Forwarded this email? Subscribe here for more

Architecture Weekly #145 - 18th September 2023

Oskar Dudycz

Sep 18

READ IN APP

Sponsor: Do you build complex software systems? See how NServiceBus makes it easier to design, build, and manage software systems that use message queues to achieve loose coupling. Get started for free.

Welcome to the new week!

I’d like to start by thanking you! I’m grateful for being here and motivating to keep it going. The latest news reminded me that I should do that more often. What news?

Architecture Weekly has become the official Substack Bestseller!

I decided to share with you the story of how it started. Read more.

If you don't have time to read, but you like numbers, here are some:
- 144 editions,
- 3644 free subscribers,
- 103 paid subscribers,
- 13 webinars with 21 Hours, 13 Minutes, 42 seconds duration.

Not too bad, right?

Speaking on the webinars, we had another one with Yves Goeleven about his Fantastic 9 Messaging patterns last week.

It’s available here. It’s a must-watch, and to prove that, let me share some comments from the community:

“The amount of knowledge and experience that led to this talk is hard to grasp and we got the result of that cleanly represented in 1.5 hours.”

“Distilled pill of experience, given in a dense form, packaged into extremely valuable visuals 💡”

“It is as you say a goldmine. In the never ending world of patterns and models someone, in this case, Yves have done the hard work and filtered out the patterns and processes which relates to our favorite expressions: Fact, State and Intent. 😊 “

Let’s start with a big bargain for architecture knowledge. Humble Bundle released such for O’Reilly ebooks:

Humble Bundle - Software Architecture O'Reilly book bundle

Of course, no affiliation, I’m sharing it because, for me, it was an instant buy. For the price of a single ebook, you get a bundle that includes books by Neal Ford, Gregor Hohpe, Vlad Khononov and other folks linked here in multiple editions.

Speaking of finances, FinOps became a trend some time ago, but it still is; it cannot get into the mainstream of the development processes. We’re getting hot takes showing "Cloud costs a lot, let’s get back to on-premise!”.

Roi Ravhon in the InfoQ Podcast (a creator of the Finout tool) shares his observation that counters that perspective

(…)something that press often discover is that they're not really adapting to the cloud, rather building on-prem infrastructure on AWS. And once doing that, they start to figure out that things are a lot more expensive than they hope than benchmark because they're not properly using cloud technologies as they should have. So it's like the first step or step and then they need to have to adapt and someone higher up gets all annoyed.

That’s also my observation, that people want to just do lift & shift hoping that going to the cloud will magically cut costs. That never happens.

Just like with the war on monoliths vs microservices, I think that the frontline is wrongly set up. We should consider the whole picture starting from the product financial model, people skills and organisation capabilities. Knowing that we can select the deployment model that would cost us less. Also, it’s important not to make lifetime decisions. Maybe going on the cloud with serverless can be a good starting point, and then pivoting parts into containerised or even on-premise infrastructure is a good decision.

Listen/read the whole interview at:

The InfoQ Pocast- Roi Ravhon on FinOps, Application Unit Economics, and Cloud Cost Optimization

I also wrote on my blog How money in Cloud impacts Architectural decisions?

I think that I told you already that my running joke is that if you try to fix a solution with a cache, you end up with two issues instead. I’m getting into dad jokes here, but not to leave you only with that, let me share a thorough article explaining caching concepts:

D4Debugging - Application Caching Strategies

Properly done cache can increase the performance of your system by a lot. Yet, remember that the system needs to have acceptable performance without that.

The cache can always invalidate, and usually, it does in the worst-case scenario. For instance, you cannot have an infinitely scaled cache; you need to set up some limits. If you’re in the e-commerce industry, then the time when you get the biggest traffic is the most important for your business (think Black Friday). The likelihood that the cache will overflow the max size is high. Then if your system can’t handle that, you’ll get the chance to write an intriguing post-mortem. Of course, if your business survives that.

We finally got a post-mortem from Microsoft about their Azure breach. I wrote about it 5 weeks ago in the 139th edition. To remind you, Microsoft came under blistering criticism for “grossly irresponsible” security. For instance:

On Wednesday, Yoran took to LinkedIn to castigate Microsoft for failing to fix what the company said on Monday was a “critical” issue that gives hackers unauthorized access to data and apps managed by Azure AD, a Microsoft cloud offering for managing user authentication inside large organizations. Monday’s disclosure said that the firm notified Microsoft of the problem in March and that Microsoft reported 16 weeks later that it had been fixed. Tenable researchers told Microsoft that the fix was incomplete. Microsoft set the date for providing a complete fix to September 28.

I commented that by reading the text, it’s clearly visible that if those accusations are correct, then that doesn’t look great on Microsoft.

And the accusation appeared to be correct…

Microsoft has said that roughly 25 organizations had one or more of their accounts breached in the campaign, which began on May 15 and lasted until June 16. Microsoft wasn’t aware of the mass hack until a customer tipped it off.
(…)the breach have included a US senator and an industry CEO.

Microsoft said that the reason for the breach was the MS engineer account. The thread actor acquired a signing key used to hack dozens of Azure and Exchange accounts belonging to high-profile users.

That’s also something to remember that if you have a privileged user who can have access to multiple production accounts, then your safety is as high as this person's safety.

Also, that’s a terrible mark for Microsoft, seeing how badly and slowly they approached this issue, lagging in releasing the full information and letting the potential threats because of that.

Still, no one died because of that, as with the result of ~~Twitter~~X’s privacy policy…

The Guardian - Twitter accused of helping Saudi Arabia commit human rights abuses

As we’re in the privacy area, check also a thorough article going through issues related to GitHub Pilot:

Elaine Atwell - GitHub Copilot Isn't Worth the Risk

Check also a great initiative around explaining Evolutionary Architecture made by Maciej Jędrzejewski and Kamil Bączek. They prepared a repository that, step by step, explains how you can start from simple strategies and add more when (and if) it’s needed. The big benefit is that it shows the practical code samples (in .NET so far), giving you an actionable approach.

Maciej Jędrzejewski, Kamil Bączek - Evolutionary Architecture

Maciej also explained and introduced this repository in the webinar for our community:

Architecture Weekly

Webinar #11 - Maciej "MJ" Jędrzejewski - Evolutionary Architecture: The What. The Why. The How.

Watch now (93 mins) | Architecture is about making important decisions at the right time. One of the soundest suggestions is to delay the most significant decisions as much as we can. That’s a nice slogan, but how to find the sweet spot? Maciej "MJ" Jędrzejewski told us about…