Trustin Lee

the best is yet to come / the founder of @netty_project & @armeria_project

[Trustin Lee @trustin]

Feel free to connect with me if you're at OSS Japan 👋

[Armeria @armeria_project]

We’re at Open Source Summit Japan 2025! 🇯🇵

The Armeria team is running a booth this year — stop by, check what we've been working on, and let us know how you’re using Armeria in the wild! 🚀

#OSSJapan

[Norman Maurer @normanmaurer]

Hi all,

We are happy to announce the release of #netty https://t.co/zpdqzEXIu4. This is a bug-fix release, please check our release announcement for all the details:

https://t.co/KvLsRbZWZq

[Trustin Lee @trustin]

@normanmaurer

[Norman Maurer @normanmaurer]

I am proud to share that #netty was selected by @SpotifyEng to receive their #OSS fund this year. This wouldn't have been possible without all the help of our community. Thanks a lot to everyone and of course @SpotifyEng itself: https://t.co/tBw1Z9s7C6

[Trustin Lee @trustin]

@normanmaurer You now should teach me, buddy! Pretty sure there are a lot to learn from you 🙌

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Trustin Lee @trustin]

@tison1096 Just need to find some time... 🥲

[Trustin Lee @trustin]

@WilbertRoget @Pilestedt @ArrowheadGS @PlayStation Where can I purchase and download it, instead of streaming it? Wanna cherish this awesome soundtrack in my personal FLAC collection! Bungie sells and distributes their soundtracks in their web store for an instance.

[Trustin Lee @trustin]

@lobaorn @shipilev @forked_franz @tstuefe @volker_simonis Thank you, @lobaorn ! It was never possible from all the users that contributed by asking questions and reporting bugs ❤️

[Trustin Lee @trustin]

An awesome encounter with @cra in Japan!

[Chris Aniszczyk @cra]

nice to bump into an old friend @trustin at #KubeDay Japan! I got a brief update on https://t.co/2KiKF41FlB

[Trustin Lee @trustin]

@rakyll Dark mode is so 80. Using it only for terminals 😝

[Armeria @armeria_project]

🚀 It's live: @trustin's Spring I/O talk about Armeria's powerful Spring Boot integration! Learn how Armeria simplifies your architecture by enabling seamless migration between different protocols unlike any other https://t.co/owsKQQFfKz #gRPC #ApacheThrift #GraphQL #Java #Kotlin

[Armeria @armeria_project]

Armeria 1.29.0 has been released!

🔧 Enhanced HTTP/JSON to #gRPC transcoding with custom method support
🧹 Configurable multipart temp file removal strategy
🌀 Kotlin Coroutines-based HTTP service

#microservices #Kotlin
https://t.co/bFdiDfpYcg

[Trustin Lee @trustin]

I'm in Berlin right now for the Open Source Fair on 14th. Find me at the @armeria_project booth or feel free to DM me!

[GitHub Community @GitHubCommunity]

We have a couple of amazing opportunities to promote your open source projects IRL in Berlin this summer!

› Open Source Fair w/ @GitButler Jun 13-14
› Open Source Spotlight w/ @WeAreDevs Jul 17-19

See our @thepracticaldev post for info: https://t.co/b8pKouz382.

[Trustin Lee @trustin]

@joschi83 NoMachine is pretty good. Cross-platform and feature-rich.

[Trustin Lee @trustin]

@normanmaurer @java @netty_project @armeria_project @ljcjug Sure thing!

[Trustin Lee @trustin]

🛬Arrived in beautiful London last night! ☕Please feel free to DM me for a coffee chat on @java @netty_project @armeria_project or even a tech talk session. 🗓️I'll be here until 12th. /cc @ljcjug

[Daniel Oh @danieloh30]

Great to see you @trustin my fellow Korean @Java_Champions again at @spring_io Trustin talking @armeria_project and @springboot