another standard, so we'll see if anyone adopts it, but it certainly has the potential to bring competition between providers up to another level, one that simply relies on price, and not functionality.

The Tablet in the Kitchen to look up recipes just got an upgrade

2017-05-09T09:01:00.002-07:00

Amazon just launched the Echo Show:

This new addition to the Echo Lineup could mean one very important feature for my Kitchen: I can remove my old First Generation iPad and upgrade to voice-enabled recipes.

This makes sense for Amazon as it's trying to get into the Video Call replacement space, but it also explains why Amazon has been pushing the "Rich Cards" features of Echo Skills, and Lex.

Time will tell, but by June 28th we'll get our first look at what could possibly be the new favorite kitchen assistant (the Echo is my current favorite kitchen assistant, so why wouldn't adding a screen make it even better?).

Here come the Recipe skills!

#ServerlessConf Austin 2017

2017-05-01T06:06:00.000-07:00

This year I attended ServerlessConf Austin, which was hosted in the Zach Theatre in downtown Austin, TX. This was the first conference I’ve been to since WWDC in 2012, so I wasn’t quite sure what to expect. While WWDC was massive, it also felt like that college course you took that was in the big auditorium and you didn’t actually get to talk to the professor or learn anything because it was more of a demonstration. ServerlessConf is just now up to about 430 attendees, so it still has a small conference vibe, even though it’s growing massively really quickly. Additionally, there were workshops put on by acloud.guru that you could attend before the event. These gave you 1-on-1 time with the conference organizers, as well as a lot of great experience with working through a tutorial with other members of the Serverless community (and some folks who were brand new to Serverless but just wanted to see what it was about).

Workshops

The Workshops were held in a separate venue, where the organizers were promised solid WiFi. Unfortunately it was Hotel WiFi, and as was a common theme throughout the conference, you had to realize that you can’t trust someone else when they just say something is “Magic” (thank you Charity Majors, who we’ll get to later)!

However, despite the issues with the WiFi, the actual tutorial I followed (building a Serverless chatbot) did prove somewhat helpful. It was slightly less advanced than I had hoped, and it weren’t for the WiFi issues I would probably have completed the entire task in a few hours (as it was I finished by Noon and cut out a bit early to hack on it a bit more in my hotel).

Still, working on the same tutorial with others there to help through, and getting some time to ask questions of the staff while working on something was pretty neat. I do wish they had a more advanced course though, as I already had a good working knowledge of the underlying technologies, I just wanted to see how to adapt them to the Serverless framework a bit more. Next year, my recommendation for acloud.guru would be to offer an “Advanced” track (and perhaps partner with a college or university in the area to get a better venue with better WiFi).

Day 1 Speakers

Day 1 of the Serverless Conference was filed with quite a few fun talks. Serverless Conference was organized similar to a BarCamp conference, where normal average people were speaking, but on a much more grand scale. They also had a committee to approve talks, and there was a lot more talking from sponsors, but in general it had that small-conference feel that we all love about something like BarCamp.

Austen Collens did a great job opening up for the conference. He started off with a short explanation of how Serverless Conference (and acloud.guru) evolved from a little home office in his mom’s house, to a warehouse in Brooklyn (with no AC in the middle of august!), all the way to the 430+ attendees that were occupying the Zach theatre, and being introduced with more of “the dubstep”. It was a really great way to get to know the audience and it showed just how far Serverless has come from an idea to being used by fortune 500 companies.

After the two opening Key Note presentations, we had a quick break for a snack, custom made donuts, and then on to the normal talks. Many of the remaining talks from Day 1 were similar re-hashes of the same topics, talking about how their specific company uses Serverless (mostly all Lambda), or showing off a fun new tool that they just launched. The theme of the day though was that live demos shouldn’t be done, because the WiFi was terrible and the Demo Gods were not with anyone. There was an unfortunate incident too with one of the Demos that proved not to work at all, but everyone felt bad for the presenter and most of the other presenters quickly made sure they had a backup plan. Normally I wouldn’t bring this up, but it’s important for what happened later on Day 2 with Randall Hunt (more on that later).

After the lunch break, they split the conference into two “tracks” with half of the speakers in the same main theatre, and the other half in a smaller theatre on the other side. I mistakenly read the schedule wrong and thought Chris Munns was speaking in the second theatre, so I ended up missing his excellent talk on CI/CD with Lambda, but fortunately it should be online soon. Even so, I learned a bit about how iRobot manages thousands of Lambda functions to control their Roomba army, and how switching to Serverless helped them innovate much more quickly and handle features like custom mapping of your house. It was also quite interesting to see some more pragmatic approaches to Serverless like GreenQ in Israel is doing. It was also very exciting to see that Serverless is global, not just something us Americans are playing around with.

After a quick snack break for a custom made ice-cream Sunday, we headed into the last portion of talks. The highlight of the last section was hands down from Lynn Langit. I believe it was her who gave my favorite quote of the conference: “Legacy is just another word for code that already works”. It was pretty interesting to hear her take on big-data analytics with Athena and Google BigQuery. It was refreshing to hear someone basically say that Amazon isn’t the king of everything, and you shouldn’t go into it as a Fanboy, but instead be practical and actually look at the differences between the two services. While I have no direct use for Athena right now, it’s certainly an interesting topic and made me think a little bit more about how I store some of my data on S3.

The after-party was also on Day 1 for some odd reason, and was a typical nerd party. It was mostly for networking, of which I did a little bit, but I actually met more people in between sessions and through lunch/snack breaks. Overall I took quite a few cards from people and even found a fellow Clevelander.

Day 2

The opening act for Day 2 was supposed to be Tim Wagner from AWS, however he got stuck in an airport somewhere and didn’t make it until the end of the conference. Instead, the folks at ServerlessConf had to quickly shuffle around and moved three of the “lighting talks” to open up. My old colleague and fellow RIT and CSH alumni Ryan Brown was second, and gave a pretty decent talk about how to integrate Legacy (there’s that word again!) stuff with Serverless applications. It was another interesting take because most of the other talks were entirely on how to build a new application, but Ryan was more focused on existing companies that obviously aren’t all-in Serverless (yet). He made it clear that you don’t have to be all-in or brand new to get started with Serverless development.

After the lightning talks was a Keynote by Jason McGee from IBM, who discussed how they helped create OpenWhisk, and focused a lot on portability within Serverless. It was interesting to see the big folks like Amazon, and Microsoft focus on why you should use their unique features, but IBM focusing on why you could switch to them, or any other provider and avoid lock-in.

After Jason’s talk, we had a quick snack break, nothing as fancy as the custom donuts this time (just Snickers and Kit-Kat bars) after which we moved into the second section. The highlight of this section was obviously Charity Majors, who did an interesting and unfiltered talk from an Ops perspective on what Serverless really means to the Ops community, and what Devs really need to learn to do. Her slides were as colorful as her talk, and you should really go check it out sometime after it’s posted. It was a good way to add a little bit of humor and lighten things up after a long day and a half of pretty deep technical talks.

After Charity we went back into some more serious technical talks, the most interesting to me of which was Firebase. They showed how you can use their platform tools almost as a replacement for the Serverless Framework, running directly on Google’s platform. This was the most surprising thing to me and quite an amazing learning experience. I had never looked into Firebase as a platform very seriously, but now I’m certainly going to.

After lunch, we again split into two different tracks, the first of which was started off by Jared Short, who talked a little bit about Single Page Apps, specifically on how to render some code behind the scenes using Serverless Technologies to help with speed and Bots/scrapers. He even made an interesting comment about “some little startup named Facebook” and showed how they don’t work without JavaScript enabled, but his very rich SPAs do (with a little magic from Serverless). It was an interesting take on how to optimize for platforms that might not have a lot of compute power, and how to really leverage the power of the Serverless Cloud.

After Jared, I quickly bolted over to the second track to wait for the talk from Forrest Brazeal on SWF and Step Functions. Before that, however, was a really unexpected surprise from Marcia Villalba from toon.tv who had probably the most artfully designed slides of the conference. The trend of the day here was humor and keeping things light, and Marcia and Forrest both held up to that task (Forrest even did an interesting “Rap” on Serverless).

After both Jared and Marcia, I sat through the hands-down best talk of the entire conference, put on by Randall Hunt. Remember I mentioned that everyone else was avoiding demos? While that was true, Randall decided it would be a good idea to do about a dozen demos all at once. He even SSH’d into a server to upload thousands of images to S3, all while in the middle of frantically typing and showing a ton of interesting code. His entire talk was very light and just very well presented. He showed himself as from AWS, but more of a developer and like the rest of us than most of the other presenters.

it all started with his laptop not working, which he then did a cold reboot to get working, and while that was going on he decided to do another demo by taking a selfie with the crowd to send to @AWSCloudNinja to show off some of the Lex and Rekognition features. After his laptop started up, he went even more off script with showing parts of his slide deck, but then jumping right into real-world coding problems: how to keep his mother updated on his status. His overall presentation was very well done, and even though it seemed like he was a disorganized mess it flowed very smoothly and he crammed a lot of information into a small presentation. Most of the things he went over I already had worked with, but seeing how he hooked them all together was pretty nifty.

The conclusion by Tim Wagner

Perhaps it was the build-up by Randall, or perhaps it was because there was so much hype about Tim, but when Tim Wagner came on to close out ServerlessConf, I was not very impressed. He was much more corporate AWS than the rest of the day had been, and his presentation style was slightly boring to me. He talked about some great information about adoption of API Gateway and Serverless in general, but he was speaking more from a manager position than from a developer.

In the end, he blended parts of a server (a stick of RAM, a CPU, etc) and that was his “big thing”. I understand the concept of destroying servers as a show of Serverless, however it was quite a bit of build up to something that wasn’t really that impressive. Sorry Tim, but Randall stole the show this time.Yeah

Stripe just told a large number of its customers to get lost

2017-03-01T13:50:00.003-08:00

UPDATE: This wasn't actually entirely Stripe's fault, their bank was the one who blasted everything with "Marijuana" referenced anywhere (probably some sort of keyword search). After some back-and-forth, stripe went back to their bank and got them to realize we're a legitimate company and not selling any Marijuana based products.

While in the scuffle, we tried to apply for a few other credit-card agencies and one other bank, who knew full well what we did and knew we didn't have anything to do with touching Marijuana products, who is supposed to be a "high risk" bank, rejected us outright. It's not just Stripe, and after this blog post Stripe actually contacted us and helped us get squared away, so I thank them for that.

TL;DR: Stripe's bank is screwing legitimate business by giving them 30 days to switch to a new platform. Even businesses that don't deal directly with Marijuana, but operate in the same space.

A few years ago, I started a company along with some others to create a new product designed to track what states are doing with Marijuana laws, including tracking who gets licenses, what companies are dealing with Marijuana, and what people belong to those companies and licenses. This is similar to a Dun and Bradstreet but specifically for business operating in the legalized Marijuana space. We also tracked all of the laws for each state and have issued two books, one for average consumers, and one for businesses looking to join the market.

Marijuana is everywhere. At this point, 29 states have some form of legalized Marijuana. New states are coming on board too. Over 60% of americans back legalizing Marijuana. Yet this isn't an issue of Marijuana being illegal, it's an issue of Banks stepping in where they shouldn't.

We are a media company, a publisher, we do not, and will not, ever touch any part of Marijuana. We do not help companies track plants, offer any financial help with anyone who produces, processes, or distributes marijuana, or help anyone acquire marijuana in any way. We simply track the business, like many other publishers do. We've even been on Yahoo Finance as one of the foremost experts on the laws in different states.

We've tried advertising on Google, Microsoft, and Facebook. Both Google and Microsoft flat out blocked us based solely on keywords. This was expected. We use Stripe for transaction purchases, and we've never had an issue, until this morning when we got a notice from Stripe that we have 30 days to migrate elsewhere. They're shutting us down because we talk about legalized Marijuana.

Stripe's bank is having a major overreaction

As it turns out, Stripe recently got a major audit by their bank, and due to that anyone even related to the Marijuana industry is being kicked off. How far will this go? If you're the NY Times and you have a column on the Marijuana industry does that mean you can't use Stripe? I just blogged about Marijuana, am I no longer allowed to use Stripe? The IRS collects taxes from Marijuana companies, are they also not allowed to use Stripe?

This isn't a fatal issue for us, however it does mean that every one of our customers will have to re-enter their credit card information into a new system. We can't get that information out of stripe for security reasons, and our customers are set up to Auto-Renew via subscriptions. If we end up losing some of our customers because of Stripe, who will pick up that slack? What about the extra month of development of integrating a new payment system and then getting the customers to switch over to it?

I know it's a tricky business, but it's going to far when you're actively destroying companies simply because they're reporting the news. I know Trump wants this to become the new normal, attacking anyone that has a different opinion than he does, but I didn't expect a well-known and respected company such as Stripe to take an active stance and decide that if you're talking about Marijuana, you're banned from their service.

I know this isn't exactly stripe setting these policies, it's the bank they deal with; but there are many many banks that allow even companies that physically sell Marijuana to do business with them. If Stripe had told us that we're in a "Risky Business" and so we have to pay an extra 1% transaction fee, we would have grumbled but ultimately kept with them. If Stripe had told us they're working on another bank that will accept us, we'd be happy. If they had even bothered to ask us what our business was before just deciding they know what we do, at least we would have known what's going on. As it is, Stripe just saw the word "Cannabiz" in our invoices, and decided we need to go.

I hope you're not in the same boat as we are, but if you do anything related to Marijuana, Cannabis, or in general anything that the president doesn't agree with, you may soon be. Small businesses are suffering because companies like Stripe won't stand up for us.

Heading to Austin Serverless Conf!

2017-02-03T07:25:00.001-08:00

Normally things are pretty hectic around here and I'm finding myself pulled in too many directions to actually get out to a technical conference. In fact, the last time I was able to get away for a full week tech conference was WWDC in 2012 (sadly, the year after Jobs stepped down from doing the keynotes).

This year, however, things have calmed down quite a bit and now all I'm worried about is optimizing our usage and trying to cut some AWS costs. We've already been pretty heavily invested in Serverless functions using AWS Lambda, but I'm really excited to learn what others in the community are using as well as catching up with some old colleagues. I'm very excited to be heading to Serverless Conf, Austin.

Tickets and flight have already been acquired.

Other things to do in Austin

Austin is also a pretty amazing place so I'm coming in a few days early and leaving after the weekend. The workshops don't start until the 26th, but if you get in a few days early, you can catch the opening month of the Round Rock Express (AAA Baseball) on the 24th and 25th.

Of course, the Mexican food is also amazing, my favorite from last time was from Polvos, but I also plan to try a few new places this year, including some of the many food truck areas that I've heard about.

It's also Texas, so it's really a requirement to try the texas sized steaks from Texas Land and Cattle. There's also too many BBQ joints worth trying to even list. (although if you have a few hours to kill you can always wait in line for Franklin).

Downtown is also worth driving through, or even walking through. It has a lot of cool museums and libraries, including the LBJ Library.

And if you happen to be bringing the wife, who also happens to love leather (as in boots), Allens Boots is also pretty nifty, but be prepared to spend a few hundred. They have quite a bit more than boots too, I actually bought a hat and belt while I was there.

Have any other suggestions for things to do in Austin while at Serverless Conf? Leave some suggestions in the Comments!

How to set DeadLetterQueue (DLQ) on AWS Lambda functions using the AWS CLI

2016-12-05T07:55:00.003-08:00

UPDATE: It's important to note that as of now, DLQ's are ONLY supported in the us-east-2 (Ohio) region. While this command doesn't return any errors in other regions, it also doesn't make any changes.

One of the cooler announcements from re:Invent that you can start using right now is Dead Letter Queues (DLQ) for AWS Lambda functions. This has the advantage of allowing you to re-try, and alert, on events that fail even after being re-tried by AWS Lambda automatically.

You can find out more information on DLQ for Lambda by reading the official documentation, however in order to get quickly started with it, you should create a new SQS queue and configure a lambda function to send to it. This should be able to be done through the AWS Console, but it doesn't appear to be there yet, so here's how to get started with the CLI.

First, upgrade to the latest version:

sudo pip install -U awscli

Then, update your function:

aws lambda update-function-configuration --function-name LambdaFunctionName --dead-letter-config TargetArn=sqs or sns arn

That's it, you should start seeing DLQ events coming in on the SQS queue you configured anytime there is a complete failure, after Lambda's re-tries have all failed.

From here, you can set up alerts using SES, you could set this up to notify you via SNS, or have another Lambda function read the queue every few minutes to pick up and try re-processing the events at a later date.

5 Announcements from re:Invent you can't ignore

2016-12-01T11:44:00.001-08:00

Werner Vogels just finished up the Day 3 re:Invent keynote presentation, and this may be the most excited I've ever been for AWS announcements in a long time. Previously we've seen a lot of weird and specific products being introduced, but this year AWS topped off quite a few improvements to existing products and workflows. Here's the ones I'm most interested in

Step Functions

Think of this as a developers version of IFTTT on steroids. If you're working with multi-step data processing, with conditional logic in the middle, you'll want this. Step functions give you a visual way to connect multiple Lambda functions together, based on events that come into your system. It'll be a great way to visually manage processing pipelines, and I can't wait to get started. Best of all, it'll be available for all today.

Amazon Lex

It's "What's inside Alexa" get it?

All joking aside, this is a huge step forward in conversational AI. Alexa is a great toy, but with the opening up of the underlying API for parsing text, and converting speech into text, as well as text back into speech, this could get interesting. I'm already pondering over the many ways I could use this to improve search, and even automate some helpdesk style systems. Want an expert system built for you? This is the way to go.

AWS X-Ray

Can anyone say "bye bye newrelic"? A better, and more detailed version of Application Performance Monitoring, with built in ways to help you automatically identify bottlenecks such as low performance on DDB tables due to needing to raise throughput. It seems focused on HTTP-based services, but we'll see once it fully comes out if it can handle any Lambda task, including integration with Step Functions. X-Ray may be the coolest developer tool released by AWS.

Amazon Greengrass

There's currently only one Greenglass hardware client, and it's from Amazon, the Snowball Edge. It'll be expensive to run that, but essentially the idea is that you're not locked into needing to use Amazon to develop for Lambda. This could have HUGE implications as it's essentially letting you run Lambda functions from any endpoint. Combine this with Lambda@Edge, which lets you run Lambda functions on CloudFront endpoints, and we're talking about a huge push forward in the serverless community.

I'm mostly looking forward to seeing how well this can help with Local development. Yes, there are OS tools like "serverless-local", but this is an official AWS client, and could even be used to help with Hybrid cloud environments. Now Serverless computing doesn't necessarily mean serverless. Perhaps we should change this to "Function-based" computing.

A slight side-note here is that Amazon is also updating their IoT button, with double the battery life. You can get the current generation essentially for free ($19.99 with a $20 amazon credit back to you).

AWS Batch

A large percentage of operations that happen on AWS services are indeed "Batch operations", not things that depend on user input, or even need to be done in real-time, but instead are long operations such as "parse this content", or "encode this video", or even "notify anyone watching for this type of news story".

These are Batch operations, and are best handled with SQS with job processors running on EC2, or ECS instances. Many companies have taken advantage of the AWS Spot Marketplace to buy cheaper instances that aren't being used by AWS, since their processing doesn't need to be real-time. This is where AWS Batch will come in handy, combining Spot Marketplace along with a quick-to-build pipeline and SQS automatically so jobs will get done based on how much you're willing to spend and how quickly it needs to be done. Is the best option to wait until instances drop to 1¢/hour and spin up 5,000 of them? If so, batch can handle that.

What can you do now?

There's still a lot to be determined by a lot of these announcements, since most are still in preview, but if you want to get started right-away you can dive into Step Functions, Athena, Polly, and CodeBuild now.

First days with Ghost Inspector

2016-11-01T14:10:00.005-07:00

A while ago we switched away from using Newrelic APM, simply because it is way too expensive for the pricing points that we are use to in an AWS environment. It's fine to have a few cents overage on an AMI, but what about when you're trying to monitor Lambda functions, or have a bunch of micro-services?

The APM piece we were able to replace pretty easily with AppEnlight, and there's some additional help there with the addition of Logging and other analytics that we were able to pull in. However, one piece that I thought Newrelic did very well which I still missed was Browser-based end-to-end testing. This was called Newrelic Synthentics, and unlike the rest of Newrelic, it was priced very reasonably.

Unfortunately we'd made the push to move away from Newrelic entirely, so I had to search for something else. This also gave me the advantage of not being confined to just what Newrelic could offer, so when I ran across a Promoted Tweet (Yes, those do occasionally work marketers!) for Ghost Inspector, I decided to take a look. What I found initially amazed me, then made me slightly sad, but finally came around to amaze me again.

The Chrome Recorder

This is a great little tool that automatically builds a test just by you running commands in a chrome browser. You can even stop in the middle of a test and insert assertions. It's easy to use, and can be enabled to work in Incognito Mode (what I prefer when using Chrome since that starts a fresh session).

It was what brought me back to Ghost Inspector (after looking around I realized I had tried them out before but it was too cumbersome). The greatest part about it was that it recorded clicks, assignment of Input functions, and everything I was doing. It seemed like a great way to go!

Then I took a look at the actual recorded events, the Chrome Recorder, and in fact all of Ghost Inspector, just uses CSS selectors to pick elements, do assertions, and generally make your tests. I quickly realized that many of the CSS selectors the Chrome Recorder was doing just wouldn't work; it was picking up on bootstrap classes instead of things like data-role attributes. Still, this was a good starting point so I could simply fix up the CSS selectors a bit and make them work for both production and development environments.

The Screen Comparison Tool

Another pretty cool idea, Screenshot Comparison. You can even tell Ghost Inspector to include only specific areas, and exclude areas, all by CSS selector. Pretty neat if you're working with a mostly static layout, and would actually notify you of a deployment if you updated the layout of a given page. It's nice to be able to do, but for the most part it wasn't really what drew me to the tool. Still, it's nice to see both a final screenshot of each test run as well as a video, especially in the event of a failure.

Variables, and imported tests

Ok, so by this point I was "so-so" about Ghost Inspector, and then I noticed the ability to import steps from other tests, and set custom variables. So there's not exactly a "for each of these elements, do this" type of option, however with a few quick shared tests, I was able to not only build a "test template" to handle login operations for tests that required it, but also create a "template" for a test to test a specific type of page, then set a variable and run that same test on dozens of pages that all needed to be checked.

Obviously tests like this are only needed to check against regressions, but when you do find a bug and you can make a test that fails, then build in the fix and watch it pass, it's something amazing.

My setup

Ok, so down to the nitty-gritty here, I've set up Ghost Inspector to have three separate "Projects" or test-suites. One Suite is actually never run, it's just called "Shared". This includes all of the test snippets like Logging in, or testing one specific page part that's used in multiple other tests, and multiple times.

Another suite is called "Development Tests", these are tests that are not scheduled to run automatically, but are designed to run one at a time, right before doing any deployment. They are time consuming, there are a lot of them, and they're basically advanced unit-tests. They point directly at our staging/development server and really hammer it with User and non-user based tests.

The last suite is called "Production Hourly Tests", as the name implies, these tests run against production servers once every hour. Some of them test screenshot compliance, some just use assertions to make sure certain items are visible. These tests are usually shorter in nature and we try not to make them spam our servers.

A final note about Analytics

One last thing, we needed to make sure our Analytics didn't get jacked up because of a test. We track how many users view any given story to see how popular it is, but we didn't want our repeated searches for the same thing to confuse that. Ghost Inspector doesn't (yet) let you pass in custom headers like the DNT header, but it does allow you to specify a User Agent. I set that to "Ghost Inspector" and check on that for each request. If it's set, I set on the backend the DNT flag, and make sure to exclude all analytics, from Intercom, Google Analytics, and our custom tracking. Not ideal to have this rely on a User Agent string, but so far it seems to be working.

Software is like Cake

2016-10-18T07:05:00.002-07:00

Ok, stay with me here. Here's how Software is like Cake.

You can buy a piece of cake anytime you're hungry for some (SaaS)

You could buy a whole cake and bring it home and cut it yourself (Self hosted software)

You could buy an undecorated cake and frost/decorate it yourself (PaaS)

You could make, and decorate the cake from scratch (IaaS)

Or, you could grind the flour yourself, get eggs from chicken, milk your own cows, etc (Self-managed Datacenter)

Which one sounds easier now?

VMWare on AWS: What does it really mean?

2016-10-13T17:52:00.002-07:00

Unless you're a huge follower of VMware already, you probably missed the announcement today. I would have if it wasn't for my friend Trevor at TechTarget. VMWare now integrates directly with AWS Cloud.

Who cares, right? This is obviously VMWare's way of trying to stay relevant in a world where everyone is moving to Cloud Computing. They announced something similar with IBM Cloud a while ago, but again that's just two Dinosaurs joining forces to try to stay relevant... right?

They really buried the lede here, but there are actually two really cool features that make make even existing AWS Customers think about switching; Hot Migration between cloud providers (or local data centers event), and auto-scaling of underlying resources.

Auto-Scaling of underlying resources

Even if you're an all-in developer for AWS technologies, there's one thing that VMWare's integration will add that is impossible to ignore: automatic scaling of underlying resources. While Docker on EC2 is a huge improvement for allowing developers to spin up containers, it doesn't automatically scale the underlying EC2 resources when there are more requests for tasks than the existing EC2 instances allow for. This is hopefully something Amazon is working on, but right now VMWare looks like it's beating AWS.

When VMWare detects there is a server at maximum capacity, it will try to move around some VMs to less crowded instances, if none are available, it can be set to automatically launch a new one. This is pretty huge for managing underlying resources, and the way you can specify for instances to be purchased is also pretty big. It has built-in support for running either on-demand or reserved instances, and it'll automatically manage that for you, allowing you to pay using your existing VMWare account, or with an AWS account.

Hot Migration between cloud providers

Cloud-interoperability may not be important for startups that are all-in already on AWS, but for any company with sufficient size, you'll start to realize pretty quickly that the best part about multiple cloud providers is the competitive pricing. If it becomes more effective to run some instances on IBM Cloud, it's easy to migrate services over while they're live with zero downtime. When things change and Amazon comes back to beat pricing decreases that IBM just put out, it's easy enough to migrate right back without any downtime at all.

It's also possible to migrate services between regions without much effort. AWS has different pricing for different availability zones, so this may become an interesting use-case. Additionally, it looks like VMWare may be able to expand a single application to run across multiple Regions, however this is unconfirmed at this point.

The Catch

VMWare is a beast, and it's not cheap. Getting started with VMWare isn't something many developers want to do, and it probably means a new dedicated Ops team just to manage it. There's staffing costs as actual licenses from VMWare to think about here, so unless you're at a pretty high scale, and absolutely need to have cloud interoperability, it's probably not something you're going to be working with.

Also, did we mention it's not quite ready yet? VMWare lists this as ready in the "mid 2007 year". Even after it's publicly ready, I'll be waiting at least a year before I even think about trying it, to make sure all of the bugs are worked out first.

The Verdict

VMWare on AWS sounds like a good idea in theory, but like all theories, it will strongly depend on how it's implemented. I'm actually more excited to see what AWS gets out of the partnership then actually using VMWare on AWS. I'd like to see some of the advanced functionality that VMWare offers get ported back to AWS Native, such as Hot-Migration and auto-scaling of EC2 instances running containers. Either way, it'll be late 2018 before I take another look.

Setting up Docker on EC2

2016-09-29T09:34:00.004-07:00

After piecing together several different sources, I finally found out how to properly configure docker storage to NOT use a loopback device on EC2. Without going through too much boring details about why this is a good idea to configure a different storage solution, here's the real solution: you need to use the "docker-storage-setup" command, which is installable through yum:

yum install docker docker-storage-setup

You also need a second EBS volume attached to the EC2 instance. You can easily create one through the AWS Console, I attached mine to /dev/sdf.

Next, create the LVM setup:

pvcreate /dev/sdf
lvcreate docker /dev/sdf

Next, setting things up, change /etc/sysconfig/docker-storage-setup:

DEVS="/dev/sdf"
VG="docker"

Next, make sure docker is stopped, and remove /var/lib/docker:

service docker stop
rm -rf /var/lib/docker

Finally, run docker-storage-setup and restart. I actually found I had to restart a few times using "shutdown -r now" just to make sure docker was going to come back up correctly on a fresh start. Theoretically though, you'd just have to do "service docker restart".

Turn Off The Lights

2016-09-29T09:28:00.002-07:00

After upgrading to macOS Sierra, and having Apex fail to work locally anymore, I decided it was time to build a dev instance, on EBS within EC2. I found a good idea from CloudSSH, but I really wanted to allow my instance to run docker commands while I was away. I decided to add the "--no-stop" flag to CloudSSH and just handle terminating the instances myself using a cronscript.

Here's the script:

#!/bin/sh

# Don't even bother checking if we haven't been up for more than

# 3500 seconds (just under 1 hour)

UPTIME=`cat /proc/uptime|awk '{printf "%i", $1}'`

if [ "$UPTIME" -gt "3500" ]

then

if [ -z "$(who)" ]

then

if [ -z "$(docker ps -q)" ]

then

shutdown -P now

And here's the /etc/cron.d/turn-off-the-lights file:

*/5 * * * * root /usr/local/bin/turn-off-the-lights

I also set up a nice little bash function to handle automatically configuring most of the common things I did for CloudSSH. I did this instead of an alias because I have multiple AWS profiles that I connect to:

# Connect to a "Cloud Environment"

typeset -A CLOUD_INSTANCE_ID

CLOUD_INSTANCE_ID+=(aci i-MY-DEV-INSTANCE)

CLOUD_INSTANCE_ID+=(newstex i-OTHER-DEV-INSTANCE)

cloud(){

export AWS_REGION=us-east-1

export AWS_PROFILE=$1

$HOME/bin/cloudssh --no-stop ec2-user@${CLOUD_INSTANCE_ID[$1]}.us-east-1 -- -i ~/.ssh/$1-cmoyer.pem -o HostKeyAlias=${CLOUD_INSTANCE_ID[$1]}

}

cloud_profiles=(aci newstex)

compctl -k cloud_profiles cloud

Now I can just type "cloud aci" and automatically get logged into my ACI dev instance. Note that using "HostKeyAlias" allows me to not have to re-verify the host key every time the IP address changes.

AWS IAM Diagnostics, figuring out what role your script is using

2016-09-21T07:01:00.003-07:00

I just spent the last hour of my day trying to figure out why my script was saying I didn't have access to a particular resource from within my Docker image. I granted access to the IAM Role for my Docker instance (or so I thought) but it still said it had no access to write to a particular bucket. The request seemed like it was saying there was credentials set, but it wasn't indicating what role the request was made by.

At one point, the AWS-SDK for Node.js would print out a very useful message like "User arn:..... is not allowed to perform action s3:putObject on resource arn:...."

Now, however, it simply told me:

{ [AccessDenied: Access Denied]

message: 'Access Denied',

code: 'AccessDenied',

region: null,

time: Wed Sep 21 2016 13:51:55 GMT+0000 (UTC),

requestId: 'REQUEST ID',

extendedRequestId: 'LONG_REQUEST_ID',

cfId: undefined,

statusCode: 403,

retryable: false,

retryDelay: 13.531139446422458 }

That's great, I know the error is Access Denied, and I know it's not a retryable error, but what did it try to do, and who tried to do it?

After stumbling around for awhile, I finally found this:

curl http://169.254.169.254/latest/meta-data/iam/info/

Which told me the IAM role that scripts were assuming in my current EC2/Docker environment:

{

"Code" : "Success",

"LastUpdated" : "2016-09-21T13:53:02Z",

"InstanceProfileArn" : "arn:aws:iam::ACCOUNT-ID:instance-profile/acindex",

"InstanceProfileId" : "INSTANCE_PROFILE_ID"

}

Not the role I thought it was running as....

Add the permissions to that ARN, and we're set.

Converting an old Mac Pro into a lockable cabinet.

2016-08-30T06:15:00.004-07:00

As we were cleaning out our basement, my wife pointed to my old Mac Pro and said "What are you going to do with that?"

Of course it brought back some great memories of when I first got it, It was my first Mac computer. Before then I was just running Linux and BSD on my desktops, but this was Unix with a nice UI over it. I loved my old Mac, but at this point it was little more than a paperweight. I had upgraded it to have 4 big drives in it, added extra ram, but it was still 20 years old. It would never run anything modern and it certainly couldn't be upgraded to the new MacOS.

After doing a little digging, I saw plenty of posts of people using an old Mac Pro as a coffee table, or end-table, but mostly just using two of them to old up a piece of wood. That wasn't enough for me, so I decided to try to turn it into a cabinet, which can be locked using a simple padlock if you wanted to.

The first step is pulling out all of the components. I didn't want to destroy the actual shell, so I took a methodical approach to pulling out all of the components.

The first step was pulling off the cover and removing everything that would just slide out. Graphics cards, Ram cards, and Hard Drives.

Remove the ram cards by holding the Circles and pulling

Hard drives come out easily by just pulling on the housing

The next step was removing the large back fan section. This metal piece just comes right out when you pull on it, it appears to be attached with magnets:

Once that part is out, you can see a few exposed screws, remove these and you're clear to lift out the back fan housing. The first is up by where you took out the hard drive:

First screw by hard drive bay 1

Next there is one by where the metal plate came off:

That should be it, you can now lift out the back fan housing unit:

Pull the back housing unit off

Next, disconnect any cables you see. There's a lot of them:

Next step, back to where we pulled out the RAM Cards, it's time to take out this beast. There are four screws on the bottom of the unit, and two tiny screws at the top. As a warning, one of my tiny screws was stripped, so I had to dremel it out.

This screw was completely stripped. I had to dremel it out.

Next, it's time to remove the heat-sinks over the CPUs. Up until this point I was able to avoid breaking things, but after this step there is absolutely no way back. The easiest way to get the vents off is to break the one heat sink off, by rocking it back and forth until the metal snaps off:

The metal heat-sink, bent down.

Once it snaps off, you'll see the 8 or so allen screws that you need to remove to pull off the heat sinks. These are spring-loaded, so once you get them mostly loosened you can hand unscrew them.

One heat sink out.

There's also a small plastic cover to the side of the heat sinks where you pulled out the back fan unit. It has three small screws in it, remove those and pull it out. Yank out all the cables this exposes.

On the other side is another heatsink, where we broke off the metal part, it has a few allen key screws, Remove them and you can pull off this heatsink as well.

Next up, remove the motherboard screws. There's tons of them. There's also a side logic board where the power button and USB slots are on the front of the case. Be careful here if you wish to preserve the iconic apple power button, there's a small cable connecting it to the logic board you should remove before yanking out the logic board. There's also some screws connecting the ports where the hard-drives slide in. Unscrew those and start yanking out cables. I had to remove some black tape around the cables at the bottom of the case to pull them out of the cable-management system at the bottom.

After a lot of pulling, cutting, twisting, bending, and swearing, I ended up with something like this:

The empty shell of my Mac Pro

Note that I wasn't able to fully pull out the top enclosures. I still haven't figured out how to remove the power supply, and I ended up breaking the housing for the CD drive because I couldn't quite figure out how to cleanly remove it. I don't recommend breaking that part off though because if you don't do it right the closing mechanism for the door may end up breaking.

In any event, once the guts are all cleaned out, you can add shelving if you want, or just leave it as is and you've got a nice empty cabinet that can easily be closed. I've been thinking about running some LED light strips inside through the open PCI slots.

History shows this year America will elect a Republican

2016-07-29T06:48:00.000-07:00

In US History, only twice have democrats been re-elected back into office with the exception of a VP taking over after the current president's death. Republicans have done it only six times. Typically, the only way for a party to maintain control through more than one president is if their VP takes over. So, if the Democrats really wanted to keep control over the White House, they probably should have nominated Joe Biden.

5 Reasons you shouldn’t use Google for your scholarly research

2016-06-09T10:49:00.000-07:00

Google is the first place most people go to for answers - and it’s probably how you found this article. Unfortunately Google has a lot of problems when doing academic research; almost everything on the internet can be included in it. This is great when you want to look up something like “how late is home depot open”, but not so great when you’re looking for detailed articles for your new research paper on Genome Sequencing.

1: Search Engines don’t vet content

Anyone with internet access can blog. They don’t even need a credit card, nor do they need to provide their real name. Typically with just an email address (which is also free and doesn’t require any verification), a blogger can get up and running in a few minutes.

The biggest problem with doing a search in Google (or any other standard search engine), is that you have no idea who wrote the content, or if it can be trusted. Traditionally, this role has been filled by Academic Journals, which vet the author, the research, and then publish to audiences.

The problem with Journals is they are expensive - if you don’t belong to a library that pays thousands of dollars per year for that specific journal, you won’t have access. Additionally, publishing to a journal costs money and takes a long time; it’s both a burden getting content in, and getting content out.

Fortunately, as technology advances, there’s been newer and better ways to publish content. The most popular new way to publish content online is through Blogging. Google picks up many blogs and anyone can access those blogs for free (for most blogs), but now we’re back to “who wrote this, can I trust it”.

This is where the ACI Scholarly Blog Index comes in. Not only do we vet every blog we bring into our system, we also profile authors and provide auxiliary information about who wrote the article right with each source:

In this example, you can see not only the full-text of the story, but also who published it, what categories that publisher is authoritative in (LC Class), when it was published, and some information about the publisher. You also get a full profile of who wrote it (Brian Wang), who he wrote it for (Next Big Future), and social media and credentials for both the author and the organization he works for.

2: Blogs come and go

Want to bookmark this story to keep it for later, or view it on the go? ACI offers “Bookmarks” as well as custom “Lists”, which let you add stories into organizational categories so you can more easily make notes of what your paper should include, as well as make citations easier.

I know what you’re thinking “every browser already comes with a bookmark button”. Yes, this is true, however when bookmarking a blog in your browser, you have to go back to that blog again to get the full-text source. Yes, this is OK if the blog stays at the same location, or online in general, but what about blogs that change their URL pattern, or go away entirely?

ACI has thousands of publications, and hundreds of them have either changed URL schemes, moved, or just completely gone away. Forgot to pay your hosting provider? Surprise, everyone trying to access that blog post is now presented with a page saying you’re no longer around. There is no quicker way to guarantee a failed grade then putting in citations to sources that no longer exist. How can you verify sources if the average blog site only lives for a few years?

For added security, ACI also backs up all content to Portico - an approved academic solution to preserve access for libraries should anything happen to ACI.

3: Community Activity

ACI also provides a general “Community Activity” score around the article which helps tell you how popular this article is within the academic community. This allows researchers to find the most actively engaged content and focus just on topics that are of interest at the time. ACI derives this score as a value from 0-99, where 0 is the least popular, and 99 is the most popular. Community activity also rolls into Authors, so it’s easy to identify the most popular authors within the academic community, for a given subject area.

Where this can become really useful is when sorting, and filtering by year. It can become quickly evident what the most popular topics are for a given LC Class, and it’s easy to identify “hot topics” and the best performing stories in your field. This allows researchers to craft blogs in similar styles to make sure they get the most traction.

4: Advanced Faceting

You know when you’re shopping on Amazon and you type in “mouse” and it comes up with mouse traps, instead of that new peripheral device you want to buy for your computer? Then you see on the left side an option to filter just to electronics, so you click on that, sort by price, and even filter down to just the items available on Prime, and boom, you have exactly what you were looking for.

This advanced filtering is called “Faceting”, and is also available in ACI. ACI allows you to filter by category, author positions, what school an author graduated from, what degree the author achieved, and even how many comments are available on the story. Looking to find out the most popular story for Cancer Research in 2015? It’s just a simple set of filters away.

5: You have to pay for it.

Wait, the fact that it’s not free shouldn’t be a positive… should it?

Yes actually it is a positive. When you’re paying for a service, you’re getting the product. When you have a service for free, you are the product. Every website costs money to run, and the people building it (like me) need to make a profit. Eventually everything ends up being sold, or VC money runs out and the product will collapse if it can’t find a way to make money.

Want to be sure you’re getting the most out of your time? Don’t rely on just free products to do everything. Paying for a product that works well is the only way to make sure that product stays in business. After all, it’s only 99¢/month.

Bonus:

You've scrolled to the end of my post, either you read it all or you're just skipping to the end. Either way, As a reward here's a coupon code for a free 7 day trial (no credit-card required) of ACI: COREDUMP

What the AWS Summit Chicago Updates mean for you

2016-04-19T09:56:00.000-07:00

Amazon just wrapped up their AWS Chicago Summit, and they’ve dropped a few important notes that developers should be aware of. As I speculated previously, this year Amazon is choosing to focus on improving existing services, of which they too many of already, instead of bringing out new services.

Managed Platform Updates for AWS Elastic Beanstalk

AWS Elastic Beanstalk is a great service that automatically manages auto-scaling, provisioning load balancers, and can even automatically provision databases for your application. It’s a step below Lambda, allowing developers to bring their own application in any programming language (through the use of Docker) with almost any application without having to worry about managing servers or even thinking about infrastructure.

Because it still runs using traditional EC2 instances that are started automatically, the system does occasionally need to perform updates. In the past to upgrade to a new AMI developers had to create a new environment, verify the new environment, then swap the URLs, confirm it was still working, and terminate the old environment. All of those steps had to happen manually by a developer performing each step through the AWS console or API.

Next, Amazon allowed developers to update an environment with just one click. When a new AMI is available, a developer could just click “change” on the environment and choose the most recent AMI. Amazon would automatically launch new instances, verify they were working, then terminate the old ones. While significantly better, this still required manual interaction, even for top security patches. A developer not paying attention could easily miss an update and leave a system vulnerable to attack.

Today, Amazon announced “Managed Platform Updates”. Effectively, the same level of automatic updates and patches that an RDS environment has is now available for every Beanstalk instance. This means developers can specify a maintenance window, when the servers are allowed to be upgraded, and have Amazon automatically apply patches and updates. This makes Beanstalk fully managed, just like RDS but for an entire application stack.

Amazon Inspector, Security Vulnerability Assessment Service Now Generally Available

Anyone who has ever worked with PHP, Apache, or MySQL web applications is aware of how quickly vulnerabilities can come out and become massively widespread. Security and Vulnerability testing is very standard among many of these types of applications because they are very highly used by developers, and so they are very quickly the target of attackers. Every type of system is vulnerable, and it’s nearly impossible to keep up with all of the various security updates manually.

To solve this problem, many developers rely on third-party software that automatically checks their systems for vulnerabilities, similar to how consumers would actively run virus scanning software to protect against known threats. Amazon Inspector is the official AWS product to handle automatic detection of common security and vulnerabilities announced by the security community for your web application. Since it’s managed automatically by AWS, it’s very simple to just point it to your application and have it check against the known vulnerabilities that may impact your service.

Today, Amazon has announced that it has entered general availability, which means anyone can use it. It also means it’s officially supported by Amazon, and is considered “Production Ready”.

Your User Pools for Amazon Cognito

Amazon Cognito is a beast of a service, allowing developers to generate effectively “server less” backend systems connecting directly to Amazon’s services, without even needing backend code running in Lambda. The power of Cognito is that developers can grant temporary and limited credentials to a front-end application (mobile, desktop, web) that sits on an untrusted client system to access AWS services. This means the credentials need to be very specific in what they offer, and assume that the client is not secure (meaning the end-user may have tampered with it). Cognito's advantage is that developers grant the credentials for very specific purposes, and it can enforce that access with IAM Roles.

However, Cognito was always very difficult to use, seeing as developers had to manage users on the backend or tie into a third-party login system like Google+. While this was OK, it didn’t really allow developers to fully manage users directly in Cognito, there was always the need to store a User record in something like DynamoDB before granting any credentials to the client.

With the new “Your User Pool” concept, this is now completely solved within Cognito itself. It now allows you to specify what information you need from a user and process the signup and identity management entirely within Cognito. This means there is no more need to store a separate “User” record in DynamoDB, since all of those properties can be stored within the User database in Cognito. You can even specify custom attributes, like what type of user, or what the regional currency of the user is. Best of all, it’s by far the easiest approach to require Multi-Factor-Authentication (MFA) for your end users, which is very important in highly secure applications such as Banking, Finance, and Medical services.

Building of the "AskAboutTrump" Alexa Skill

2016-03-31T12:25:00.000-07:00

I was involved in the Amazon Echo Beta (and I've just now received my Echo Dot), and when the Alexa Skills Kit came out I immediately wanted to see what fun I could have with it.

With a free AWS Account, and a Free Algolia Account, I quickly whipped up an "AskAboutTrump" skill. It's now approved and live in Amazon Alexa, just go to your Alexa app and search for "Ask About Trump". (Note that I had to change this from "Ask Trump" to "Ask About Trump" to pass the Alexa Approval process, more on that later).

The process is relatively simple, once you have signed up for both AWS and Algolia, create a new Algolia index. In my case, I called it "trump", but if you wanted to create a different type of q/a system you could make it more appropriate.

Next, I filled in a few records in my index, I just went under "Add Manually" and filled out a few examples, like:

{
"name": "How will you make america great again?",
"response": "By building a wall, beating china, and forcing companies to bring business back to america",
"priority": 22
}

Note the three important parts, the "name" which is what would be searched, the "response" which is how the skill question will respond, and the "priority" which I used in the custom search ranking. Under the "Ranking" tab I aded both "name" and "keywords" (keywords giving me an additional option to add more search keywords if needed). Under "Custom Ranking" I added "priority", mostly as a disambiguation tool if multiple records match pretty equally.

I filled out a few more records later on as I came up with other witty quotes, which I all did via the "Add Manually" option, but it would also be trivial to just create a little site to add in records more easily too.

Next, create Access keys in Algolia to pass to your ASK Skill. I created my access key with both Read and Write access to the index so I could have the Alexa skill also add in support for adding new responses. I never got around to actually implementing this part, but it could be done with enough time.

Next up, create the Lambda function. I have the full code I used available on GitHub: https://github.com/kopertop/AskAboutTrump

The code was relatively simple, the key part is in the "askQuestion" function:

function askQuestion(intent, session, callback) {
  var repromptText = 'Go on, ask';
  var sessionAttributes = {};
  var speechOutput = 'I will make america great again! Ask me how.';
  var closeSession = false;
  var question = intent.slots.Question;
  if(question && question.value){
    question = question.value;
  }
  console.log('SEARCHING FOR', question);
  index.search(question, { hitsPerPage: 1 }, function(err, resp){
    var title = question.value;
    if(!err && resp && resp.hits && resp.hits.length > 0){
      console.log('ALGOLIA RESPONSE', resp.hits);
      closeSession = true;
      speechOutput = resp.hits[0].response;
      title = resp.hits[0].name;
    }

    // Setting repromptText to null signifies that we do not

    // want to reprompt the user.
    // If the user does not respond or says something

    // that is not understood, the session
    // will end.
    callback(sessionAttributes,
      Skill.buildSpeechletResponse(title,

        speechOutput, repromptText, closeSession));
    });

Note that this allows for any sort of free-formed question to be asked, and the search is done in Algolia to find the closest match. That means that you could have something with a bunch of questions in the "title" but the same response, or include extra words but if the user leaves them out they still match. Why did I do this instead of just a simple mapping?

Lets take a more complex example: "about what are new york city values how do you like feel about new york city.". This matches:

Ask Trump, what are new york city values
Ask Trump about new york city
Ask Trump how do you feel about new york city
Ask trump about new york city values
Ask Trump do you like new york city

And many more....

In any event, after the Labmda function is created, you'll need to register it with Alexa Skills Kit. This can be a relatively complex process to get approved, so here's the key points that I missed the first few times:

Include a lot of phrases in your "Interaction Model".

For mine, I had:

GetQuote a quote

GetQuote quote

GetQuote give me a quote

GetQuote get a quote

GetQuote get quote

AMAZON.HelpIntent help

AMAZON.HelpIntent what can i say

AMAZON.HelpIntent what can you answer

AskQuestion {What Will Trump Do|Question}

AskQuestion {Where do you live|Question}

AskQuestion {Where do think about climate change|Question}

AskQuestion {How do you feel about free trade|Question}

AskQuestion {Do you like Hillary Clinton|Question}

AskQuestion {Who do you want counting your money|Question}

AskQuestion {Does mexico have good people|Question}

AskQuestion {How do you feel about Saudi Arabia|Question}

AskQuestion {How do you feel about politics|Question}

AskQuestion {Where do you live|Question}

AskQuestion {How do you feel about China|Question}

AskQuestion {How will you fix the border crisis|Question}

AskQuestion {What are new york values|Question}

AskQuestion {How are you doing in the polls|Question}

AskQuestion {Will you win the election|Question}

Your Interaction Model must include your example phrases.

When you get to your "Publishing Information", make sure the three "Example Phrases" are included in your Interaction Model.

You must include a "Help Intent", "Stop Intent", and "Cancel Intent".

If a user ever wants to stop, cancel, or get help, they need to be able to. Saying "Stop" pretty much at any point in your interaction must quit your app.

You must provide a proper reprompt request, and handle if the user doesn't say anything.

My initial confusion was failing to provide a re-prompt request, and also not handling the basic "Just Start the app". For example, if you just say "Open Trump" it needs to do something. Or, if you ask for "Help", it returns an open prompt after saying "Try asking me....". This is important, and if the user responds after that you need to make sure to close the stream. If you leave the listening stream open, or don't provide a proper reprompt request, you will be rejected.

This was the most confusing thing to me because I thought "But I don't control when Alexa closes the stream!", but yes you do, you control that by just passing the "closeSession" variable. Make sure that is set to "true" only after you have answered a users question, and make sure you pass a "Reprompt request" to anything that is "false".

Go ahead, download my skill.

Let me know what you think, and if you have any other questions you think would be nice to see answers to leave them in the comments!

Lambda VPC Primer

2016-02-17T08:35:00.005-08:00

AWS just announced support for Lambda access to VPC protected resources. This effectively means that your Lambda functions will run inside of a VPC and have access to any private IP and firewall resources you may be running, such as RDS instances which restrict by IP. It also means you can effectively manage the IPs your Lambda function will use, giving you a huge amount of control over Lambda functions and gaining the ability to provide static IPs to your lambda functions when used in conjunction with VPC NATs.

UPDATE: Your VPC Lambda subnets MUST be behind a NAT. At this time it looks like the "Auto Assign Public IP" function using an internet gateway directly does not work.

Before you begin, it’s important to note that a VPC Lambda function needs some special access to be able to create resources inside of your VPC. Fortunately, these resources are all managed in a single Managed Policy Group, so the first step is to create a new Role specifically for your VPC function and assign the “AWSLambdaVPCAccessExecutionRole” managed policy.

In your AWS Console, go to “Services -> Security & Identity -> IAM”:

In the left menu, choose “Roles”:

Click the “Create New Role” button:

Fill out the Role Name, I prefer to start every Lambda role with “lambda_”, then click continue:

Under the “Select Role Type”, choose “AWS Lambda”:

Now the important part, on the next page under “Attach Policy” search for “lambda” in the search box, and find and check the “AWSLambdaVPCAccessExecutionRole”, then hit “Create”:

This policy adds some very important access rights to your Lambda function. It replaces the “AWSLambdaBasicExecutionRole”, so if you’re upgrading an existing role you can use this instead of that policy. This policy gives your Lambda function access to write logs to CloudWatch Logs, and to create resources in your VPC. It’s important to create this role BEFORE you try to create your lambda function, as you will need to reference it in the very first step of your lambda function creation.

On the Lambda console, you will notice a new section when creating a function, which allows you to choose a VPC:

Choose your VPC and new options will show up, allowing you to choose Subnets and security groups for your lambda function.

Note that you don’t need to add any inbound rules for your security group to your lambda function, but you can use this security group to grant access to other VPC resources that your Lambda functions need to be able to access. For example, if you have an RDS instance that grants access to only specific security groups, you could make a new security group called “Lambda” and add that to the grants in your RDS instance’s security group.

Remember, before you go to create your new Lambda VPC function, make sure you set up your role to support Lambda VPC access!

The age of Core Cloud Computing is over

2015-12-01T07:03:00.003-08:00

Amazon coined the term "Cloud Computing" back in 2006. The term "Cloud Computing" really meant "a way to treat computers just like any other utility". The idea was that Amazon really understands how to manage physical hardware, so the average developer shouldn't have to. Cloud Computing was born, and eventually expanded into other "Cloud Services", simple, common services that developers would need in order to build any basic application.

Cloud Computing today has expanded to mean just about anything, there are multiple types of Cloud Services including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and other offerings in between (some also insist that Software as a Service (SaaS) is a type of Cloud, but really that's been around much longer then the term Cloud).

A Cloud Service really is a building block to help you develop your application. There are only three types of Core Cloud Services on which every other service is built:

Compute - (EC2 "Instances", which replaced "Servers")
Storage - (S3, EBS, which replaced Hard Drives and File Storage solutions)
Network - (ELB, VPC, etc, which replaced Routers, switches, and networking gear)

Every other Cloud Service is built from a combination of these three services. They are the basic fundamental building blocks of all applications and services on which you can build anything. Some may even argue that Storage and Network are just specialized versions of Compute, but we won't go down that far of a rabbit hole.

Lets take a look at RDS for example, RDS is basically a specialized Compute instance with Storage and Network built in to serve up a specific application (An SQL database). Before RDS you could still run an SQL database on the cloud, it was just more complex to do it yourself and the initial investment of time was much greater. Amazon saw the amount of people doing this same basic task and decided to make a top-level service that was built on the three building blocks to make that one task more simple.

The most significant new service to come out recently was Amazon Device Farm, which is actually a specialized version of Compute. It's still a Compute service, but instead of being built on traditional server hardware, it's built on top of Mobile devices to help you test your code on a different type of hardware. This is the only Core Service that Amazon developed this year, and they've released many new services in 2015.

What does this mean for Cloud Computing going forward?

The age of building Core Services is over. The focus now is on making it way easier for developers to produce new products. Even beyond that, the amount of top-level resources is so high that the focus for developers now should be on building services for non-developers. Up until very recently, many services developers would make came out of necessity to make other developer's lives easier, either by monitoring applications, or by providing one small building block to a larger application. Those days are coming to a close very quickly as the Cloud Computing providers are starting to integrate those types of offerings right into their platforms.

If you're building applications in the Cloud today, don't start by designing something new for other Developers, start with designing something that the average person could use.

Twitter is about to remove statistics APIs

2015-10-02T10:41:00.002-07:00

Twitter recently announced they will be removing the API that allows you to gather and display statistics about how many times a URL has been shared. This has a huge impact for systems like AddThis and SharedCount, which will no longer be able to retrieve statistics for URLs that are shared on twitter.

These tools will continue to be able to show the same statistics for other social media sites like Facebook, Google+, Pinterest, etc. What does this mean for Twitter?

Why would Twitter do this?

First, lets understand why twitter would do this. It's pretty obvious in their notice that they want people using Gnip instead of their APIs directly. Gnip is a paid service, and although it's a very good service, it doesn't offer nearly the same functionality as "hey here's a URL tell me how many times it was shared on twitter". When Twitter Acquired Gnip, they slowly started disabling other big-data entities like DataSift and it became obvious they wanted to control the statistics coming out of Twitter. They want to use you as the product, and they want people to pay for their data. It's not really surprising that they're disabling more APIs, but it's quite confusing that they are not offering a paid alternative to this counts API.

What does this mean for my site?

What it means for the average publisher is that you can no longer get statistics about how often an article, blog post, or website has been shared on Twitter. You can get a 30 day count (how many times it was shared in the last 30 days) by subscribing to Gnip, or you can get an approximate count using the Search API, but you can't just display a button saying "this is how often this was shared on twitter". That means getting popularity for an article on Twitter is now nearly impossible.

In the age of Alternative Metrics for publishers and deep analytics for all of the social media space, this move makes no sense. It makes twitter quickly approach irrelevancy.

Twitter is nearly irrelevant now.

At ACI, we use SharedCount to get statistics on how often an article is shared. We get statistics from all of the major social media sites through one simple API call, and we use that to determine popularity of a story, not just in ACI, but throughout social media as well. When this news first came up, the first thing I did was a quick check of how many shares in twitter we see vs other social media sites. What I found was astonishing:

Facebook: 311,338,380
Twitter: 10,519,290
Google+: 9,220,078
LinkedIn: 2,085,853

People are almost as likely to use Google+ to share an article as Twitter.

Let that sink in for a moment. Who do you know that uses Google+? Compare that to the number of people who use Twitter? What does that tell us about Twitter?

Basically it means that Twitter is not used for anything professional at all. It's just quick ranting. You can't get a full story in there and you can't really do much on twitter BUT post a link, so the fact that people are not posting links to scholarly content says that the academic community doesn't use Twitter.

Facebook has over 30x the usage as Twitter in the Academic space.

That means Facebook, and not Twitter, is the social media platform of choice for Academics. So what impact does this have on ACI? Practically none, because even if twitter doesn't eventually include an API in Gnip or some other paid platform to get these statistics, they're minor in comparison to Facebook stats. Our most popular articles in ACI are not shared on twitter, but rather on Facebook.

Facebook gets it. They work directly with Publishers to make their content more targeted, work very well to support insanely targeted advertising, and they still want you to get at some overall statistics for free. Why? because there's a lot of usage on Facebook, hell they even passed one billion users on a single day.

This move by Twitter says they aren't generating the revenue they should, and it's a last straw effort to try to get something going. Don't be surprised if they continue to "trim the fat" and continue to bring down the service to remove pieces that people actually use.

420: Enhance Your Calm

2015-07-10T12:41:00.003-07:00

If you've worked with the Twitter API, especially in the early days, you're probably very familiar with the HTTP error code 420: Enhance Your Calm. It's not an official HTTP error code, but being in the 4xx level it does make it a valid client error, and it has some perfect illusions to what you should do to fix the problem.

Relax.

Stressing out a system to it's absolute max isn't good. In fact, a DDoS attack is exactly that, issuing too many requests for the server to handle that it has no other viable option then to block legitimate traffic. Stressing out a car by redlining it for hours would have the same very negative effect. It's not good for technology, and it's not good for us.

It's well documented that stress, or our reactions to stressful situations, has very negative reactions on us. Stressing out over a situation does no good, and often leads to bad decisions as well as the physical and mental effects it has on you.

But I strive well under stress.

No, you may think you do well when stressed out, but what really happens is you produce more. The quality of code produced while under a strict deadline is always worse. Remember the early issues of Healthcare.gov? It wasn't just because of a lot of incompetent people, it was also because those people were put under such strict deadlines the only reasonable way to accomplish all that was required of them was to work long, hard hours. That leads to stress, which produces shitty work product.

I've had a lot of personal experience with this in my professional life too. When I first came to Newstex, we had to switch off of an antiquated system that was falling apart at the seams. It wasn't designed to handle the massive volume of content we were processing, and it was dropping content already. I was fresh out of college with a lot of debt and needed to prove myself to the company. I put some undo pressure on myself as well because I wanted to make the system perfect. I was getting requirements thrown at me from every direction and would scatter to try to get things done as they came in since there was no way to keep up with it if I didn't. Every day was like fighting a fire, except there was almost no way to gain ground, the backlog kept on burning up and I just couldn't get ahead of it all.

I took shortcuts, but I got the job done. The system scaled very quickly from only taking in about 50k stories a week to over 200k a week without any issues. Since switching onto that new system we've had no significant downtime, we've always been able to recover quickly and build on top of it as we needed to. I produce a lot of code in a very short period of time all because I was put in a very stressful situation and the only way out of that situation was to do so.

5 years later, I realized there is a better way

Back when I first started, I produced a lot of code, and answered every feature request with either implementing it within a few days, or not doing it because it would take too long. The problem with that is you end up with a house made of duct-tape instead of a solid infrastructure. Sure the system works and it's incredibly flexible, but it could have been built a lot better, and made a lot more adaptable and easy to manage. I recently started a brand new and very large project for my company (now re-branded as ACI). I looked at all the old code I had written and though "Wow, how does this even work?". Yes it worked, but it was ugly and not very maintainable.

Stressful situations get you to build code quickly, but approaching a problem in a much more calm manor, when you don't have tight deadlines or lots of features you need to do right now leads to a lot more stable code. It makes you re-think processes and instead of taking the easy way out, do the right thing. Sometimes the easiest way is the right way, but it's almost never the first way you think about it.

When my boss calls me in a panic, I just say "Ok, no problem"

Early on I would get upset when I got a call the day of a deployment telling me I needed to change everything. I've learned the simple solution to not being stressed out about problems is to just not let them stress you out.... don't react in a way that won't get anything done. What good does getting upset about the changes do? When he does that sort of thing now I simply say "Ok, no problem, but then we have to delay this release and push off these features to get it done". It's a trade-off; if you want new things done something else gets pushed off.

Take time off, and go off-grid

Another thing that I've discovered that really helps when the stressful situations start to build up is to take a break whenever you can. When there aren't fires to be put out, take a week and go completely off-grid. Make sure there are people in-place to manage things while you're gone, but don't take any calls, texts, or even emails while you're away. (I wasn't quite able to not answer any emails, but I didn't answer any from clients at least). At least once a year, your body needs to completely de-compress and forget about everything. When you come back you should be much more focused and able to think more clearly about the issues that you need to solve. Don't look at that never-ending task list and think "it will never be all done", that's not the point of it.

Inbox zero is a pipe dream for most of us. Take what you can tackle, delegate what you can, and just push off what you can't. Some things will just sit at the bottom of the pile forever. That's just the way things go. Don't expect to always get every task completed. Get what's important done.

Take time for lunch, every day.

This can be one of the hardest things to do as a remote employee. Take time off for lunch, if you aren't heading out of your home-office, at least go away from your computer for a while. You should already be standing about once an hour anyway, so this time just go to the kitchen, make something more then just a sandwich, and then sit down at the table and eat it. Don't just scarf it down and go back to work either, enjoy it, take some time away.

The bottom line is don't get angry.

Just be realistic. When new requests come in be honest, if you don't think you can get them done let them know. If your boss tells you what he needs you to get done, tell him when you can get that done. If he tells you when the deadline is, give him a list of features to prioritize and tell him how far down the list you can get done. And remember it's always best to under-estimate how much you can get done and how quickly you can get it done, if you end up getting more done or get things done quicker it's way better then getting less done or taking longer.

Just don't get angry when new things happen. Explain what you need to get it done, if it's time or another person. That's easier said then done, but the more you work on it the better you'll get.

And remember the next time that angry customer calls, they aren't angry at you personally. They are angry at the situation. It does no good to fuel their anger.

Is Microsoft the new Apple?

2014-12-04T06:41:00.004-08:00

Think Different.

That's the phrase Apple coined back in 1997. It appealed to the upcoming generation who wanted to "fight against the man". In those days, the "man" was Big Blue, the terrible combination of IBM and Microsoft. They were all there was to have for computers. Microsoft beat Apple to the punch, they had invested more in the GUI then Apple had, and gotten a release out first. They were widely adopted, so they quickly grew in support. Businesses and Personal users both used Microsoft Windows, because it's what all the applications were written for, and people all wrote applications for Windows because it's what everyone used.

Apple wanted to change that, they wanted people to use the better operating system, even if there weren't as many applications for it. They started building their own Office-like products, and trying to convince the world that simpler was better.

The new age of Apple

Simpler is better. And when Apple switched to a Unix-based backend to run OS X, they ushered in a new wave of support. They no longer were just the system for the technically un-savy, they gave every geek what we wanted, a nice GUI on top of an existing platform we already knew how to use.

Apple continued to grow and innovate. Eventually they launched the first iPhone; a smartphone designed for the average person. It wasn't the first Smartphone, but it was the first to include an App Store, and a completely new platform designed to help developers put their software in the hands of users on the go. Apple once again was at the forefront of innovation because they were the underdog. They had to innovate, and produce top-quality products to get people to switch away from existing devices.

Apple as the new Giant

After the iPhone launched, Apple continued to innovate for a few years. It's hard to pinpoint exactly when (although I believe it was directly related to the death of Steve Jobs), but at some point after Google launched the Android OS, Apple started copying instead of innovating. Instead of pushing forward with new ideas, and building everything with their users best interests in mind, they decided to bow to pressure and do what others had been doing. They made phones larger, more unmanageable for the average single-hand usage, and even started selling cheaper versions of the phone.

Apple has been riding on their brand for the past few years. They have been stale, and they have been adding very single-use cases to their OS. You can tie an app into Siri, but only in a very specific way, through Home Automation APIs. You can share data between apps, but only through "Health Kit" which is designed to share health-related data. Everything so far has been piecemeal, instead of a better, more general solution.

Microsoft is the new little guy

Everyone forgot about Microsoft. They bought Nokia in an attempt to enter the Smartphone market. They built an entirely new OS around touch and widgets. They looked at how users want to use their devices, and have even produced a new Microsoft Band smart watch that is specifically advertised as a way to stop technology from massively disrupting your everyday life. They've built a new OS shared between a desktop, tablet, and phone (although only the "new" apps work on all three). The problem with their software right now? Nobody writes apps for them.

Because nobody writes apps for them, nobody wants to buy them. Because nobody wants to buy them, nobody writes apps for them.

Wait, doesn't this sound familiar?

Where do we go from here?

I've always loved Apple products, but I'm not an Apple fanboy. Apple currently has the best PCs on the market. They have the best Smartphones on the market as well. Microsoft is catching up quickly, and they've already developed a superior OS, it's just not quite ready for prime-time.

The concepts are there, the ideas are there, but Microsoft needs to execute as well as Apple did back in the 90s. They need to encourage people to Think Different. The next time you're thinking about dropping $650 on an iPhone or Android (and yes, you're really paying $650 despite what your carrier tells you), take a closer look at the $150 Windows phone instead.

As for me? I have no plans to switch my desktop to Windows unless they also embrace Unix. I'm a coder, and I use the terminal in my every day life. We develop iPhone apps because that's where the money (and users) are at.

However, my next phone, in about a year or two, will most likely NOT be an iPhone.

Logentries - A different kind of Logging service

2014-12-03T09:05:00.003-08:00

NOTE: I originally reviewed Logentries in a post I did for TheServerSide.com. In it I had confused this with another logging service I had checked out which was an Application-level logger only. Logentries does accept logs from Syslog.

Logentries was actually a recommendation to me after I wrote a blog post about our search for log services. After checking it out for a little while, I realized pretty quickly that the service was not for us. Log entries has a very unique approach to logging, both for Applications and Systems. Instead of deciding what to SEND to Logentries, you have to decide what to keep Searchable in Logentries.

That makes for a very unique approach to logs. With their new Unlimited logging service, you can send as much data as you can produce, from as many servers as you have, and still only pay for what you actually process and index. That means if you want to send all your debug logs, but you don’t need to make them searchable except for that one period of time where you had an issue, you can do that.

Pros:

Lots of features (live-tail, alerting, etc)
Send everything, index what you need
“Unlimited Logging”
Parse your logs how you want them

Cons:

Longer initial setup to parser your logs
Need to tell it what you want to index
Expensive depending on how much you want to index

Algolia understands Service

2014-07-29T09:51:00.001-07:00

The final "S" in SaaS is important. Sometimes the difference between two products can be that Service. In Algolia's case, they screwed up. They made a mistake that caused them to lose all of our documents in one of our indexes. Within a few minutes of contacting them, they had figured out what happened, and were working to correct it. Unfortunately they couldn't restore our lost documents, and they felt very bad for this happening.

The Contract doesn't matter

Despite not having an official SLA with them, they knew that we were a customer, and one they wanted to treat right. They didn't point to a document and say "well the service was only down for 1% of the time, so we're only going to give you back 5% of your bill". They are a small company, with a great product, and a fast-paced innovative team. They didn't hide behind an SLA, they specifically went above and beyond to make sure we were happy.

Algolia owned up to the mistake.

We all make mistakes, and they owned up to it, and reimbursed our entire bill for the month. They admitted it was their fault, and they were willing to do anything and everything to apologize and minimize the impact on us.

Algolia understands customer relations

Algolia Cares, unlike Splunk. They responded quickly, found the problem, and gave me steps to correct it, as well as their assurances that they have implemented test cases to prevent it from happening again. It wasn't catastrophic, our systems didn't go down because of it, but it did inconvenience us, and they were well aware of it.

Happy customers are repeat customers

I'm incredibly happy to see Algolia spend so much time making sure we feel satisfied with the service. They're constantly improving things and taking our feedback, and giving us features that we said we'd like to see. They're keeping us in the loop, and when something bad happens they fix it.

If you need a distributed search system, I strongly suggest Algolia. It's fast, the service is great, and the system is incredibly reliable. We've had only a few issues over the past few months we've been using it, and none of it was true downtime. They looked at our specific use case and have made improvements to their backend systems to make sure our system runs fast, not told us to re-do how we use the system to make it run fast.

They take the initiative to make the system work the way we want it to. They don't force you to use something they've structured for a specific purpose.