wftglf

Disappointed to discover OP didn't actually go and eat in all the kebab shops.

Hmm but is it excellent for kebabs? I'm more a falafel person so can't really judge but I think crystal kebab is the only one and it doesn't do any form of deep fried chickpeas I rate the chinese place over the road though!

Hey, author of the post here. I've had quite a bit of feedback on the post from some people with a lot more Qubes experience than me - there are definitely some issues with it - e.g. you can install software from non-default repos in Qubes without setting a netvm for the template. We'll publish an edited version soon in case anyone else stumbles across it.

"Qubes is awesome, but it's no substitute for an air gap." - agreed - for some stories an actually air-gapped machine is essential - if nothing else just because it's very easy when messing round in Qubes manager to add a netvm to the wrong Qube.

However, of the stories we receive coming through SecureDrop system, many don't have the risk profile of something like Snowden - e.g. a local politics story that GCHQ aren't likely to be too fussed about. For these cases, it's helpful to have an environment which is secure, but has a browser available for e.g accessing our CMS or doing research.

On our team we swapped databases 6 times in a year. We’ve landed on Aurora Serverless V2 – was it worth it?

> It's not too long ago they would ask for information faxed using company letterhead, as a form of legitimization.

I had PayPal ask me for exactly this (emailed rather than faxed) recently for my PayPal business account!

No, I think it's on our own infrastructure.

It's the same system, just without any tags on it that mix it in with editorial content. I think if we wanted it published somewhere like the technology section we'd have had to go through a much more rigorous editing process (we probably wouldn't have got away with 3000 words!)

The main advantage of the migration was getting onto a fully managed DB. What we didn't mention was that there were also huge cost implications - savings of ~£40k - through switching to RDS - compared to paying for a mongo support contract.

In a happy world the guardian wouldn't rely on a company we spend a lot of time reporting on for unethical practices (tax avoidance, worker exploitation etc.) - but we decided it was the only way to compete. One of the big drivers was a denial of service attack on our datacentre in 2014 on boxing day - not an experience any of us want to have to deal with again.

Thanks to hacker news and reddit this piece got over 100,000 page views which should be enough to justify the blog staying on platform!

Sadly we don't trust our security practices anywhere enough for that! Secret investigations happen in an air gapped room on computers with their network cards removed then get moved across to the main CMS when they're ready to publish.

Yep that's what we were doing, and the management software (OpsManager) was also running on EC2 instances. We messed up the VPC configuration so that NTP didn't work on some of the instances - which unsurprisingly broke authentication between OpsManager and the db instances