Toni Mira

Chief Architect, Department of Health, Catalonia. Swimming, Triumph Bonneville and Barça enthusiast. Proudly married to M and father to S, M and C.

[Toni Mira @jmirap]

@mariusserra Un competidor nat dels enigmarius, el trobarem a faltar. Descansa en pau, Carles

[Toni Mira @jmirap]

@sempresaludava Bravo Jair😘😘

[Sergi Marcén 🎗 @sergimarcen]

I el més important, ho he fet gràcies a un equip de professionals increïblement bons. A ells, especialment vull agrair-vos la feina, una feina que moltes vegades no es veu, però que en canvi es necessària perquè el nostre dia dia sigui possible.

[Stanislav Kozlovski @kozlovski]

Uber has one of the largest Kafka deployments in the WORLD…

So how do they secure it?

mTLS and strong authorization rules.

Uber models its production environment as a zero-trust network. Since any host can be compromised, they rely on strong cryptographic primitives to establish trust between services. 🥷

uPKI is Uber’s identity platform, based on top of Spire. It’s responsible for issuing short-lived, auto-rotated cryptographic key pairs. Those pairs consist of an X.509-SVID, a private key and a trust bundle. 🔐

With this setup, the system automatically refreshes (rotates) its certificates once they’re near expiry.

The Spire agent keeps a long-lived connection open to the Spire server and proactively generates a new cert when the time is right.

💡 This is key, because it allows Uber to issue very short-lived certificates which then bound the time a bad actor has to make use of any leaked credentials.

mTLS gives Uber authentication, confidentiality via encryption, and data integrity. 👍

What’s missing is authorization now.

Similar to checking in to a flight after they’ve verified your ID (you are who you say you are) - the next check is:
✋ are you actually allowed to board this flight? (do you have the ticket with the right permissions)

For this, Uber has a service named Charter. Similar to AWS IAM, it’s a framework allowing you to specify who and what can access specific services and resources.

Kafka has a pluggable authorization framework, where you can configure a custom Authorizer class to do the authz for you (`authorizer_class_name`).

This authorizer gets called as part of any request flow. In Uber’s config, it’s called with a pair of actor, resource and operation.

🎬 actor - the entity that is the subject of the authorization decision (e.g you at an airport). Also called a KafkaPrincipal in Kafka.

🪨 resource - the resource upon which the authorization decision is made (e.g the flight)

🔧 operation - the operation performed on the resource (e.g boarding). Also called an ACLOperation in Kafka

The Authorizer makes a remote RPC call to Charter to figure out the decision for this pair, and from then-on it caches the result.

Simple, right?

[Carles Valbuena @CarlesValbuena]

Jo, com molta altra gent, tinc un problema seriós amb Netanyahu.

Alhora, aquest és un dels discursos polítics més fenomenals que he escoltat en tota la meva vida.

Estic realment impressionat.

El millor? Que està improvisant, amics.

I ho fa davant el psicòpata que presideix Espanya, que no sap on ficar-se.

[Gergely Orosz @GergelyOrosz]

One of my best productivity investments: an active noise cancelling, over-the-ears headphone. Makes a massive difference in a shared office, when traveling, and even when working at home (when there are small noises).

I am reminded how useful it is on the days I don’t have it.

[Esmorzars De Forquilla.Cat @EsmorzarsLleida]

Avui és un dia per estar content😍

El meu mapa al web https://t.co/d8bsFehpRI , acaba de superar les 400.000 visites en menys de 3 anys🙄

Trobareu més de 200 locals d'arreu visitats per mi, amb les imatges i escrit a xarxes de la visita🕵🏻‍♂️

RT plis, hi ha molta feina darrera🙏🏻

[Catalunya Ràdio @CatalunyaRadio]

"Que ens deixin fer la nostra feina". @EnPeyu, en Jair [@sempresaludava], la @Neusssi i en @JordiBorda reivindiquen la cultura catalana i en català als premis #Ondas2023. Seguim! 💪
https://t.co/Xu8mPdBIeV

[Sam Altman @sama]

the mission continues

[Satya Nadella @satyanadella]

We remain committed to our partnership with OpenAI and have confidence in our product roadmap, our ability to continue to innovate with everything we announced at Microsoft Ignite, and in continuing to support our customers and partners. We look forward to getting to know Emmett Shear and OAI's new leadership team and working with them. And we’re extremely excited to share the news that Sam Altman and Greg Brockman, together with colleagues, will be joining Microsoft to lead a new advanced AI research team. We look forward to moving quickly to provide them with the resources needed for their success.

[Kenji Hiranabe @hiranabe]

Topology(rigorous mathematics) that aims to describe "Conway's Law" and "Team Topologies". You are mentioned. @TeamTopologies @matthewpskelton @manupaisable cc: @kakutani @haradakiro @ryuzee @miholovesq
https://t.co/VOObHXR6Tf

[Castells en Xarxa @CastellsEnXarxa]

😱 D'aquesta manera han descarregat els @borinots el primer 𝟰𝗱𝟵𝗳 de la seva temporada! 🔥🔥🔥

#castellsenxarxa #castells #castellers #castelleres

[OpenAI @OpenAI]

OpenAI announces leadership transition https://t.co/fFYDLwGXQz

[Charity Majors @mipsytipsy]

Book signing! Come on by and get your copy 📚🖊️🐝🌈🌷✨ #KubeConNA #KubeCon with @gmiranda23 at @honeycombio booth

[Cory Doctorow NO LONGER ON TWIT TER @doctorow]

There's a cheat-code in US #antitrust, it's been increasingly used since #Reagan and the "#ConsumerWelfare" theory ("#monopolies are fine, so long as the lower prices") shoved out the long-established idea that antitrust existed to prevent monopolies from forming *at all*.

1/

[NBA @NBA]

LUKA MAGIC.
WHAT ELSE CAN YOU SAY.

4 straight threes... each getting progressively more difficult and more clutch... to reach 49 points and give Dallas the win.

Special stuff from a superstar.

[Patrycia Centeno @PoliticayModa]

#lovePardodeVera

[Raju Gandhi @looselytyped]

Holy cow! If you are an aspiring (or even veteran) #software #architect you CANNOT miss this @humble https://t.co/dQXw3nr1m2. Books from @neal4d @markrichardssa @samnewman and so many more. Absolutely a must-have!

[Corey Sanders @CoreySandersWA]

With our focus on empowering customers to create value in the cloud, our partnership with Oracle helps meet the evolving needs of organizations. We’re bringing together the best of Oracle and Microsoft by making OCI database services available in Azure.

https://t.co/DuXS5RxAHO

[Satya Nadella @satyanadella]

Our expanded partnership with @Oracle will make Microsoft Azure the only other cloud provider to run Oracle's database services.