Thursday 26 January 2017

How to handle a support request: GitLab

The same way as I complain when someone does a lousy job, I want to give props to a company that seems to do it just right.

I am a GitLab user by choice. A while ago I moved most of my repositories there. The initial reason for the move was that, at the time, GitHub did not allow private repositories for free users and I like to keep my projects private until I am ready to publish them.

Since then, I have not found a reason to move, it just works. Admittedly, I am a very light user, but I like what I see. As a security professional, I also like that they offer an on-premises solution and an open source one so you can fix issues if you find them.

A couple of days ago I got a GitLab invitation to a group I had not heard about. It sounded suspicious but I am currently waiting for a couple of technical tests to come my way and thought that it could be related and, in any case, there should be nothing that could attack my computer on the locked-down browser I use, so I accepted.

When I got into the group, there were over 180 users in there, but no other content. I dug out a bit more and all of the users had joined in the last 3 or 4 hours or were pending. At this point, I was sure that there was something wrong with this group, so I left and went to report it.

I sent an email to the support email (readily available in multiple places) and an email address that I guessed for the security team (no bounce, so it may actually have reached them) and got a receipt notification at 15:24. So far, so good.

At 16:34 I got a confirmation email to let me know that someone was looking into the reported issue.

At 16:38 got another confirmation email telling me that the user that invited me had been identified as a spammer and was being dealt with and a link referring to a ticket about a similar issue.

So, in less than 1:30 they read my report, performed an investigation and sent me a reply with the actions they were taking. Colour me impressed, specially because this is for a free account and I have never paid them a penny.

I have seen GitLab representatives in multiple technical sites. Whenever someone mentions any issue with the product, there will be one asking for more details and I have not seem them been rude or anything like that.

They have also been increasing the capabilities of the free version of the software as people requested them, while keeping obviously enterprise-related features for the paid one.

I was obviously pre-disposed to use them professionally before but now, after this experience, I am even keener. If they provide this level of support and responsiveness for free customers, I expect them to be great for paying ones.

Well done GitLab!

Wednesday 4 January 2017

Choosing Your Next Programming Language

It's the time for New Year resolutions and many of you will choose to learn a new programming language.

As with all choices, there are many ways of deciding the one you want but, having done this a few times, this is the criteria that I use.

First all, what do you want to achieve by learning a new language?

If you want to find a new job, your best bet is one of the really popular languages, which means something like JavaScript, Java, C#, Python, PHP or Ruby. These are not the most exciting languages but they will increase the possibility of getting a new job.

Of course, if you do know of a company you want to work for, just choose whatever stack they use. 

Also keep in mind that you are not only choosing a new programming language, you are also choosing a complete environment, with different tooling, libraries, documentation and even may require different OS. With the rise of Open Source and Free software, the cost should not be that much of an issue anymore and most licenses will allow you to use the software for free, but it's worth keeping an eye on.

If you would like to improve your development skills, there are two approaches that you can take, take a language that you already know and focusing in pushing the boundaries, EG. writing a complete new framework from scratch, try focusing on areas you do not normally do like doing embedded work if you normally do desktop applications or backend if you do frontend.

You can also choose a new language, using a different paradigm from what you normally use. For functional languages, you can use Haskell (pure, lazy evaluation), Scala (hybrid functional/oop on the JVM), F# (hybrid functional/oop on the CLR) or OCaml (hybrid functional/oop, compiled to native). For actor based systems, Erlang, Elixir (a more modern language on the Erlang VM, with improved libraries, tooling and macros), Scala. If object oriented is what you want, you could look at Ruby (dynamically typed, OO), Smalltalk (the daddy of OOP) or many others. If you want to program with statically typed languages, you can choose a new one (Go, Rust and Swift are popular) or go with statically typed languages that extend dynamic ones, such as Flow or TypeScript.

A different (and complimentary) way to choose a language is to decided what you want to do. Web development? Java, C#, Ruby, Python, PHP, JavaScript. Web APIs? The previous ones plus Go. Desktop application development? C#, Java, C++. Mobile applications? Swift for iOS, Java for Android, JavaScript for both (with Cordova/React Native), C# with Xamarin for both. System and command-line development? C, C++, Rust.

Again, you will often use the language that provides the frameworks and libraries that you need. If you want to do Windows desktop development, your best bet is C#, if you are doing Linux, probably C++ or C, etc.


In my experience, the most important thing about learning a new language is to find a project that you want to do and driving it to completion. Start small and then, once you have something completed, then add to it or find a more ambitious target.

Before someone asks, my chosen languages for early 2016 are a completely new language for me in an area I haven't done for a while, systems programming, for which I've chosen Rust and a language that I know but haven't done seriously for a while, JavaScript, both backend and frontend.