mjallday

this is interesting. i see you've added functionality to use these via a browser. have you considered making these tools available via a cli interface too?

Logged in specifically to agree and upvote this comment!

- on-demand preview of changes before i hit save

- source code is always embedded with the diagram and anyone can reference and edit

- source controlled history via confluence history

I've used mermaid extensively but ultimately abandoned it because it didn't have a good flow for sharing the source and history. Confluence + PlantUML is a great solution.

For too long information security has been a blocker instead of an accelerator. My nightmare scenario was a few years ago when we had to halt all production work for 6 months while we met with endless lawyers and CPAs to try and explain how our entire infrastructure was built. Developers hated it, product hated it, marketing hated it, maybe the CPAs loved it?

I've seen huge deals fall through because of failing to get compliance fast enough, or basic security missteps (how many articles about turning on MFA do we need?) lead to major incidents. And don't even get me started on consultants and spreadsheets. I have stories to share...

That is why we built Control - to solve compliance with one integration.

Controls accelerates and automates SOC2, ISO 27001, PCI and more - so that you can build your company, not work on compliance. No more legalese, writing policies or manually running endless compliance scanners across your systems.

At VGS, we're on a much bigger mission - to protect the world's information. This means that we are relentlessly committed to real security and fast compliance.

That's why as a part of this launch, we're offering guaranteed SOC2 compliance on Control for FREE. Just create an account, commit to real security, and we'll take care of the rest.

As a cloud ops minded person, we thought it would be compelling to allow people to simply connect AWS to a free read only tool, from a company I can trust with our info like VGS, just to see what security results came back.

We'd love to hear your feedback, and if you have questions about Security/Compliance, let us know. My team and I will be around all day to help.

It would be really interesting to hear you talk about how you test the policies that are written for opa.

are the policy documents stored alongside the service or kept in a central registry? do you need to include opa when doing unit testing for the individual services or can it just be layered on and integration tested?

Encryption is one part of PCI (data stored at rest and in transit). There's still a slew of controls that need to be satisfied when you have access to the data and there's no getting around them if you chose to take this burden on yourself.

The technology involved in persisting sensitive data on disk is a small portion of becoming compliant.

Having said that, huge fans of envkey.

Tokenization is just one part of the solution and you're correct, tokenization providers are plentiful.

VGS also handles compliance, audits, assumes liability and handles custodianship of the data, and provides a convention (versus configuration for most tokenization security) that provides a simple integration.

If you're looking for someone to help offload and get you compliant quickly without having to get mired into the world of compliance yourself it's a solid offering.

If you don't exercise then now would be a great time to start. Endorphins feel great and sometimes the intensity of physical activity is a good way to hit the reset switch on your brain.

Check out dwolla or balanced.

Using our (Balanced's) open source projects for paid trials for potential hires is working really well for us.

It's now a standard part of bring any engineer into the team.

It's easier to do this with front end candidates with our dashboard but also works well with backend hires using Billy, our recurring billing product, and we can now do it with infrastructure candidates since we've started opening up our cookbooks etc.

It's probably more of a marketing angle.

I don't know/care that it's a gtx 650. Just a device that fits my needs. Apple abstracts/demphasises certain details to great effect.

Languages live or die on their libraries.

This is great. I sat down to write a quick api in go about three weeks ago but couldn't find a framework that I wanted to use. This looks like it has a decent abstraction and libraries like this really help language adoption.

Much thanks to the author of the library.