<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/">
    <channel>
        <title>Steven Byrnes</title>
        <link>https://steve.net</link>
        <description>Technical deep-dives, news, and information...</description>
        <lastBuildDate>Sun, 05 Apr 2026 19:44:16 GMT</lastBuildDate>
        <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
        <generator>https://github.com/jpmonette/feed</generator>
        <image>
            <title>Steven Byrnes</title>
            <url>https://steve.net/favicon.ico</url>
            <link>https://steve.net</link>
        </image>
        <copyright>All rights reserved 1996-2026</copyright>
        <item>
            <title><![CDATA[Software Monocultures]]></title>
            <link>https://steve.net/articles/2024/software-monocultures</link>
            <guid>https://steve.net/articles/2024/software-monocultures</guid>
            <pubDate>Tue, 23 Jul 2024 05:00:00 GMT</pubDate>
            <description><![CDATA[It's been a few days since the Great Windows Crash of 2024, and I've had some time to reflect on what happened.  Here are some of my thoughts.]]></description>
            <content:encoded><![CDATA[

![](/v1/2024/a_giant_balancing_rock_on_a_tiny_base_beb3fc24-dd65-4f33-bded-fe97058732a6.png "No problem here...")

It's been a few days since the Great Windows Crash of 2024, and I have a few thoughts about what happened, and things we should consider going forward.

For those who weren't aware, on Friday, July 19th, an automated update of widely
used security program, Crowdstrike Falcon, caused Windows computers around the
globe to crash / blue screen. The fix required physical access to millions of
computers. Companies and organizations affected included airports around the
world, a high percentage of Fortune 500 companies, hospitals and healthcare
facilities around the world, and much, much more.

My tl;dr thoughts:
1. Monocultures (software and hardware) are incredibly problematic.
2. Fleet-wide automated updates are fraught.
3. Security is hard, and full of tradeoffs.
4. Remote management is essential, but sometimes you really need it at the hardware level.
5. Software can be brittle.

## The long explanation

1. The first thing that popped in my head on Friday was the phrase "software monoculture."   This describes the situation where you have a large group of computers all running the same operating system or applications.  (The same thing can happen in hardware where all CPUs from a particular company have the same vulnerability.  Since there are only a few companies that make the world's most widely used CPUs, such a bug can easily impact millions of computers or devices.)

       With a monoculture, when there's a severe bug, or a security exploit, you can end up with a scenario where all of the computers are impacted at the same time.   The impact often plays out over days, weeks, or months.  We've seen this many times over the years, and it has taken many forms.  The heartbleed security bug a decade ago took years to mostly be resolved.   However, we've never seen quite a vivid illustration of software monoculture until last week when millions of computers around the world effectively crashed all at once.

       In this case, Mac and Linux computers running Crowdstrike Falcon did not have an issue.   (Although that wasn't guaranteed unless Falcon works differently on those platforms.). And of course Windows computers not running Falcon didn't have any problems either.

       In the case of Heartbleed, it was an issue with a widely used library that ran on multiple operating systems.   So perhaps that was more widespread than a software monoculture.    Another bad, widespread example were the Meltdown and Spectre exploits, which impacted widely used CPUs.


2. Automated updates can be problematic, especially if it involves a reboot at an inopportune time, or a crash.  When it's fleet-wide, it can be disastrous.   In this case, it was a crash.  But it could be even more disastrous if a piece of malware got automatically distributed.

3. Security is hard and full of trade-offs.  Products like Crowdstrike Falcon exist to solve a very real problem: security exploits or attacks that aren't known ahead of time, and that target servers and/or desktops.   When you're facing a large, distributed attack, you need to be able to detect, and react to it.   The need for such a product or operating system feature hasn't gone away.

4. I would guess most major companies are able to remotely manage their Windows desktops and servers.   However, the most widespread products only work if the operating system is running.   Servers often have remote management capabilities that don't require the operating system to be running, but desktops... not so much.  Between point of sale-type devices, and remote work, this is a big issue.

5. Software can be brittle, and when it fails, it can fail spectacularly.  A lot of people have focused rightly on the failings of CrowdStrike.  It was clearly a bad update that should never have been pushed to millions of computers.   And there has also been a lot of commentary on how Falcon ran inside the operating system.   However, I think a case can be made that perhaps an operating system shouldn't fail like that when there's a driver issue.  Drivers need elevated permissions, but with a lot of modern CPU features, perhaps there could be better isolation within the operating system and its components.

What do you think of all of this?  Were you impacted?  Were you part of the recovery effort?   What lessons do you think we should have learned?  And what do you think we (in technology) should do differently going forward?

![](/v1/2024/hundreds_of_computers_all_with_the_Windows_Blue_Scree_3b34489e-2f75-4873-b932-5781571ff235.png "What Friday felt like")
]]></content:encoded>
            <author>contact@flatland.tech (Steven Byrnes)</author>
        </item>
        <item>
            <title><![CDATA[Security Questions vs. Modern MFA]]></title>
            <link>https://steve.net/articles/2024/security-questions</link>
            <guid>https://steve.net/articles/2024/security-questions</guid>
            <pubDate>Thu, 27 Jun 2024 05:00:00 GMT</pubDate>
            <description><![CDATA[Multi-Factor Authentication (MFA) is better, so why are we still using security questions in 2024?  They are a very bad idea.  Let's dig in!]]></description>
            <content:encoded><![CDATA[

![Bad passwords](/v1/2024/bad_passwords_4d73c50c-3287-4e49-8e50-56251e73a381.png "weak passwords")


Many websites still utilize security questions as a secondary authentication
method during account creation or password resets. While seemingly convenient,
these questions often rely on personal details easily discoverable through
social media or basic online research.

This raises the question: **Why prioritize security questions when more robust multi-factor authentication (MFA) options exist?**

Several websites, like the one I recently encountered, offer functionalities
like developer features that require additional security. However, upon
completing the access request form, the site directed me to set up a security
question. This seems counterintuitive, considering the website also offers more
secure MFA options such as authentication apps, in-app notifications, and SMS
verification.

The advantages of modern MFA over security questions include:

- Enhanced security: Randomly generated codes or biometrics provide a
  significantly higher level of protection compared to predictable personal
  details.
- Improved user experience: Modern MFA methods are often more convenient and
  user-friendly than remembering obscure answers to pre-set questions.

It's important for websites to prioritize robust MFA methods as the primary
choice for account security. Security questions, while seemingly familiar, can
be a vulnerability in today's digital landscape.
]]></content:encoded>
            <author>contact@flatland.tech (Steven Byrnes)</author>
        </item>
        <item>
            <title><![CDATA[Resume Bot]]></title>
            <link>https://steve.net/articles/2024/resume-bot</link>
            <guid>https://steve.net/articles/2024/resume-bot</guid>
            <pubDate>Thu, 20 Jun 2024 05:00:00 GMT</pubDate>
            <description><![CDATA[I decided to test out a little resume bot using Langflow, a visual tool for building RAG applications.]]></description>
            <content:encoded><![CDATA[
I wanted to try out [Langflow](https://www.langflow.org/) to build a little Retrieval Augmented Generation (RAG)
Chatbot. Langflow is, in their words, "a visual framework for building
multi-agent and RAG applications". Basically, you can hook together different
components and run them. In my case, I hooked a PDF parser, chat window, a
vector database, and OpenAI. It did not require any coding, but it's definitely
an exercise for those who are more technically savy, as you end up bootstrapping
it using a Python command.

I used [this video](https://www.youtube.com/watch?v=rz40ukZ3krQ) as a starting
point. Even though as I write this the video is less than two months old, some
things are slightly different in the Langflow user interface. To me that shows
how quickly the ecosystem is iterating.

![Langflow workflow I used](/v1/2024/resume-bot/langflow.png "Langflow workflow I used")


After I created the workflow, I started the chat. You get presented with a chat
interface similar to ChatGPT.

I started to ask it questions about my resume.

![Do I know security?](/v1/2024/resume-bot/q-security.png "Asking the bot: do I know security?")

That wasn't too bad.   Next, I asked it if I knew how to write software.

![Do I know how to write software?](/v1/2024/resume-bot/q-software.png "Asking the bot: do I know how to write software?")

This is where ChatGPT's strength really shows. It was able to pick out the tools
and languages from my resume, and it correctly structured them. Yes, it's
relatively straightforward conceptually, but given that it was able to do it
with some local data and a workflow I put together in a few minutes is quite
satisfying.

It was a fun little exercise, and it's a good example of how much great, free or
low cost software is out there. The workflow is on
[Github](https://github.com/erewhon/test-chat/) as "Resume Searcher".


[//]: # (Vector databases that use Hierarchical navigable small world &#40;HNSW&#41; indexes:)

[//]: # ()
[//]: # (- Apache Lucene Vector Search)

[//]: # (- Chroma)

[//]: # (- FAISS)

[//]: # (- Qdrant)

[//]: # (- Vespa)

[//]: # (- Vearch Gamma)

[//]: # (- Weaviate)
]]></content:encoded>
            <author>contact@flatland.tech (Steven Byrnes)</author>
        </item>
        <item>
            <title><![CDATA[Overengineering Simplicity]]></title>
            <link>https://steve.net/articles/2024/overengineering-simplicity</link>
            <guid>https://steve.net/articles/2024/overengineering-simplicity</guid>
            <pubDate>Tue, 06 Jun 2023 05:00:00 GMT</pubDate>
            <description><![CDATA[Where our hero makes the simple complicated.  Again.]]></description>
            <content:encoded><![CDATA[
<iframe  class="aspect-video w-full" src="https://www.youtube.com/embed/StTqXEQ2l-Y" title="Everything is awesome - Lego movie song" frame-border="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

There are many easy ways to write and publish content. This site is not
an example of that.

After trying many techniques over the years, I've settled into markup
transformed into HTML. Specifically, I started with
[Astro](https://astro.build/), mostly because I've used a lot of static
site generators over the years (e.g. Jekyl).

Although I like Markdown, and have used it quite a bit, on a daily basis
I use Orgmode in Emacs a lot more. Now, I could just export Orgmode
directly to HTML but… no, of course that would be too straightforward.
(It's built-in to Orgmode.)

So instead, I am using Pandoc to transform an Orgmode file into
Markdown, then I use the markdown file in Astro as an MD or MDX file.
But wait, there's more! Recent versions of Astro have a nice content
system, and it will leverage front matter in Markdown files for title,
publication date, etc. Basically all of the metadata about a post stored
in one file. Orgmode has a similar mechanism, *however* pandoc only
copies over certain fields from Orgmode to Markdown. The rest end up as
raw blocks in the Markdown, which get rendered in final HTML input and
is just totally wrong. But there is a way around it! With a little
Lua-based Pandoc filter, you can take all raw blocks and transform them
into Metadata. There's even an example in the Pandoc documentation.
However, it also includes the unknown Metadata as raw blocks. A one line
tweak to their script fixed it.

Victory! So now I'm able to comfortably write my Org files and transform
them into Markdown, then build them into the Astro website.

But will I be able to render extra things into the MDX, like React
statements? If you can see an embedded YouTube video, it answers is yes!

# Update: July 1, 2023

I had originally used some embedded MDX in the source for this page, but
it would get mangled on the way through the Orgmode to Markdown to HTML
pipeline. I tried wrapping it in `\passthrough` statements, but that
still got mangled, so I ended up hand fixing the markdown.

Today, I got frustrated with the "solution", so I ended up writing a Lua
filter that takes links like: `yt:abcdef` and turns them into the proper
`iframe` that gets passed through to MDX.

Since I can't be bothered to put the code in a Gist, here's the filter
I'm using:

``` lua
-- Really a hack to work around dual markup pipeline <sigh>
function Link(el)
  if el.target:match('yt:(.*)') then
      local target = string.match(el.target, 'yt:(.*)')
      local title = pandoc.utils.stringify(el.content)

      return pandoc.RawInline('html',
               string.format('<iframe ' ..
                             ' class="aspect-video w-full"' ..
                             ' src="https://www.youtube.com/embed/%s"' ..
                             ' title="%s"' ..
                             ' frame-border="0"' ..
                             ' allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"' ..
                             ' allowfullscreen></iframe>', target, title))
  end
end
```

I've never written Lua before, or it's been years, so there may be a
more concise way to do the above. But it gets the job done.
]]></content:encoded>
            <author>contact@flatland.tech (Steven Byrnes)</author>
        </item>
    </channel>
</rss>