When synchronizing a larger folder in Kube, you’ll notice that the memory usage is growing at an alarming rate.
Surely something must be wrong? Let’s dig into that.
Testing and prototyping in Kube
To build a reliable product it is essential that we build ways for us to ensure that what we build also works as expected.
In its simplest form that means that you try what you build, the assumption being that if it works for you, it works for everyone.
- By now we all know that “works for me” is not enough, but there are also a variety of additional challenges;
- It’s not enough to only test when a feature is first implemented, the tests need to be repeated regularly to ensure nothing breaks that once worked.
- There is a balance to be struck between over- and under- testing. Tests need to be of high quality and have to be maintained with the system, otherwise they become a burden instead of an asset.
- The right things need to be tested. Test things that are too trivial and you end up with loads of tests with little value (but a maintenance cost). Test things that are too complex and your tests become fragile and don’t tell you what broke, making fixing it harder.
- The testenvironment needs to be realistic enough so we test the right things (e.g. we don’t want to test the internet connection typically), yet also removes the bits that we don’t have under our control, so we test our system only. That ensure that the test remain reliable and are fast to run (so they are run regularly).
Don’t forget the attachments..
As me, you have probably been in this situation many times:
You spend hours on putting together the most perfect email presenting the project document that you have spent a month putting together, You select the most exquisite words from the vocabulary and make sure that every comma is in the right place and no spaces are left unaccounted for. You get ready for the perfect time to deliver this document to the influential audience of your mail. You press the SEND button – the email leaves your screen with a small sound ….
Incidents and Recurring Tasks
In the past, we’ve had several occurrences of DNSSEC signatures on DNS zones expiring — partly by not using our own product to the fullest extent of its capabilities. Embarrassing, if you ask me, but it’s more like a misappropriation of the features we did use, where we maybe should have used another feature better suited to our processes and collective work-flows.
So let me explain how we use Kolab’s features to battle our recurring task to refresh signatures, and why and how this is a task that requires manual intervention.
Announcing Service Windows: Reboot Weekend
As may have already been brought to your attention, some software mitigation is needed for vulnerabilities dubbed “Meltdown” (CVE-2017-5754) and “Spectre” (CVE-2017-5753, CVE-2017-5715).
If I were to summarize the issue with these vulnerabilities then in principle they would, when successfully exploited, allow reading memory that doesn’t belong to the process, the user or even the same operating system instance. In just that way, the Kolab Now infrastructure isn’t impacted.
However, we’re still going to need to patch this out. The only way we can is by updating software and rebooting systems, and this will happen during the weekend of Saturday January 13th and Sunday January 14th.
Annual SSL Certificate Refresh
This is a reminder that our annual certificate renewal period is coming up soon. Usually, we have our certificates issued some time in December, and certificate issuers allow for a grace period up to some time in January. We’re now in that grace period, so our certificates are going to be renewed and cycled throughout our infrastructure.
Recursion Violation: A 2nd 2nd Factor
A second factor protects your account, but to such extent that if you loose the one device you are normally using, you will have lost access to your account. Hence, we’re going recursive and get you a second second factor (22FA, 2FA^2).
Here’s the process;
- Create a first second factor and call it your Secondary.
- Take a picture or screenshot of the QR code, so that you can print it and store it offline, some place safe.
- Continue with enabling the first, but secondary, second factor and type the validation code so you know everything works.
- Create a new second factor, and confirm the high-security with your Secondary.
- Call the new factor Primary; this will be the one you keep on your phone, and use in your day-to-day.
- In order for this token to be scanned, you’ll have to remove the Secondary from your device.
- Continue with the process of getting your primary second factor on to your device.
- Log out.
- Lose your phone.
Help! Now what?
- Buy a new phone.
- Add back your secondary second factor using the piece of paper stored safely offline.
- Log back in using this backup TOTP-based second factor.
- Go to your settings and remove the primary token; you’ll need to confirm it using your secondary.
- Add a new factor and call it New Primary.
- Remove the secondary from your phone.
- Continue with adding back a primary token and enjoy your new token!
Simple, right? Nothing to it. Too easy.
Incident Report: DNSSEC record expired
On Saturday morning (CET) the DNSSEC records expired on one of our DNS servers. This caused a group of customers to have troubles logging in and connecting to Kolab Now services. The record has been renewed and all customers should have access (at 22:49 CET – Please read below).
PGP encryption for Kube
Secure and confidential communication is an important requirement for a society, and something, I think, we should provide to as many people as possible.
A popular mechanism to achieve this is to use public-key cryptography, which allows a person to encrypt a message to a persons key, so that only the intended recipient can decrypt the message. This means that even if an attacker would get his hands on the encrypted message, without the key, it’s only useless gibberish.
As one of the primary usecases of Kube is communication, it should also support you in doing so in a secure and confidential fashion.
Incident Report: Hypervisor Failure
This weekend, at approximately 12:00 UTC on Sunday, an issue on one of the hypervisors went by unnoticed for too long, and was finally resolved in the morning of Monday. This post explains what happened, why it happened, and what we’re going to be doing to address the situation.
