I’ve just made speach at #devconf in Brno about using gpt for IaC. The short summary: Just imagine that there is very smart junior in your team. The main problem is lack of the context

https://www.goncharov.xyz/it/gpt4iac-en.html
https://www.youtube.com/watch?v=OMOVEMChr8A

#devconf #ai #iac

🎉 Videos from DevConf are available

https://www.youtube.com/channel/UCmYAQDZIQGm_kPvemBc_qwg

my summary:

👍systemd@meta
🤔diagram as code
🤔OMG i can become root!
🤔Playbooks or Makefiles: choose your trade offs before it is too late
🔥How a hit on the head made me into a better leader (Management lessons learned from a health emergency)
🤔Shifting Performance Engineering Left
🔥The Art of Troubleshooting
🤔Taranis AI: Pioneering AI-Driven OSINT
🤔Securing Secrets at Scale: Integrating Ansible Automation with Conjur
👍Ansible automation for work and for fun
👍AI agents in incident management
🤔about:Fediverse - An introduction to the decentralised social network
🔥Click-Click and Kubernetes: Kubernetes-in-Kubernetes with Kamaji, KubeVirt, and the Cluster API
🔥gpt4iac

#devconf

🌧When the Cloud Delete Your Stuff

A person had a 10-year AWS account with important data. AWS sent a verification request and the account was deleted without a proper warning. Later the account was partially restored after people pushed the story to Reddit TOP.
Takeaways:
1. Don’t trust a single provider with the only copy. Two copies in two different places is the baseline.
2. Own your backups off the provider when possible. Snapshots inside the same account are not true redundancy.
3. Automate recovery drills. Backups are useless unless you regularly test restoration.
4. Keep billing and contact info tidy.
6. Human action still matters. Tech fails; people can sometimes save you.

Links:
- AWS deleted my 10-year account and all data without warning https://www.seuros.com/blog/aws-deleted-my-10-year-account-without-warning/
- AWS Restored My Account: The Human Who Made the Difference https://www.seuros.com/blog/aws-restored-account-plot-twist/
- 5 steps to lose your AWS account https://www.reddit.com/r/aws/comments/utwndj/5_steps_to_lose_your_aws_account/
- https://t.me/hacker_news_feed/119503
- https://news.ycombinator.com/item?id=44770250
- my photo archive https://t.me/simpleEngineerNotes/20

#aws #fail

🤡 2 Ways to solve the problem or RTFM

The task was quite simple:
1. build a java app via maven
2. during the build run some tests
3. the tests should connect to external service
4. the API key must be passed as an env var

The problem was at the first glance during a build wasn't possible to pass env vars to maven:
- the custom jenkins library was used
- the was no way to modified it
- the library was designed to follow the very specific flow


So, initial solution was:

1. Jenkins Pipeline -> Exposes credential as LLMHUBAPIKEY_text environment variable
2. setLLMHUBAPIKEY.sh script -> Creates .mvn/maven.config
3. Maven reads .mvn/maven.config -> Sets property LLMHUBAPIKEY=gen-xxx
4. Surefire plugin -> Uses property in argLine
5. Test JVM  -> Receives -DLLMHUBAPIKEY=gen-xxx as system property
6. Test code  -> Reads via System.getProperty("LLMHUBAPIKEY")

It worked, but was over engenieried and too complicated. Hopefully, after reading docs for the jenkins library it was spotted that there is ability to pass env vars to during maven build and solution was

1. Jenkins Pipeline -> Exposes credential as LLMHUBAPIKEY_text environment variable
2. Test code  -> Reads LLMHUBAPIKEY_text environment variable

Well, 3 times easier & much more simplier. RTFM

#java #jenkins #fail

🎯 How tech salaries really work and what companies actually pay \\ 2025

I’ve recently read the article. Here’s a simple breakdown, without drama(but I insist to read the source, it’s interesting)

💶Total compensation ≠ your salary

When you see $200K total comp, usually it means:
* Base salary: ~$140K
* Equity: ~$40K on paper, vests over 4 years, can be worth more or less
* Benefits: ~$15–20K (you don’t get this money directly)

The only guaranteed part is the base salary. Equity is variable. Benefits are not cash.

🛠The job market changed

2021–2022 were exceptional years: high salaries, a lot of hiring, a lot of easy money.
2025 is different:
* Mid-level roles: often $100–140K
* Senior roles: $150–200K
* Junior roles: hard to find, usually $60–90K

There are more candidates and fewer open positions, so offers became more conservative.

🗺 Geographic pay bands

Same role, same responsibilities, but pay depends on the city you live in. Companies do this not because your work changes, but because the market allows it.

👶 Junior roles aren’t really junior

Job ads often say Junior up to $120K, but the expectations look like mid-level:
* 2–3 years of experience
* Production projects
* System design basics
* On-call experience

Meanwhile, real juniors get much lower offers or struggle to get interviews at all.

🚀 Startup equity isn’t a guaranteed bonus

Equity often looks good on paper but:
* It vests over several years
* Many people leave before full vesting
* It depends on the company’s real valuation
* Exercising it may require spending thousands
* Preference stacks can reduce payouts significantly

Treat equity as a possible upside, not part of your stable income.

🎓 Titles don’t reflect pay
Senior or Staff titles vary a lot between companies. Some companies use titles instead of raises.

💰What companies really pay
* FAANG: $120–280K base depending on level
* Big startups: $100–240K base
* Series A–C: $80–200K base
* Non-tech: $60–180K

The median US software engineer salary in 2025 is around $120K base.

🤔 Final note

Software engineering is still a good career, but salary expectations should be realistic. The market is different now, companies optimize costs, and compensation packages look bigger than they actually are.

#article

EDR, IDS, NSM, SIEM compare bellow

https://t.me/simpleEngineerNotes/140

🎯 EDR, IDS, NSM, SIEM

📖 Quick glossary
* IDS (Intrusion Detection System) watches network or host activity and alerts when something looks suspicious. It doesn’t fix anything by itself
* NIDS / HIDS network IDS vs host IDS. NIDS watches traffic on the wire; HIDS watches files, processes, logs on the machine
* EDR (Endpoint Detection & Response) agent on endpoints that collects telemetry (processes, files, network), detects malicious behavior, and helps investigate & respond (isolate, kill process, etc.)
* NSM (Network Security Monitoring) full network visibility for hunting and historical packet analysis. More about forensic than just alerts
* SIEM (Security Information and Event Management) central system that aggregates logs/alerts from many sources, normalizes data, runs detections, and keeps searchable history
* Vulnerability scanner finds known CVEs in images, packages, OS. Not a detector; it’s preventive
* Audit tool checks systems against security baselines and compliance rules

🔧 What a real EDR needs
1. Endpoint agents collecting process, file, network, and logs
2. Central store + search
3. Detection rules + ability to add custom rules
4. Integration with network telemetry for context
5. Some response options (isolate host, kill process, quarantine file)
6. Vulnerability and config data to prioritise alerts
7. Long-term history for investigations

🧩 How to cover EDR
* Wazuh core of the endpoint story. Agents, log collection, file integrity, alerting, and a centralized manager. Acts like SIEM + HIDS. Good starting point for EDR capabilities
* OSQuery run SQL-like queries on hosts. Great for investigation and periodic inventory. Works well alongside Wazuh (feed OSQuery results into Wazuh)
* ClamAV basic malware scanning on files. Useful for quick scans and quarantine
* Falco runtime detection for containers / Kubernetes. Detect suspicious syscalls, container escapes. Use in any containerised infra
* Security Onion network side: IDS/NSM (Suricata/Zeek/Elastic). Gives packet-level visibility and network alerts to correlate with endpoint telemetry
* Trivy scan container images and repo dependencies (npm, pip). Run in CI and before deploy. Good for supply-chain CVE detection
* OpenVAS / GVM scheduled vulnerability scans of hosts and network services. Good for asset-level risk scoring
* OpenSCAP / Lynis regular configuration audits and compliance checks (CIS, etc.). Use for hardening and evidence for audits

✅ Combinations

1️⃣ EDR-like stack
* Wazuh (agents + manager) — collection, detections, alerts.
* OSQuery — deepen host visibility and hunting.
* ClamAV — file scans.
* Trivy theoretically can be used for for supply chain issue un runtime

2️⃣ Container / Kubernetes + endpoints
1 + Falco (runtime container detection) and Trivy (CI image scanning).

3️⃣ Network-aware, SOC setup
Security Onion + Wazuh + OSQuery + Falco + Trivy + OpenVAS.

4️⃣ Compliance & hardening
Run OpenSCAP / Lynis regularly and feed results into Wazuh.


🤔Final thoughts
Open-source combo gets you close to EDR, but it’s not a commercial EDR out of the box. Things that are harder with OSS and requires some efforts. But wazuh looks like an entry point into that world

#security #research