La Place de l'Eglise (1866) - Johan Barthold Jongkind

Securing Webhooks

In this post, I will focus on the rationale behind some popular webhook security methods and will try to explain them in simple terms. 1. Basics Risks and Measures 1.1. Webhooks can be set to leak data silently Let’s assume you are a webhook provider and an attacker compromises the credentials of one of your clients. If your platform doesn’t notify users when a webhook is created or updated - the attacker can create a webhook silently and start leaking data without alerting anyone....

September 18, 2022 · 7 min · Serhat M. Dündar
La Cote Saint Andre (1880) - Johan Barthold Jongkind

Deconstructing and Understanding an SSL Certificate

Checking SSL certificates on a browser is easy. Just click the green lock icon and you’re good to go. But what if doing the same in a more hacker way? This is where openssl comes into play. Let’s start by checking the SSL certificate of this website: openssl s_client -connect depth=2 C = US, O = DigiCert Inc, OU =, CN = DigiCert High Assurance EV Root CA depth=1 C = US, O = DigiCert Inc, OU = www....

January 25, 2022 · 8 min · Serhat M. Dündar
Road near La Cote-Saint-Andre (1885) - Johan Barthold Jongkind

Storing Passwords in a Database: Hashing, Salts, and Peppers

“How do you store passwords in a database”? A very common question for back-end-oriented interviews. After conducting hundreds of technical interviews on different levels, I can confidently say around 50% of the candidates can’t answer this question. The most common answer I often got is “there is a package/gem/library we use, and it manages the password part”. Well, yes, frameworks, libraries, and packages cover most of the complexity nowadays, but I don’t accept this as an excuse for not being curious about essentials....

January 24, 2022 · 5 min · Serhat M. Dündar
Bords de riviere (1868) - Johan Barthold Jongkind

A Primitive Hashing Function in Go

Cryptographic hash functions are complex mathematical calculations. Therefore understanding them requires a considerable amount of time and patience. However, they all have things in common: an input, a cryptographic algorithm, and an output. Recently, I had a chance to study some popular cryptographic hash functions, such as MD5 and SHA-1, and tried to understand how they really work. Wikipedia pages I linked include a considerable amount of information already, and more can be found online, but what I want to do was understand similarities between them and write my own primitive hashing function in Go....

January 23, 2022 · 4 min · Serhat M. Dündar
Paysage a la Côte Saint-Andre (1886) - Johan Barthold Jongkind

SSL/TLS Handshake, Hybrid Encryption and Public Key Infrastructure (PKI)

Hybrid Encryption: Symmetric and Asymmetric Encryption Combined Both symmetric and asymmetric encryption has advantages and disadvantages. So, which one should we use? Well, nowadays we often use them together. Asymmetric encryption is often used to exchange private keys between parties securely. In other words, parties who would communicate establish an asymmetric encryption protocol in the beginning just to exchange private keys. When the private key exchange is completed, they keep communicating by using symmetric encryption - which is faster than asymmetric encryption....

January 22, 2022 · 6 min · Serhat M. Dündar
Rue A Saint-Parize-Le-Chatel, Pres De Nevers (1862) - Johan Barthold Jongkind

Symmetric and Asymmetric Encryption

Symmetric Encryption (Private Key Cryptography) In symmetric encryption only a single key, in other words, a private key is used to encrypt and decrypt a message. Symmetric encryption is also known as “Private Key Cryptography” as the whole encryption is only based on a private key. Some popular symmetric encryption algorithms are: Algorithm Cipher Key Size Block/State Size Popularity Notes AES Block 128, 192, or 256 bits 128 bits 1 The best one....

January 21, 2022 · 13 min · Serhat M. Dündar
La Campagne Nivernaise (1873) - Johan Barthold Jongkind

Canary AWS Lambda Deployments

Lambdas aren’t easy. This isn’t just a provocative start, but instead my overall experience planning, creating, and deploying them. Let’s be honest, making something up and running requires plenty of AWS knowledge. One might get lost easily even inside IAM alone. IAM groups, IAM users, IAM roles, IAM group policy attachments, IAM policy documents, IAM role policies - and how they connect is confusing enough considering what Lambda promises, simplicity. And this is just IAM....

June 14, 2021 · 10 min · Serhat M. Dündar
Cart on the Beach at Etretat (1862) - Johan Barthold Jongkind

Book Review: The Design of Web APIs

Title: The Design of Web APIs ISBN: 9781617295102 Publisher: Manning WWW: Pages: 389 I recently had a chance to read “The Design of Web APIs” from Manning Publishing. The book is inspired by “The Design of Everyday Things”, the legendary writing of Donald Norman, that I still own as an original hard-copy printed in 1990. I like this masterpiece not because I studied Donald Norman quite a lot during my PhD studies (especially during the Human-Computer Interaction course), but also it’s still very relevant writing....

May 2, 2021 · 3 min · Serhat M. Dündar
Le Spui A La Haye (1868) - Johan Barthold Jongkind

Packing JS projects for AWS Lambda with Grunt

Grunt is a Javascript task runner. It automates repetitive tasks like minification, compilation, unit testing, linting, etc. So it’s also quite useful for packing JS projects for AWS Lambda. Install the CLI globally: npm install -g grunt-cli Add it to the package.json: npm install grunt --save-dev The Gruntfile.js or file is a valid JavaScript or CoffeeScript file that belongs in the root directory of your project. A Gruntfile is comprised of the following parts:...

May 2, 2020 · 1 min · Serhat M. Dündar
Notre Dame of Paris seen from the Quai de la Tournelle (1863) - Johan Barthold Jongkind

Rails and PostgreSQL: Types

During nokul we’ve heavily implemented PostgreSQL features into our Rails application. Unfortunately, ActiveRecord doesn’t come with constraint support for PostgreSQL, but rein does a fantastic job covering what’s missing in ActiveRecord. We believe that, one shouldn’t rely on a web application, that is very prone for human-error, when it comes to data integrity. Therefore our PostgreSQL tables included various constraints and limits. Below you will find a set of rules that we’ve investigated, implemented and battle tested with various types....

November 9, 2018 · 5 min · Serhat M. Dündar
Le Treport, Le Matin, Normandie (1852) - Johan Barthold Jongkind

Rails and PostgreSQL: Constraints

During nokul we’ve heavily implemented PostgreSQL features into our Rails application. Unfortunately, ActiveRecord doesn’t come with constraint support for PostgreSQL, but rein does a fantastic job covering what’s missing in ActiveRecord. We believe that, one shouldn’t rely on a web application, that is very prone for human-error, when it comes to data integrity. Therefore our PostgreSQL tables included various constraints and limits. Below you will find a set of rules that we’ve investigated, implemented and battle tested with various types....

November 3, 2018 · 3 min · Serhat M. Dündar
The Church of Overschie (1866) - Johan Barthold Jongkind

Tuning PostgreSQL Configuration

Configuration File RAM amounts defined below doesn’t represent the total amount of memory available for your machine, instead, it represents what PostgreSQL can use maximum. Decribed configuration requires PostgreSQL >= 10. Remove max_parallel_workers for older versions. The configuration file is usually located at /etc/postgresql/$VERSION/main/postgresql.conf in Debian-derivatives. For locating the file in other operating systems, you can use psql as follows: psql -U postgres show config_file; Tracking Query Statistics Enable the pg_stat extension, if you are interested in tracking query statistics:...

November 2, 2018 · 1 min · Serhat M. Dündar
Landscape with Man on a Donkey (1849) - Johan Barthold Jongkind

Encrypting Sensitive Data With Rails

The most recent versions (5.1 and 5.2) of Ruby on Rails has shipped with a new feature named as encrypted credentials which replaces the secrets.yml, and enables you to keep sensitive data in an encrypted file named as config/credentials.yml.enc. However, this feature only works with a single file that is config/credentials.yml.enc. Recently we needed to add some data in our repository, which we wanted to keep as encrypted, but that also didn’t really fit into the credentials....

October 1, 2018 · 2 min · Serhat M. Dündar
Notre-Dame vue du quai de la Tournelle (1852) - Johan Barthold Jongkind

Rails Instantiated Fixtures

Here is a sample Ruby on Rails fixture named as newsletter: newsletter: name: foo message: bar first_name: foo last_name: bar There are two popular ways to use this fixture in your Rails tests. The first one is directly calling the name of fixture file, followed by a symbol stating the name of any individual fixture: class NewsletterTest < ActiveSupport::TestCase test 'a sample test' do assert newsletters(:newsletter).valid? end end And the other one is assigning fixtures to an instance variable in the setup block:...

May 3, 2017 · 2 min · Serhat M. Dündar
Le Chateau De Virieu-Sur-Bourbre, Isere (1877) - Johan Barthold Jongkind

Import Big MySQL Databases Faster

I recently had to import some quite large SQL dumps to my local machine for data analysis purposes. There were 10 different .sql dumps in total, and each of them were sized more than 100GB. Naive Attempt First of all, I tried to import each by using the < operator: mysql some_database < some_dump.sql Unsurprisingly, each task took very long to finish, approximately 6-7 hours per dump file, in a brand new laptop with i7 CPU, 16GB RAM and 1TB SSD....

April 5, 2017 · 2 min · Serhat M. Dündar
Ornacieux (1879) - Johan Barthold Jongkind

Running Rake Tasks in a Loop

Rake tasks in a loop, will only executed once if they are not “re-enabled”. Take a look at this example: namespace :yoksis do desc 'fetches all references' task :references do mapping = { get_instruction_language: 'UnitInstructionLanguage', get_instruction_type: 'UnitInstructionType' } mapping.each do |action, klass| Rake::Task['yoksis:reference'].invoke(action, klass) end end desc 'fetch an individual reference' task :reference, %i[soap_method klass] => [:environment] do |_, args| puts args[:soap_method] puts args[:klass] end end When you run the yoksis:references task, it will only print out {get_instruction_language: 'UnitInstructionLanguage'} and will skip the second item of the mapping hash....

April 3, 2017 · 1 min · Serhat M. Dündar
The Towpath (1864) - Johan Barthold Jongkind

Using has_many :through for Nested Relations in Rails

has_many :through is a useful association type of Rails. It’s mostly popular and often used as a join model for many-to-many relations. However, has_many :through is more than a simple join model, because it conducts INNER JOIN(s) on related models. We can also take the advantage of this behaviour on nested has_many relations. Lets imagine a scenario where we have a nested has_many structure as follows: Country (has_many :regions) -> Region (has_many :cities) -> City (has_many :districts) -> District Models and tables of the structure:...

August 20, 2016 · 3 min · Serhat M. Dündar
Environs de Grenoble (1873) - Johan Barthold Jongkind

Boolean Type Words in YAML

YAML is a widely used data serialization language. In almost any software project, or during any dev-ops tasks, you can come across with YAML. For example Ruby on Rails uses YAML for fixtures, configuration files and localization. CI/CD tools such as CircleCI and Travis also use YAML for configuration. If you ever experienced a strange behaviour with YAML, you may have used one of the many reserved words of YAML. YAML reserves some words such as ‘yes’, ’no’, ‘y’, ’n’, ‘off’, ‘on’, etc....

June 7, 2016 · 1 min · Serhat M. Dündar
Halage En Hollande (1867) - Johan Barthold Jongkind

Calculating Similarity Between Two Data With Ruby and Elasticsearch

I recently had to find similar data located in a dataset, in order to find potential duplicate records: "John Doe 123456789" "John Foe 123123123" After considering a couple of options, I’ve decided to continue with Elasticsearch, as it was already integrated in the project I was working on. The Ruby client of Elasticsearch provided a useful function on search results, records.each_with_hit, that I could abuse for this situation: file = File....

December 8, 2015 · 1 min · Serhat M. Dündar