Christophe Limpalair

Happy new year! Since Istio ambient announced GA in Nov 2024 at KubeCon SLC, a common question I heard is what happens to my applications when ztunnel is being upgraded. Check out this GREAT blog from John Howard: https://lnkd.in/ekk4zUPk

53

Every enterprise has one - an identity abyss. It’s the place where forgotten applications sink: 👻 Contractor-built tools no one dares to touch 👻 Acquired systems with no documentation 👻 Fragile, business-critical apps still hanging on duct taped auth 👻 Code everyone’s afraid to touch because “it’ll break everything” We pretend it’s “technical debt.” But it’s actually where your biggest identity risks are hiding. The 20% of apps that behave get all the governance love. The other 80%? They live in the abyss - with hardcoded creds, shadow authentication flows, and outdated protocols. The next frontier in identity security isn’t another access review framework. It’s bringing those forgotten apps back from limbo - without breaking them. It’s about shining light into the abyss - finally seeing where identity truly lives. That’s where control begins. Orchid Security

49

There are upwards of 30 FHIR server providers (at last count). The decision of which one to use usually starts with investigating one of the five provider categories listed below, often without realizing you’re doing so. 1. The “Big 3” managed cloud providers 2. On-premises “enterprise” servers 3. Independent providers 4. “All-in-one” solutions 5. Open source servers In my experience, it’s rare for a company or organization looking for a server provider to spend serious effort in examining providers from different categories. I go into detail on each of these categories in this post: https://lnkd.in/eFqfhkKg I’ll be speaking about comparing FHIR servers at DevDays in a few weeks. Hope to see you there.

42

13 Comments

In the Denver area? This Wednesday, we're hosting another local meetup! Join us as Adam Y. presents on "Why you need aws-vault for almost everything" Adam will deep dive into aws-vault and how it can transform your AWS workflow. If you build on AWS and you don't currently use something like aws-vault, I highly recommend that you attend this talk. 💡 aws-vault is an open source tool to securely store and access AWS credentials in a development environment, but it does so much more. Learn how using it can dramatically reduce risks on developer machines while also increasing convenience when using better security practices like MFA. It makes developing your cloud workloads locally easier and more like what they’ll experience when deployed. This talk focuses on the practical applications of aws-vault and how to integrate it into your workflows. Additionally the key controls and abilities it provides will be covered from a risk mitigation perspective in a way that will appeal to developers, operators, engineering managers, and security personnel alike. 🔗 RSVP and more details: https://lnkd.in/dDufggJM 🙋‍♂️ FAQ: - This event is in-person only, we do not offer remote viewing - We don't provide any replays of these presentations (but if there's enough interest I bet I could convince Adam to join us for a Cybr webinar 😉 LMK in the comments) #awscommunitybuilders #awssecurity #cloudsecurity

28

I've been spending a lot of time lately speaking with Encore customers to learn what they're getting out of it. For many, what they are buying is basically: Not needing a DevOps team. But often that's not at all what led them to try Encore in the first place. Several found Encore when looking to migrate away from Ruby on Rails because they wanted a more performant backend framework. Only later, when they began testing Encore Cloud, did they realize it would also let them avoid hiring or scaling a DevOps team. That realization is what actually closed the deal. So how do you sell a DevOps automation platform to someone who's shopping around for backend frameworks? And perhaps even trickier, how do you sell a backend framework to someone who's looking for a DevOps tool? We're regularly doing both, but we haven't figured out the perfect answer yet. A lot of the time, seeing is believing, so we're focused on letting the product experience shine. Below is a quote from my conversation with Danny Hawkins, CTO of logistics platform provider Quiqup. Aside from liking the experience using Encore's tools, they've also been able to save $180k annually by not needing to staff a DevOps team. If you're curious you can read the full case study here: https://lnkd.in/d4bMdQ-Z And if you want similar results for your company, comment below or DM and we can have a chat.

27

After passing the security review for my file app, I distilled some of the key lessons for writing more secure code in Salesforce. This includes: - Real time feedback using static code analysis (Code Analyzer) - How to manage sharing and access with Field Level Security (FLS) - Read, update, and create data easier using Piotr Kożuchowski's Apex Libra Use the link in the comments to learn more 👇️

55

6 Comments

MSP's are chasing the Amazon-like experience, but we'll never have it unless the IT Channel starts working like Amazon. Today, customer experience flows downstream: From OEM → to distributor → to MSP → to customer. That's why it sucks, but Amazon flipped that. They built backwards—from the customer experience all the way through the supply chain. And that’s why they win. MSPs and VARs keep saying, “Our customers want an Amazon-like experience.” Then they turn around and bolt on another portal or tool that only makes things worse. Now the customer needs 6 logins just to manage their tech. No one’s logging in. No one cares how your back end works. It’s time to rethink the model. Start with the customer experience. Then work backwards—just like Amazon did in the ‘90s. If we want to modernize how IT gets bought, sold, and supported… this is where it starts. 🎙️Watch the conversation to see why the customer-first mindset is the missing piece in today’s MSP stack. #MSP #VAR #CustomerExperience

19

VictoriaLogs v1.31.0 comes with two useful enhancements: - Ability to make instant snapshots over per-day partitions. This simplifies backups and multi-tier storage schemes where older per-day partitions could be moved to higher-capacity, but less expensive storage. See https://lnkd.in/duUkcVHV - The `query_stats` pipe, which shows various statistics for the executed query. This statistics helps understanding why the query is slow and helps optimise it. See https://lnkd.in/dgCMY8h8

28

Advisory is baked in. But is it budgeted in? Most MSPs include strategic effort in their stack: QBRs, roadmaps, long-term guidance. But when there’s no structure, no segmentation, and no scoped value, that advisory layer becomes inconsistent, invisible, and unsustainable. Customer Success isn’t just “included.” It needs to be planned, delivered, and measured. Your Sustain segment needs risk protection and automated reporting. Your Educate segment needs insights, guidance, and justification. Your Modernize segment needs roadmaps and structured planning. Your Transform segment needs strategic guidance and a seat at the table. Not every client needs the same motion. That’s where most MSPs get stuck. What does good look like? > Advisory capacity scoped into managed service tiers > Budgeting (way) ahead of immediate needs > Operationalizing QBRs with roadmaps aligned to business outcomes > Making Customer Success the product, not an afterthought When advisory isn’t planned, it gets lost in the noise. When it’s productized, it drives the growth loop: impact, trust, expansion, repeat. More on this in my conversation with Luis Giraldo. We unpacked CS maturity, scalable advisory models, and what it really takes to move beyond the commodity trap. Post and video coming soon.

51

4 Comments

The "Web Whisperer" - CloudPages Build Landing Pages in SFMC. CloudPages: Create microsites, forms, and preference centers without a developer. Seamlessly connect form data to your SFMC lists. Stop bouncing between tools! 🌐 CloudPages lets you build beautiful, responsive landing pages, forms, and microsites right inside Marketing Cloud. Capture leads, update preferences, and feed all that data directly into your automations. No dev team required. What would you build? A webinar sign-up page or a survey? #CloudPages #LandingPage #LeadGeneration #SFMC #NoCode #MarketingTools #DigitalRenaissanceArchitect #lopsact

57

1 Comment

Aiven gives you OpenSearch that just works - secure, scalable, and easy to upgrade, without needing to be an expert in OpenSearch internals or AWS networking. Most teams just want to use OpenSearch, not to learn how to run it. And definitely not how to configure six different AWS services to make it production-ready. If you’ve ever tried to set up AWS OpenSearch, you know the drill: VPCs, security groups, IAM policies, fine-grained access control, snapshots, instance sizing, KMS, node-to-node encryption, Cognito for Kibana user management, and more. Before you even index your first document, you’ve already spent hours configuring the infrastructure! Disclosure: This post is sponsored by Aiven, but the reviews are mine, based on hands-on testing of their managed OpenSearch service and reviewing their docs. The first thing you'll notice about Aiven OpenSearch is just how much easier it is to set up compared to AWS OpenSearch: ✅ Encryption at rest is enabled by default. ✅ Hourly and 24-hour backups included. ✅ Multi-node cluster for high availability (optional). ✅ Built-in user management + SSO integrations (Okta, Azure AD, etc.). ✅ Logs and metrics visible in the UI, with built-in support for Datadog, Prometheus, and more. Need to upgrade the cluster? One click. No downtime. No blue/green deployment hassles. Scaling up or down? Done in minutes from the console or CLI. Snapshots? Automatic and easily restored through the console or CLI. There is even a "forking" feature for cloning an existing OpenSearch cluster (config only, or with data). Useful for creating staging or testing environments from production. Is it more expensive than AWS? Slightly. But the engineering time you save and the headaches you avoid are worth it, especially if portability or multi-cloud is part of your requirements. Use the link below to get $100 in credits and try it for yourself: https://fnf.dev/43ZX5yw

58

7 Comments

If you work in AppSec, you know the devil is in the details It’s those details that many vendors fail to communicate well We’re asked all the time: How does Escape's API discovery actually work? Here’s what we hear from you: “We get it—Escape doesn’t rely on traffic analysis. But what do you rely on?” To answer this—and more—we’ve completely revamped our documentation (kudos to Antoine Carossio 👏) to make everything crystal clear. In short: Step 1: All Escape needs to start is your company’s domain name. This acts as the foundation for our exploration process. Step 2: Advanced subdomain enumeration and intelligent crawling (including API discovery from frontend code) allow Escape to inspect a wide range of URLs, each undergoing thorough fingerprinting analysis. Step 3: Using AI-powered fingerprinting, we classify application assets, detect endpoints, and analyze response patterns—even for unique or non-standard configurations. Check out the docs for more technical precision 👉 https://lnkd.in/eBtYFV_S We hope this brings the clarity you need. At Escape, we believe transparency builds trust—and we know that in AppSec, trust is everything!

22

1 Comment

Making a config change shouldn’t require five tickets and a prayer. But when CLI scripts are manual, device updates are inconsistent, and teams don’t know what’s been touched — change becomes risky. That’s when errors slip in. That’s when compliance drifts. That’s when config management breaks down. Itential brings config management into the modern era — with automation at the core. 🔁 Back up device configs 📋 Track changes and drift in real time 🛠 Automate remediation across any CLI or API-based device 📚 Prove compliance, instantly Manage all of your of devices with the same confidence as one — without the manual effort. See how it works → https://bit.ly/4kOgK9V

20