Cloud Experts Unleashed

In this episode, your hosts, Ben Nadel and Ryan Brown, sit down with Steve Leve from ShareASale to dive into the challenges and lessons learned from navigating an acquisition, managing technical debt, and executing large-scale migrations. They explore the impact of legacy systems, the balance between maintaining old infrastructure and innovating new solutions, and the role of AI in modern software development.

Key Points:

• Steve shares his journey from a small-town coder to a principal architect at ShareASale.

• The team discusses the challenges of merging companies post-acquisition, including business model differences and technical debt.

• Lessons from large-scale infrastructure migrations, including moving from ColdFusion monoliths to modern architectures.

• The importance of balancing innovation with maintaining existing systems and the trade-offs of cloud computing.

• How AI is reshaping development practices, from documentation to automated testing.

Migrating an entire business platform brings its share of surprises and roadblocks.

• Steve shares his experience of being acquired by AWIN and the growing pains that followed.

• The team discusses the complexities of merging different operational and technological approaches.

• They reflect on the unexpected technical challenges, including a looming data center shutdown and hardcoded infrastructure dependencies.

• The importance of knowledge sharing within a team to prevent reliance on a single expert.

Navigating technical debt is all about prioritization and timing.

• The group explores the idea that not all technical debt needs to be fixed—only what blocks innovation or scaling.

• Steve emphasizes "tidy first" as an approach to incrementally improving code rather than massive rewrites.

• Real-world examples of how debt manifests in migrations and why some old code surprisingly holds up.

• The discussion touches on key strategies for managing technical debt within an evolving business landscape.

Migrating to AWS and cloud adoption brings new efficiencies but also new constraints.

• Steve and Ben share stories of migrating to AWS, the surprises along the way, and the need for expert help.

• Lessons on the hidden costs of cloud adoption and why simply lifting and shifting to the cloud isn't always the best strategy.

• The team debates the trade-offs between autoscaling, managed services, and maintaining on-premise solutions.

• Real-world examples of cost-efficient cloud migration strategies.

Strangler patterns, AI-driven documentation, and the future of software development.

• The team discusses the strangler pattern as a way to incrementally transition from legacy systems to modern platforms.

• Steve shares insights on how AI is being used for documentation, testing, and even code analysis.

• The group speculates on how AI-driven tools can improve developer efficiency and streamline migrations.

• They reflect on the importance of keeping up with evolving tech while maintaining a pragmatic approach to change.

This episode is packed with practical insights, real-world experiences, and candid discussions about the messy, challenging, and ultimately rewarding process of managing technical debt, cloud migration, and acquisitions. Whether you're a developer, architect, or IT leader, there's something valuable here for you!

In this episode, your hosts, Ben Nadel and Ryan Brown, sit down with Andrew Pendleton, Senior Director of Design Systems at Verizon, to discuss the role of design systems in driving consistency, accessibility, and innovation. They explore how Verizon’s approach to accessibility goes beyond compliance, how design systems empower both designers and engineers, and the challenges of maintaining a unified system in a vast enterprise.

Key Points:

• Verizon’s Design System centralizes design and engineering decisions to create scalable frameworks for digital experiences.

• Accessibility at Verizon is treated as a driver of innovation, not just compliance, influencing best practices and component design.

• The impact of constraints in design systems, allowing teams to move faster and focus on complex problems.

• The importance of cross-team communication and standardized language in improving adoption and efficiency.

• Strategies for starting a design system and integrating accessibility in an organization.

Andrew shares how his background in digital art, development, and management uniquely positioned him to lead Verizon’s Design System team.

• He discusses the importance of bridging the gap between designers, engineers, and product teams through shared terminology and best practices.

• The conversation covers how accessibility has led to innovations like responsive web design, captioning, and high-contrast modes.

• Verizon’s approach to user testing includes an accessibility lab where customers with disabilities provide direct feedback on digital and physical product experiences.

The team dives into how Verizon builds and maintains accessible components for its design system, including an advanced video player with baked-in accessibility features.

• Andrew explains how they studied platforms like YouTube, Adobe, and native HTML elements to build an optimized solution.

• The importance of leveraging the platform but extending it where necessary to maintain accessibility.

• The balance between stability and flexibility in design systems to allow innovation while maintaining consistency.

The discussion shifts to the challenges of adoption within a large enterprise and strategies to encourage engineers and designers to embrace the design system.

• Architectural misalignment and legacy technologies present obstacles to adoption, requiring phased transitions.

• Design tokens help standardize visual elements even in non-React environments.

• The role of accountability in ensuring accessibility and quality standards are maintained, even when teams customize components.

Andrew and the hosts close the episode by discussing how individuals and organizations can begin implementing accessibility in their work.

• Recommended resources for learning about accessibility, including books and online tools.

• The importance of having an accessibility champion within a company to drive awareness and adoption.

• Practical steps developers and designers can take to improve their accessibility practices, even in organizations without formal accessibility initiatives.

This episode is packed with insights on design systems, accessibility, and the intersection of technology and user experience. Whether you’re a developer, designer, or product leader, there’s something here for you!

Ben and Ryan Show Episode 12

In this episode, your hosts Ben Nadel and Ryan Brown sit down with security expert Brian Riley, author of the HoyaHaxa blog, to discuss ColdFusion security vulnerabilities and best practices for mitigating risks. The conversation dives into recent ColdFusion exploits, how security patches impact developers, and the broader implications of securing applications beyond just ColdFusion itself.

Key Points:

• ColdFusion has been targeted by multiple 0-day vulnerabilities, highlighting its continued presence in critical systems.

• Adobe's recent security updates introduce breaking changes, forcing developers to make necessary adjustments.

• Security is a multi-layered approach—application security is just one part of a larger ecosystem that includes OS, networking, and cloud infrastructure.

• The trade-off between convenience and security often leads to vulnerabilities, especially with features like remote CFC access.

• Managed hosting providers and security tools like HackMyCF can help developers stay ahead of emerging threats.

Discussion Highlights:

ColdFusion Security Landscape

• ColdFusion is still actively targeted by attackers, despite debates over its relevance.

• Government and financial institutions heavily rely on ColdFusion, making it a high-value target.

Adobe's Recent Security Updates

• Adobe is pushing security patches that enforce stricter security measures, sometimes breaking legacy applications.

• The variable scoping issue is a major focus—forcing developers to fix long-standing bad practices.

• Deprecated encryption methods are being phased out for stronger security.

Common Security Best Practices

• Regularly update ColdFusion and all associated components like Java and Tomcat.

• Restrict access to CFIDE and ColdFusion Administrator to prevent common exploits.

• Use a multi-layered defense strategy, including web application firewalls (WAFs), OS-level security, and network protections.

Challenges of Security in Hosting and DevOps

• Managed hosting providers must balance security with not breaking customer applications.

• Attackers often leverage vulnerabilities beyond just the ColdFusion layer, including database, OS, and network weaknesses.

• Cloudflare and similar services help block DDoS attacks but aren't always sufficient in real-time scenarios.

The Convenience vs. Security Tradeoff

• Many vulnerabilities exist because developers prioritize ease of use over security.

• Features like remote CFC access, while convenient, often introduce security risks.

• Security teams and developers must collaborate to strike the right balance between usability and protection.

Final Thoughts and Resources

• Brian Riley's blog HoyaHaxa provides deep dives into ColdFusion security issues.

• OWASP’s Top Ten is a great resource for understanding common security vulnerabilities.

• Developers should engage in proactive security practices rather than waiting for the next 0-day exploit.

Recent ColdFusion Related HoyaHaxa Blogs

• https://www.hoyahaxa.com/2024/12/an-initial-analysis-of-cve-2024-53961.html

• https://www.hoyahaxa.com/2024/08/bsideslv-2024-slides-modern-coldfusion.html

• https://www.hoyahaxa.com/2024/07/on-coldfusion-administrator-access.html

Ben and Ryan Show Episode 11

In this episode, hosts Ben Nadel and Ryan Brown interview Grant Powell, founder of Curios. Grant shares his journey in the Web3 and NFT space, detailing how Curios started as a licensable NFT platform and successfully pivoted after the NFT bubble burst. The discussion dives deep into digital ownership, blockchain challenges, and how Curios is revolutionizing digital content distribution for creators.

Key Points:

• Curios' Evolution – Originally an NFT licensing platform, Curios pivoted to focus on digital content ownership after the market downturn.

• Blockchain & ColdFusion – The role of ColdFusion in building Curios' rapid development and API-driven platform.

• NFTs Beyond Art – Real-world applications for NFTs in digital ownership, including music, books, and event ticketing.

• Decentralization – The benefits and challenges of decentralized platforms compared to centralized ones like Ticketmaster.

• AI in Collectibles – Grant’s work with collectibles.com and AI-driven identification and valuation of collectibles.

Episode Breakdown:

Curios' Origin and Pivot

• Curios started as a platform to help businesses create and manage NFTs.

• The NFT craze led to unrealistic expectations, and as the hype collapsed, Curios pivoted to a broader digital ownership platform.

• ColdFusion played a key role in the flexibility and speed of their platform’s development.

Real Use Cases for NFTs

• NFTs are more than just overpriced JPEGs—they serve as proof of ownership for digital content like eBooks, music, and videos.

• Grant highlights how digital ownership differs from physical ownership and why secondary markets for digital goods are still developing.

• Ticketing is a strong use case, especially for VIP passes and exclusive access to events.

Challenges of Web3 and Blockchain Scalability

• Many blockchains create “walled gardens” that limit interoperability.

• Curios was among the first platforms to support multiple blockchains.

• Scalability issues in blockchain transactions require additional abstraction layers to ensure speed and efficiency.

Digital Rights and Ownership Protection

• Blockchain technology ensures proof of ownership, but enforcement remains an issue.

• The right to access content is separate from hosting the content itself, allowing removal when necessary.

AI and the Future of Collectibles

• Grant discusses collectibles.com and how AI is transforming the world of collecting.

• AI can help identify, grade, and value physical collectibles like coins, comics, and trading cards.

• The future of AI-driven marketplaces and its impact on the secondary market for rare items.

The Balance Between Work, Entrepreneurship, and Life

• Grant and Ben share insights on time management and balancing multiple projects.

• The importance of structuring schedules to maintain productivity without burnout.

• Investors’ perspectives on serial entrepreneurship and the fine line between focus and diversification.

Ben and Ryan Show Episode 10

In this episode of the Ben and Ryan Show, hosts Ben Nadel and Ryan Brown are joined by Dan Short, the Director of Engineering at Virtuous Software, to explore the dynamics of career paths in software engineering, particularly the transition from individual contributor to management. The conversation dives deep into personal experiences, practical advice, and insightful reflections on leadership, motivation, and the evolving role of technology in the workplace.

Key Points:

• The transition from individual contributor to management and the challenges of developing management skills

• Understanding personal "why" and aligning career choices with motivation and joy.

• Can you do both - balancing technical expertise with managerial responsibilities (or not).

• Addressing the role of AI as a supportive tool rather than a replacement for engineering roles.

• Strategies for fostering team motivation and achieving organizational goals effectively.

Dan’s Introduction and Career Path

Dan shares his journey from the Army to becoming the Director of Engineering at Virtuous Software, highlighting his transition from administrative tasks to technical and managerial roles.

• Early career in automating processes using Microsoft tools.

• Progression from IT management to web development during the early 2000s.

• Moving into management out of necessity and adapting through trial and error.

• Building and leading teams at companies like CoStar and Virtuous Software.

The Reluctant Manager Transition

Dan discusses the challenges of moving from an individual contributor to management, focusing on the struggle to find new ways to measure success and the initial reluctance to take on leadership responsibilities.

• Discovering satisfaction in mentoring and enabling team success.

• Differences between technical wins and people-oriented victories.

• Importance of defining clear roles and responsibilities.

• Lessons learned from managing through uncertainty and resistance.

Navigating Career Path Options

The team debates whether to grow into management within an existing company or seek leadership roles elsewhere, emphasizing the importance of mentorship and personal alignment.

• Balancing technical and managerial responsibilities effectively.

• Challenges of transitioning into management in familiar versus new environments.

• The value of mentorship and support systems in career growth.

• Recognizing when management might not align with personal goals.

The Role of AI and Technology in Engineering

Exploring the evolving role of AI in software development, Dan highlights its potential as a tool for enhancing productivity rather than replacing engineers.

• Practical applications of AI, like automating repetitive tasks and generating ideas.

• Addressing concerns about AI replacing human creativity and problem-solving.

• The importance of maintaining a people-centric approach in technology roles.

• Using AI for brainstorming and augmenting decision-making processes.

Advice for Aspiring Managers

Dan offers advice for those curious about management, stressing the importance of aligning career choices with personal joy and motivations.

• Trying out mentorship and team lead roles before committing to management.

• Leveraging books, podcasts, and thought leaders for continuous learning.

• Staying curious and focusing on people-centric problem-solving.

• Cultivating a supportive workplace that values both management and IC career paths.

Ben and Ryan Show Episode 9

Key points:

• AI as a spectrum: Some embrace it as life-changing, while others fear its implications.

• Early AI exploration focused on ethics and societal impacts.

• Ethical frameworks often lag behind technological advancements.

AI's practical applications, such as automating tedious tasks, were highlighted, with Shawn discussing potential benefits for developers:

• Automating unit testing could save time and increase efficiency.

• AI's role as an assistant or "intern" to augment but not replace human expertise.

• Validation remains critical to ensure output reliability.

Shawn emphasized the importance of prompts and domain knowledge for effective AI use.

They explored organizational and individual growth, discussing how to create meaningful work environments:

• Helping others achieve goals can foster personal growth.

• Transparency in team dynamics, such as working agreements, improves collaboration.

• Intentionality in interactions, especially in remote or hybrid work setups, enhances effectiveness.

The ethics of AI, especially in decision-making, was examined:

• Past AI missteps, like biased hiring algorithms, underscore the need for accountability.

• Predictive policing and crime data illustrate potential for reinforcing systemic biases.

• Informing consent and transparency in algorithms are vital to building trust.

Shawn shared insights on soft skills and people management:

• People skills are a key differentiator for success in technology roles.

• The balance between technical expertise and empathy fosters better teams and outcomes.

• Team exercises, like identifying unnecessary tasks, can drive efficiency and morale.

The episode closes with reflections on creativity, evolving frameworks, and career motivations.

• Technology should alleviate mundane tasks, enabling more focus on innovation and enjoyment.

• Tools like AI can aid creativity but should complement, not replace, human ingenuity.

• Keeping foundational skills while adapting to tools like GPT ensures long-term success.

Ben and Ryan Show Episode 8

Key topics included:

• Plug in your laptop if you are recording a podcast

Ben and Ryan Show Episode 7

• Feature Development: Charvi explained that ColdFusion development prioritizes user needs, stability, security, and performance, often influenced by customer feedback and industry trends.

Ben and Ryan Show Episode 6

Ben and Ryan Show Episode 5

In this episode, your hosts Ben Nadel and Ryan Brown are joined by xByte Cloud Chief Technology Officer, Dakota Clum, to double click into cloud hosting.

What are people doing to deploy dev code into cloud hosted servers

• RDP and make file changes directly on server

• FTP and apply updates to files one at time

• Azure DevOps - CI/CD (being adopted more)

• Agent can be deployed and have code deployed to traditional VPS

Load balancing on clusters

• Cloud based NAS shared storage between cloud servers

• Master - child replication

• SQL can load balance synchronization

• SQL can do active/passive for geo-failover

• Load balacing web servers needed before SQL needed most of the time

Deployment strategies

• Tradeoffs between efficiency and risk appetite

• You can evolve your processes over time

• No right or wrong answer

Scaling

• Depends on your needs

• Possible to run into issues where nodes not available on AWS

• Need to do reserved instances to get performance needs

• If you can predict when you need more load, you can do short term scaled servers

• Determine what needs scaled instead of entire application - or offload these to a separate service

Risk Appetite

• DR options - is it ok to be down for 15 minutes

• Cost of going from 4 9's of availability versus 5 9's

• For smaller deployments, do you need a separate dev server - non 0% chance that dev takes down production

Shared Hosting

• You get a website

• Share all RAM, CPU, Disk with everyone

• Noisy neighbor can take you down

• Generally shared hosting don't allow support for all ColdFusion hotfixes

• If just HTML files, it may not be an issue compared to also needing SQL

• Risk appetite of noisy neighbors

Most Common Security Issues We Have Seen In Other Environments

• Supporting file types not needed by your app allowing PHP executions

• Too many ports open exposing attack vectors

• SQL Injection when form input not sanitized

• File upload to default directories (don't use /upload)

• Allowing file executions in upload directories