Nico 🧱

CS Engineer 🚀 Explore and discover 🚵🏻‍♀️

[Boris Cherny @bcherny]

As engineering, product, design, DS, etc. melt into a new kind of role, I was reflecting on what roles might look like in the future. For example, when I look at the Claude Code team I see what I think is five archetypes:

1. Prototyper: comes up with brand new ideas; churns out many ideas, most of which don't ship
2. Builder: quickly turns a prototype/idea into production-grade product/infra
3. Sweeper: cleans up the UI, simplifies the code and system, unships, optimizes performance
4. Grower: takes a product that has been built and iterates on it to improve Product-Market Fit
5. Maintainer: owns a mature system to make it secure, reliable, fast, and efficient as it scales

Many people span across 2 roles, and sometimes 3 roles. I also notice that these roles are not really tied to job function -- eg. across Anthropic, some designers match category 1, some 2, some 3; same for engineers, PM, DS.

A healthy team needs a mix of these, depending on the product:

- A product that is new and pre-PMF needs people that are strong at 1+2+3
- A product that is growing and has found PMF needs 2+3+4 and some 5
- A product that has strong PMF needs 3+4+5 and some 2

Maybe product roles of the future will look more like this, and less like the domain-specific roles of today?

[Dr Milan Milanović @milan_milanovic]

𝗧𝗵𝗲 𝗠𝗼𝘀𝘁 𝗗𝗲𝗺𝗮𝗻𝗱𝗲𝗱 𝗙𝗿𝗼𝗻𝘁𝗲𝗻𝗱 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀 𝗶𝗻 𝟮𝟬𝟮𝟯.

Recently, DevJobsScanner shared which frontend frameworks were in greater demand and which were best paid by analyzing actual job offers. They studied about ~500K jobs from 1 November 2022 to 31 December 2024 from different sources (LinkedIn, Glassdoor, Dice, etc.).

Here are the results:

1. 𝗥𝗲𝗮𝗰𝘁 is the most demanded frontend framework with 225k job offers

2. 𝗔𝗻𝗴𝘂𝗹𝗮𝗿 is in second place with 172k offers.

3. 𝗩𝘂𝗲 is in the third place with 48k offers

All others had less than 7.2K (Svelte, Solid.js, Alpine, Backbone, ...).

Looking at the trends during this period, 𝗔𝗻𝗴𝘂𝗹𝗮𝗿 𝗮𝗻𝗱 𝗥𝗲𝗮𝗰𝘁 𝘄𝗲𝗿𝗲 𝗾𝘂𝗶𝘁𝗲 𝗰𝗹𝗼𝘀𝗲 𝘁𝗼 𝗲𝗮𝗰𝗵 𝗼𝘁𝗵𝗲𝗿 𝗺𝗼𝗻𝘁𝗵 𝗯𝘆 𝗺𝗼𝗻𝘁𝗵. Suppose we compare it to 2022, where Angular was less in demand than React in 2023. they come closer.

Regarding the 𝗷𝗼𝗯 𝗱𝗲𝗺𝗮𝗻𝗱 𝗳𝗼𝗿 𝘁𝗵𝗲𝘀𝗲 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀 𝗽𝗲𝗿 𝗰𝗼𝘂𝗻𝘁𝗿𝘆, React dominates most countries. Still, some European countries, such as Switzerland, France, Spain, and Italy, have more job opportunities for Angular than React. In Switzerland, Angular jobs represent 65% of the frontend jobs. While in Belgium, 59% of frontend job listings require Vue expertise.

Comparing 𝘀𝗮𝗹𝗮𝗿𝗶𝗲𝘀 for each one, the highest-paid frontend framework is React, with an average yearly pay of $116k. With annual earnings of $110k and $107k, respectively, Angular and Vue are ranked second and third.

Check the entire text in the comments.

Image: DevJobsScanner

#technology #softwareengineering #coding #techworldwithmilan #frontend

[Chris Staudinger @ChrisStaud]

How SQL injections work, and how to protect your system from them.

SQL injection is a type of attack where the attacker runs damaging SQL commands by inserting malicious SQL code into an application input field or URL.

For example, imagine an app that returns all your information after logging in. That query may look like the following:

SELECT * FROM users
WHERE username = 'USER_INPUT';

If an attacker were to submit a malicious input, the query could change to the following:

SELECT * FROM users
WHERE username = '' OR '1'='1';

This query will return all users as '1'='1' will always return true.

𝗬𝗼𝘂 𝗰𝗮𝗻 𝗽𝗿𝗼𝘁𝗲𝗰𝘁 𝘆𝗼𝘂𝗿 𝘀𝘆𝘀𝘁𝗲𝗺 𝗳𝗿𝗼𝗺 𝗦𝗤𝗟 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗯𝘆 𝗱𝗼𝗶𝗻𝗴 𝘁𝗵𝗲 𝗳𝗼𝗹𝗹𝗼𝘄𝗶𝗻𝗴:

𝟭. 𝗨𝘀𝗲 𝗽𝗿𝗲𝗽𝗮𝗿𝗲𝗱 𝘀𝘁𝗮𝘁𝗲𝗺𝗲𝗻𝘁𝘀 𝗼𝗿 𝗽𝗮𝗿𝗮𝗺𝗲𝘁𝗲𝗿𝗶𝘇𝗲𝗱 𝗾𝘂𝗲𝗿𝗶𝗲𝘀

User input cannot be executed because prepared statements and parameterized queries ensure a distinct separation between user input and SQL code.

𝟮. 𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗲 𝗮𝗻𝗱 𝗰𝗹𝗲𝗮𝗻 𝗶𝗻𝗽𝘂𝘁𝘀

Use expected formats and constraints to validate user input, and clean inputs to get rid of characters that may be interpreted as SQL code.

𝟯. 𝗙𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲 𝗹𝗲𝗮𝘀𝘁 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗽𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲

Limit the permissions for database accounts used by applications and services to only what is required for their functionality. This limits the system's vulnerability to SQL injection attacks.

𝟰) 𝗦𝗲𝘁 𝗪𝗲𝗯 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹𝘀 (𝗪𝗔𝗙)

By setting up WAFs, common threats and attacks from HTTP/S traffic like SQL injections can be identified and blocked before they ever reach your application.

Learn more about API security here: https://t.co/nAmhUfSNvV

~~~

A big thank you to our partner Postman who keeps our content free to the community.

📩 If you found this helpful, consider subscribing to our newsletter where we help you level up your engineering and system design skills: https://t.co/076cpzUaQo

[Dr Milan Milanović @milan_milanovic]

𝗪𝗵𝘆 𝗱𝗼𝗲𝘀 𝗚𝗼𝗼𝗴𝗹𝗲 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱 𝗠𝗼𝗱𝘂𝗹𝗮𝗿 𝗠𝗼𝗻𝗼𝗹𝗶𝘁𝗵𝘀 𝗶𝗻𝘀𝘁𝗲𝗮𝗱 𝗼𝗳 𝗠𝗶𝗰𝗿𝗼𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀?

In the last decade, we have seen a massive trend of using microservices everywhere. We were building systems for a few hundred or thousand users and wanted to know how to make a system for millions of users. This was over-engineering and needed to be corrected. Why it was wrong? Because the development lasted long and we created incredibly complex systems, hard to maintain. This is especially true for startups that must go fast and stay simple.

A recent paper by authors from Google found that most of their developers split binaries for one of the following reasons: it improves performance, fault tolerance, and abstraction boundaries and allows for flexible rollouts.

Yet, splitting applications into microservices has its challenges:

🔸 𝗜𝘁 𝗵𝘂𝗿𝘁𝘀 𝗽𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲. The overhead of serializing data and sending it across the network is increasingly becoming a bottleneck

🔸 𝗜𝘁 𝗵𝘂𝗿𝘁𝘀 𝗰𝗼𝗿𝗿𝗲𝗰𝘁𝗻𝗲𝘀𝘀. It is incredibly challenging to reason about the interactions between every deployed version of every microservice.

🔸 𝗜𝘁 𝘁𝗮𝗸𝗲𝘀 𝘄𝗼𝗿𝗸 𝘁𝗼 𝗺𝗮𝗻𝗮𝗴𝗲. Rather than having a single bi-nary to build, test, and deploy, developers must manage 𝑛 different binaries, each on their release schedule.

🔸 𝗜𝘁 𝗳𝗿𝗲𝗲𝘇𝗲𝘀 𝗔𝗣𝗜𝘀. Once a microservice establishes an API, it becomes easier to change by breaking the other services that consume the API.

So, they proposed the following approach:

𝟭. 𝗪𝗿𝗶𝘁𝗲 𝗺𝗼𝗻𝗼𝗹𝗶𝘁𝗵𝗶𝗰 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 that are modularized into logically distinct components. A component is a long-lived agent, similar to an actor.

𝟮. 𝗟𝗲𝘃𝗲𝗿𝗮𝗴𝗲 𝗮 𝗿𝘂𝗻𝘁𝗶𝗺𝗲 𝘁𝗼 𝗱𝘆𝗻𝗮𝗺𝗶𝗰𝗮𝗹𝗹𝘆 and automatically assign logistical components to physical processes based on execution characteristics. So, if both components are in the same OS process, they are called regular method calls, but if they are co-located, calls are executed as RPCs over the network. Runtime decides whether these modules should be collocated or moved to different machines (and scaled, etc.).

𝟯. 𝗗𝗲𝗽𝗹𝗼𝘆 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 𝗮𝘁𝗼𝗺𝗶𝗰𝗮𝗹𝗹𝘆, preventing different versions of an application from interacting.

This approach consists of two main parts: a programming model with abstraction that allows developers to write modularized applications and a runtime for building, deploying, and optimizing these applications. They claim that it reduces application latency by up to 15x and costs by up to 9x by simplifying application management and deployment.

If you want to check the framework implementing the approach from the paper, check https:// serviceweaver. dev/.

What do you think about this approach? Does it look like EJBs or CORBA?

#microservices

[Cox Automotive @CoxAutomotive]

Las Vegas, we are HERE! Who is ready for NADA 2024?! We can't wait to see you at the Cox Automotive Village so soon.

#NADAshow #CoxAutomotive

[Cory House @housecor]

Problem: Your code base probably contains a lot of copy/pasted code, but it's hard to find.

Solution: jscpd

jscpd is a command line tool that finds copy/pasted code and reports specific duplicated lines.

Works for over 150 languages.

Example report:

[Nature is Amazing ☘️ @AMAZlNGNATURE]

Driving in Canada 🏔️

[David Fowler @davidfowl]

C# range as a language (ability to be both very high level and low level) is unmatched 😍.

#dotnet #csharp

[David Pine @davidpine7]

🤓 Wrote a .NET Aspire solution that exposes a Weather API to several client apps @angular, @reactjs, and @vuejs:

⚡ They're based on templates via "npm create x@latest" where 'x' is either, reactapp, vue or @angular—with table UX.

#dotnet #dotnetaspire #javascript #nodejs

[Chris Staudinger @ChrisStaud]

Load Balancer vs Reverse Proxy — What's the Difference?

Modern applications and websites handle large amounts of traffic. Two of the main instruments to ensure the smooth operation of large-scale systems are load balancers and reverse proxies.

However, they approach traffic management in slightly different ways:

𝗟𝗼𝗮𝗱 𝗯𝗮𝗹𝗮𝗻𝗰𝗲𝗿𝘀 are concerned with routing client requests across multiple servers to 𝗱𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗲 𝗹𝗼𝗮𝗱 and 𝗽𝗿𝗲𝘃𝗲𝗻𝘁 𝗯𝗼𝘁𝘁𝗹𝗲𝗻𝗲𝗰𝗸𝘀. This helps maximize throughput, reduce response time, and optimize resource use.

𝗟𝗼𝗮𝗱 𝗯𝗮𝗹𝗮𝗻𝗰𝗲𝗿 𝗶𝗻 𝗮𝗰𝘁𝗶𝗼𝗻:

𝟭) Client requests are sent to the load balancer instead of directly to the server(s) hosting the application.
𝟮) A server is chosen from the load balancer's list using a predetermined algorithm.
𝟯) The request is forwarded to the selected server.
𝟰) The server processes the requests and sends the response back to the load balancer.
𝟱) The load balancer forwards the response to the client.

A 𝗿𝗲𝘃𝗲𝗿𝘀𝗲 𝗽𝗿𝗼𝘅𝘆 is a server that sits between external clients and internal applications. While reverse proxies can distribute load as a load balancer would, they provide advanced features like SSL termination, caching, and security. Reverse proxies are 𝗺𝗼𝗿𝗲 𝗰𝗼𝗻𝗰𝗲𝗿𝗻𝗲𝗱 𝘄𝗶𝘁𝗵 𝗹𝗶𝗺𝗶𝘁𝗶𝗻𝗴 𝗮𝗻𝗱 𝘀𝗮𝗳𝗲𝗴𝘂𝗮𝗿𝗱𝗶𝗻𝗴 𝘀𝗲𝗿𝘃𝗲𝗿 𝗮𝗰𝗰𝗲𝘀𝘀.

Whilst load balancers and reverse proxies possess distinct functionalities, in practice the lines can blur, as many tools act as both a load balancer and reverse proxy. For example, tools like Nginx can perform both roles depending on their configuration.

[Chris Staudinger @ChrisStaud]

The main components of Docker explained.

Building and deploying applications has its complexities. Software inconsistencies across different environments lead to significant issues including deployment failures, increased development and testing complexity, and more.

Docker solves the "it worked on my machine" problem, and streamlines application deployment by encapsulating applications and their dependencies into standardized, scalable, and isolated containers (containerization).

Docker has a handful of core components powering the technology. By understanding them you will have a strong fundamental understanding — Let's dive in!

Images:
Read-only templates that are used to build containers. Images are created with Dockerfile instructions or can be downloaded from a Docker registry like Docker Hub.

Container
An instance of an image. It's a lightweight, standalone package that includes everything needed to run an application.

Dokcerfile
A script-like file that defines the steps to create a Docker image.

Docker engine:
The Docker engine is responsible for running and managing containers. It's composed of the Docker daemon and the Docker CLI that communicates through REST API.

Docker daemon:
The daemon is a persistent background service responsible for managing objects. It does so via listening for API requests. Docker objects include images, containers, networks, and storage volumes.

Docker registry:
Are repositories where Docker images are stored and can be distributed from. Docker registries can be public or private. Docker Hub is the default public registry that Docker is configured with.

Docker network:
Containers run on networks allowing them to communicate with each other and the outside world. The network provides the communication gateway between containers running on the same or different hosts.

Volumes:
Allow data to persist outside of a container and to be shared between container instances, even after a container is deleted. Volumes decouple data life from the container lifecycle.

The components listed above all tie together to produce a simple system for developers to automate the deployment, scaling, and management of applications. This has led Docker to become a powerful and integral tool in modern software development.

[Chris Staudinger @ChrisStaud]

Clean Architecture explained.

— What is Clean Architecture
— The anatomy of Clean Architecture
— Advantages & drawbacks
— Use cases

Tomorrow thousands of subscribers will learn all about Clean Architecture.

Join us to get the issue: https://t.co/GnJOJZKqok

[Chris Staudinger @ChrisStaud]

SOLID principles explained.

SOLID represents five principles of object-oriented programming. Whether or not you use OOP, knowing these principles gives you a lens into the foundations of clean code which can be applied to many areas of programming.

S — Single Responsibility Principle
O — Open/Closed Principle
L — Liskov Substitution Principle
I — Interface Segregation Principle
D — Dependency Inversion Principle

Let’s break down each principle:

1. Single Responsibility Principle (SRP)

Each unit of code should only have one job or responsibility. A unit can be a class, module, function, or component. This keeps code modular and removes the risk of tight coupling.

2. Open-Closed Principle (OCP)

Units of code should be open for extension but closed for modification. You should be able to extend functionality with additional code rather than modifying existing ones. This principle can be applied to component-based systems such as a React frontend.

3. Liskov Substitution Principle (LSP)

You should be able to substitute objects of a base class with objects of its subclass without altering the ‘correctness’ of the program.

An example of this is with a Bird base class. You might assume that it should have a ‘fly’ method. But what about the birds that can’t fly? Like a Penguin. In this example, having a ‘fly’ method in the Bird class would violate LSP.

4. Interface Segregation Principle (ISP)

Provide multiple interfaces with specific responsibilities rather than a small set of general-purpose interfaces. Clients shouldn’t need to know about the methods & properties that don't relate to their use case.

Complexity ↓
Code flexibility ↑

5. Dependency Inversion Principle (DIP)

You should depend on abstractions, not on concrete classes. Use abstractions to decouple dependencies between different parts of the systems. Direct calls between units of code shouldn’t be done, instead interfaces or abstractions should be used.

[Chris Staudinger @ChrisStaud]

REST vs GraphQL.

— How REST and GraphQL work
— The benefits and drawbacks of each
— A comparison between the two
— Where each shines best

Tomorrow thousands of subscribers will learn about REST and GraphQL.

Join us to get the issue: https://t.co/GnJOJZKqok

[Chris Staudinger @ChrisStaud]

GraphQL vs REST.

We just released an article in our weekly newsletter breaking down;

— How GraphQL and REST work
— The benefits and drawbacks of each
— A comparison between the two
— Where each shines best

Missed the issue? Check it out here: https://t.co/t93AqikFEf

[Chris Staudinger @ChrisStaud]

Monolithic vs Microservices Architecture - Which is Best?

Before we start, why should you care? System design decisions are important because it’s hard to reverse. Careful consideration is needed to ensure you’re meeting your system's requirements.

Monolithic vs microservices is an instance of this.

Monolithic is a software design pattern where all application components are combined into a single, tightly-coupled, unified application.

Whereas in a microservices design, components of an application are structured as a collection of loosely coupled, independently deployable services. Each service corresponds to a specific business functionality.

E.g, say we have a social media platform with the following functions:

🔸User management
🔸Content creation & management
🔸Interactions
🔸Notifications
🔸Messaging

In a monolithic architecture, all of the business functions mentioned above exist & are deployed as a single unit. With all data housed in the same database.

In a microservices architecture, each of the business functionalities listed above is treated as a single unit with its own database. An API Gateway routes requests to services, aggregates responses, and more. A centralized management service handles load balancing, failure recovery, configuration, and more.

Monolithic pros:

✅ Simplicity: easier to develop, test, & deploy an app as a single unit
✅ Performance: Can be faster due to shared memory access & no network latency
✅ Unified process: Everything happens in the same place & process — easier data management.

Monolithic cons:

❌ Scalability: Minimal flexibility as everything scales together even if just one component needs it.
❌ Deployment risk: Every change requires an entire deployment. Because every component is interconnected, a bug in one area can bring the entire application down.
❌ Technology lock-in: The application is often restricted to one tech stack

Microservices pros:

✅ Independent deployment: Each service can be deployed, scaled, upgraded, & restarted independently
✅ Resilience: The impact if one service fails is limited to that service & its consumers — reduced blast radius
✅ Flexibility: Choice of optimal tech stack for each service

Microservice cons:

❌ Complexity: added complexities such as inter-service communication, data consistency, and more
❌ Data management: keeping data consistent across services can be challenging
❌ Operational overhead: Increased complexity of monitoring, deployment, logging, and more

So, which should you choose?

Monolithic is best for:

🔹Smaller scale applications
🔹Apps that require simple deployment and development
🔹Fast and reliable communication between components is required
🔹Apps that need atomic transactions

Microservices are best for:

🔸Larger scale systems
🔸Simpler management of development & deployment between teams
🔸Future scalability is required
🔸Apps that need fault isolation

[Chris Staudinger @ChrisStaud]

HTTP vs HTTPS — What’s the Difference?

HTTP → Hypertext Transfer Protocol.
HTTPS → Hypertext Transfer Protocol Secure.

Here are the key differences between the two:

The primary difference between these two protocols is 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆.

𝗛𝗧𝗧𝗣 𝗶𝘀 𝗻𝗼𝘁 𝘀𝗲𝗰𝘂𝗿𝗲. Data exchanged between your browser and the site you're visiting is in plain text (unencrypted). If someone intercepts this transmission, they can read and manipulate the data.

𝗛𝗧𝗧𝗣𝗦 𝗶𝘀 𝗮 𝘀𝗲𝗰𝘂𝗿𝗲 𝗽𝗿𝗼𝘁𝗼𝗰𝗼𝗹. Information transferred is encrypted using SSL (Secure Sockets Layer) or TLS (Transport Layer Security) protocols, providing privacy and integrity of information.

𝗗𝗮𝘁𝗮 𝘁𝗿𝗮𝗻𝘀𝗳𝗲𝗿 for HTTP occurs on port 80, whereas HTTPS utilizes port 443. The browser handles this automatically.

The protocols have different 𝗨𝗥𝗟 𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲. A website that uses HTTP starts with the 'http://' prefix, while a website that uses HTTPS starts with 'https://'.

For websites handling sensitive data such as credit card information, HTTPS is a must. Even if a site doesn’t handle sensitive data, the extra security with 𝗛𝗧𝗧𝗣𝗦 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝘀 𝘁𝗿𝘂𝘀𝘁 𝗮𝗻𝗱 𝗰𝗿𝗲𝗱𝗶𝗯𝗶𝗹𝗶𝘁𝘆 to users.

𝗦𝗘𝗢 is often a very important area of business, for this, HTTPS is the way to go. Not using HTTPS will significantly hurt ranking as it is an important ranking factor.

In summary, the internet uses the HTTP and HTTPS protocols to move data around. However, HTTPS is a secure protocol that offers identification, privacy, and data integrity.

[Chris Staudinger @ChrisStaud]

This week we will cover:

— Understanding database types
— A look into binary trees
— What is Kafka, and how does it work
— SSL vs TLS

Don’t want to miss out? Subscribe to our free newsletter for a weekly deep dive & content roundup: https://t.co/XkFxRiQI5Z

[Chris Staudinger @ChrisStaud]

Caching is key for optimized performance. Caching layers include:

— Hardware layer
— System layer
— Network and distributed layer
— Application layer

Tomorrow, thousands of subscribers will learn where caching is used.

Join us to get the issue: https://t.co/cdQACkYrkn

[Chris Staudinger @ChrisStaud]

Every component of a URL explained in under 2 minutes: