A few months ago I noticed the same pattern across multiple teams:

Dependabot alerts were technically enabled, but nobody was really looking at them.

Not because people didn’t care about security. The problem was simpler: developers spend their day in Asana, Jira, or Linear, not in GitHub’s Security tab.

So vulnerabilities stayed open for weeks, sometimes months, and eventually became background noise.

To fix that, I built security-workflow-sync.

It’s a small open source tool that reads Dependabot alerts from GitHub and syncs them into the workflow system your team already uses.

Today it supports Asana. Jira, Linear, and GitHub Issues are planned next.

Subscribe to Implementing 💻

🔧 The solution

security-workflow-sync connects GitHub Dependabot with your task management tool.

It fetches open Dependabot alerts from a GitHub organization and creates matching tasks in Asana.

The tool itself does not scan dependencies and it does not replace existing security tooling. Dependabot still handles detection. This project only handles synchronization and task ownership.

Everything runs from a single Docker command, so you can run it locally, from CI, or from a scheduled cron job.

🔑 Prerequisites

Before running the tool, two things must be enabled on the GitHub side for each repository you want to monitor:

• Dependency graph: GitHub parses your manifest files (package.json, requirements.txt, pom.xml, …)

• Dependabot alerts: GitHub matches your dependencies against the Advisory Database and produces alerts

Both settings can be enabled at organization level.

One important detail: enable “Automatically enable for new repositories”, otherwise newly-created repositories will silently miss Dependabot coverage.

You'll also need a GitHub Personal Access Token with the `security_events` scope (authorized for the organization) and an Asana Personal Access Token.

📦 Step 1: Bootstrap the Asana project

The `bootstrap` command creates a new Asana project with the right sections and custom fields. Run it once:

docker run --rm --pull always \
  -e ASANA_ACCESS_TOKEN=... \
  marcomoauro/security-workflow-sync:latest bootstrap

If your token has access to a single Asana workspace, it gets auto-detected. If you belong to multiple workspaces, the command lists them and asks you to pick one via ASANA_WORKSPACE_GID.

The command prints the generated ASANA_PROJECT_GID. You’ll need it for the sync step.

marcomoauro@MacBook-Pro-2 ~ % docker run --rm --pull always \              
  -e ASANA_ACCESS_TOKEN=XYZ \                   
  marcomoauro/security-workflow-sync:latest bootstrap
[info] Auto-detected Asana workspace: Acme (991745504083).
[info] Creating Asana project "Security Findings" in workspace 991745504083…
[info] Created project 1215096078675826.
[info] Created section "Critical".
[info] Created section "High".
[info] Created section "Medium".
[info] Created section "Low".
[info] Created section "Team Assignment".
[info] Reusing existing custom field "SWS: Severity" (1215098554617643).
[info] Reusing existing custom field "SWS: Repository" (1215095156543835).
[info] Reusing existing custom field "SWS: Package" (1215095954783217).
[info] Reusing existing custom field "SWS: Tech Team" (1215094188188106).
[info] Reusing existing custom field "SWS: Advisory" (1215294138228970).
[info] Reusing existing custom field "SWS: Advisory URL" (1245094997344211).
[info] Reusing existing custom field "SWS: Deduplication ID" (1215194138115263).

Bootstrap complete.
Export the following env var when running `sws sync`:

  ASANA_PROJECT_GID=1215093077675836

Next steps:
  1. Run `sws sync` to pull current Dependabot alerts into the project.
     The first sync also creates one placeholder task in the "Team Assignment"
     section for each repository it encounters.
  2. After that first sync, open the Asana project and set the
     "SWS: Tech Team" field on each placeholder.
  3. From the next sync onward, every alert for that repository will
     inherit the team automatically.

🔄 Step 2: Sync

docker run --rm --pull always \
  -e GITHUB_TOKEN=... \
  -e GITHUB_ORG=... \
  -e ASANA_ACCESS_TOKEN=... \
  -e ASANA_PROJECT_GID=... \
  marcomoauro/security-workflow-sync:latest sync

The first sync creates one task for each open vulnerability and places it into the corresponding severity section.

The task name follows the format [Severity] package - owner/repo.

The task notes include:

• advisory link

• vulnerable version range

• affected manifest files

• first patched version.

Running the sync multiple times is safe. Existing alerts are updated instead of recreated.

Subscribe to Implementing 💻

👥 Team ownership

When the sync sees a repository for the first time, it creates a placeholder record in the Team Assignment section with the repo name. You manually set the Tech Team value on that placeholder once.

From that moment, every alert for that repository automatically inherits the assigned team, including across syncs and reopened alerts. The team field is append-only: once set, the tool never overwrites it on individual tasks. Manual edits made directly inside Asana stick.

This avoids having to assign ownership manually for every new alert.

🎯 Filtering by repository

If you want to roll this out gradually, you can limit the sync to a subset of repositories:

docker run --rm --pull always <env vars> marcomoauro/security-workflow-sync:latest sync \
  --include-repos acme/web-app,acme/billing-service

When --include-repos is set, the tool fetches alerts only from those repos via GitHub’s per-repo Dependabot endpoint. For small rollouts this is also much faster than scanning the whole organization.

--exclude-repos can be used to skip archived or noisy repositories.

🕐 Putting it on a cron

Read more

For AWS queues using the SQS service, you can create these 3 Cloudwatch alarms to help you ensure everything is working correctly:

• Message production

• Consumer is inactive, there are messages in the queue but the consumer is not retriev…

Read more

In this episode, I'm going to introduce you to the MCP server that I made for Substack.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/substack-mcp

Subscribe to Implementing 💻

🔒 Substack lacks public APIs

Substack lacks public APIs, so I reverse-engineered the platform to understand the data exchanged between the platform's UI and backend.

This allowed me to use the same mechanism to request operations.

I've discovered that the session is managed through a cookie, which is exchanged in all calls between the client and the backend. This cookie is used to verify if the user is authenticated and authorized for the operations they're requesting.

Using the same mechanism, I created an e-mail sequence platform for Substack that allows for creating customized workflows to send e-mails every day.

You can find the post here:

🖥️ What is an MCP Server?

as well explained by modelcontextprotocol.io:

MCP is an open protocol that standardizes how applications provide context to LLMs. It provides a standardized way to connect AI models to different data sources and tools.

MCP follows a client-server architecture where a host application can connect to multiple servers:

• MCP Hosts: Programs like Claude Desktop, IDEs, or AI tools that want to access data through MCP

• MCP Clients: Protocol clients that maintain 1:1 connections with servers

• MCP Servers: Lightweight programs that each expose specific capabilities through the standardized Model Context Protocol

• Local Data Sources: Your computer’s files, databases, and services that MCP servers can securely access

• Remote Services: External systems available over the internet (e.g., through APIs) that MCP servers can connect to

Subscribe to Implementing 💻

🔑 Retrieve your Substack credentials

To use the server, you need to retrieve 3 parameters:

• Session token

• Publication URL

• User ID

Session token

This information is exchanged in all authenticated calls between the UI and the backend. You can retrieve it using your browser's devtools, such as Chrome in my case.

Go to Network, filter the calls by Fetch/XHR and look for the call drafts?offset=.....

Among the request headers, look for Cookie, which contains a list of information in the “key=value;” format. From these, retrieve the session token found in the substack.sid or connect.sid key. Only one of these will be present, so simply retrieve the value you find!

In my case, I have the substack.sid cookie. Please note the value we'll need later for the MCP Server.

Publication URL

This is the domain of your newsletter, which you can find in the address bar. In my case, it's https://implementing.substack.com

User ID

Just like the Session token process, open the network and search for the publication_user call.

Go to the response, Preview section, and retrieve the id from the user key. If you have multiple users in your newsletter, retrieve the id associated with the user with your name.

Subscribe to Implementing 💻

📘 How to start the MCP server

You can use the MCP server in two ways, via NPX (Node.js) or via Docker.

NPX (Node.js)

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I show you how to deploy a FIFO queue with a producer and a consumer with the Serverless framework.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/sqs-queue-lambda

Subscribe to Implementing 💻

🔄 What are Queues?

A queue is an architecture component that manages tasks or messages in a specific order.

Queues are helpful because they allow systems to handle tasks efficiently and avoid being overwhelmed. They make sure that tasks are completed in the right order and can be processed when resources are available.

This leads to better performance, easier management of tasks, and more reliable systems.

Advantages of using queues:

• Load Balancing: By managing the flow of tasks, queues prevent systems from being overloaded. When too many tasks arrive, the queue holds them until the system is ready to handle them, thus maintaining a balanced workload and preventing crashes or slowdowns.

• Reliability: Queues ensure that every task gets processed, even if the system is busy or experiencing issues. This reduces the risk of losing tasks and ensures that all operations are completed successfully.

• Scalability: Queues can handle a growing number of tasks without a drop in performance. As the demand on the system increases, queues allow it to scale up smoothly, ensuring that additional tasks are managed efficiently.

• Decoupling producer and consumer rates: Queues allow the producer and consumer to operate at different speeds. If the producer generates tasks faster than the consumer can process them, the queue temporarily stores the excess tasks until the consumer is ready. This decoupling helps manage traffic spikes allowing the system to handle peak loads without overwhelming the consumer. Only the component producing messages needs to be scaled, while the consumer can remain unchanged.

AWS Simple Queue Service (SQS)

SQS is a cloud service that helps manage and store messages between software components. It ensures that messages are sent and received reliably.

SQS offers two types of queues: Standard and FIFO.

• Standard queue:

Standard queues provide high throughput, allowing a large number of messages to be processed quickly.

They are designed for applications where occasional duplicate messages and out-of-order processing are acceptable. This type of queue is ideal for scenarios where speed and scalability are important, such as processing tasks in parallel or distributing work across multiple consumers.

Messages are delivered at least once and there is no guarantee of the order of delivery.

• FIFO queue:

FIFO (First In First Out) queues ensure that messages are processed exactly once and in the exact order they are sent.

This makes them suitable for tasks that require strict order and exactly once processing, such as financial transactions or inventory updates.

FIFO queues have a limited throughput compared to Standard queues, but they provide stronger guarantees about message delivery and processing.

Each message is delivered once and remains available until it is processed and deleted.

Subscribe to Implementing 💻

👨‍💻 Let's implement together

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/sqs-queue-lambda

We implement a Lambda function that exposes an API via AWS API Gateway to process HTTP calls and queue messages.

The presence of a queued message triggers a second Lambda function, which acts as the consumer of the message.

serverless.yml

We can create resources in this way:

org: implementing
service: sqs-queue-lambda

provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-2
  tags:
    Name: sqs-queue-lambda
  environment:
    QUEUE_URL: ${self:custom.queue.url}
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - sqs:SendMessage
      Resource: ${self:custom.queue.arn}

plugins:
  - serverless-offline

resources:
  Resources:
    queue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: queue.fifo
        FifoQueue: true

functions:
  app:
    handler: lambda.handler
    events:
      - httpApi:
          path: /{proxy+}
          method: ANY
  consumer:
    handler: consumer.handler
    events:
      - sqs:
          arn: ${self:custom.queue.arn}
          batchSize: 1

custom:
  serverless-offline:
    reloadHandler: true
  queue:
    arn: !GetAtt queue.Arn
    url: !Ref queue

• Queue definition:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I’ll show you how to deploy a DynamoDB table and how to configure a Lambda that reads and writes to it.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/lambda-dynamodb

Subscribe to Implementing 💻

🗄️ DynamoDB

DynamoDB is a NoSQL database service provided by Amazon Web Services.

It is fully managed, which means AWS takes care of all the maintenance and scaling, so you don't have to worry about managing the infrastructure.

It’s schemaless, meaning it does not require a fixed data structure, making it flexible to store different types of data.

Partition key and sort key

In DynamoDB, data is organized using a primary key, which can be a partition key alone or a combination of a partition key and a sort key.

• partition key:

The partition key is a unique identifier for each item in the table and determines how data is distributed across partitions. This helps ensure even distribution and efficient access.

The partition key must be unique for each item in the table when used alone.

• sort key:

The sort key is used in combination with the partition key to create a composite primary key. This allows multiple items with the same partition key to be stored, with the sort key providing additional uniqueness and enabling items to be sorted within each partition.

The sort key allows you to perform more refined queries, such as retrieving items within a specific range, filtering results based on sort key values and sorting.

Subscribe to Implementing 💻

Search operators: Query and Scan

In DynamoDB, searching data can be done using two main operations: Query and Scan.

• query:

The Query operation is efficient and retrieves items based on the primary key values, which can include both the partition key and sort key. By specifying the partition key, you can quickly find all items that share the same partition key value.

Additionally, you can use conditions on the sort key to filter the results.

Query are ideal when you know the specific partition key value and optionally want to filter or sort items within that partition.

• scan:

The Scan operation, on the other hand, examines every item in the table. While this can retrieve all items that match the specified criteria, it is less efficient than Query, especially for large datasets, because it must read every item in the table.

Scans are useful when you need to retrieve a broad set of data and don't have a specific partition key to narrow down the search.

It is more flexible but should be used sparingly due to their higher resource consumption and slower performance compared to Query.

Subscribe to Implementing 💻

👨‍💻 Let's implement together

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/lambda-dynamodb

I show you how to create a DynamoDB table and a Lambda that can read and write to it.

DynamoDB table Users

We add the following resource to the serverless.yml file:

(serverless.yml)
...

resources:
  Resources:
    DynamoDBTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: UsersTable
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
...

This small snippet lets us define the UsersTable.

The AttributeDefinitions and KeySchema sections define the table's structure, only the fields for the partition key and sort key are required; other fields can be added later.

In this case, we've set the id field as a string (S) and as the partition key (HASH). Since there's no sort key, this means we can have at most one user with the same id.

With “BillingMode: PAY_PER_REQUEST” you are charged based on the actual read and write requests your application makes to the table, rather than provisioning a fixed amount of read and write capacity units.

Subscribe to Implementing 💻

Lambda

Similarly to what we saw in the last episode we define a lambda that will act as a wrapper for the entire Koa.js application:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I show you how to deploy your Koa.js application in a Lambda function with AWS.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/lambda-node-backend-template

Subscribe to Implementing 💻

👋 Introduction

In the previous episode, we saw how to deploy a Lambda function using Serverless, with the trigger calling a function in a JavaScript module.

(serverless.yml)
...

functions:
  hello:
    handler: handler.hello
...

(handler.js)
...
export const hello = async (event) => {
  return {
    statusCode: 200,
    body: JSON.stringify({
      message: 'Hello from Implementing!'
    })
  };
};
...

With the Serverless framework it is also possible to deploy applications made with technologies such as Express, Koa.js and many others, with minimal overhead.

The result will be a single Lambda function will be deployed that exposes the application and delegates routing management to it, if configured appropriately.

In this way, development can continue as usual with minimal changes to the developer experience, making it easy to introduce the framework even to teams unfamiliar with Serverless technology.

Subscribe to Implementing 💻

👨‍💻 Let's implement together

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/lambda-node-backend-template

The structure of the application is similar to the one I use in all my projects that I then deploy on Heroku, a detailed explanation can be found here:

Create Koa.js app

Similar to the template I always use, the only difference is that the app created with the Koa library is not used to create an HTTP server.

Middleware and routes are registered in the app and then exported:

import cors from '@koa/cors';
import Koa from 'koa';
import json from 'koa-better-json';
import {koaBody} from 'koa-body';
import {APIError404, APIError405, APIError415, apiErrorManager} from './errors.js';
import log from './log.js';
import {
  initAsyncStorage,
  logIncomingCall,
  routeSummaryLog
} from './middlewares.js';
import router from './router.js';

process.on('uncaughtException', (e) => log.error('uncaughtException', e));
process.on('unhandledRejection', (e) => log.error('unhandledRejection', e));

const app = new Koa();

const body_limits = {
  formLimit: '64mb',
  jsonLimit: '64mb',
  formidable: {maxFileSize: '64mb', multiples: true},
  multipart: true,
};

app.use(cors({exposeHeaders: ['x-version']}));
app.use(koaBody(body_limits));
app.use(json());
app.use(initAsyncStorage);
app.use(routeSummaryLog);
app.use(logIncomingCall);

app.use(async (ctx, next) => {
  try {
    ctx.set('x-version', process.env.npm_package_version);
    await next();
    if (!ctx.body) {
      // if body is not defined at this moment, it means that no route matched the request, so a 404 error is fired.
      throw new APIError404();
    }
  } catch (error) {
    apiErrorManager(ctx, error); // error handler
  }
});

app.use(router.routes());
app.use(
  router.allowedMethods({
    throw: true,
    notImplemented: () => new APIError415(),
    methodNotAllowed: () => new APIError405(),
  }),
);

export default app;

Subscribe to Implementing 💻

Expose app with serverless-http

To expose the app we can use the serverless-http, this library allows you to “wrap” your API for serverless use.

We can install it by executing:

npm i serverless-http

We create a lambda.js module like this one:

import slsHttp from 'serverless-http'
import app from './src/app.js'

export const handler = slsHttp(app)

and we will configure the handler in the serverless.yml configuration file:

(serverless.yml)
...

functions:
  app:
    handler: lambda.handler
    events:
      - httpApi:
          path: /{proxy+}
          method: ANY

...

Subscribe to Implementing 💻

Environmental variables management

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, you will learn how to deploy Lambda functions so that they can be invoked via an HTTP call using the AWS API Gateway.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/hello-world-lambda

Subscribe to Implementing 💻

👋 Introduction

Serverless technology is very interesting because it allows you to focus on your product goals without worrying about managing servers. This makes the development process much easier and more enjoyable. I discovered the benefits of serverless computing thanks to a former colleague who introduced me to it.

I will guide you through the process of creating and deploying your first AWS Lambda function.

You will learn how to set up the function so it can be invoked through an HTTP call using AWS API Gateway. This will be a great starting point for understanding how serverless applications work and how you can leverage them to build scalable and efficient solutions.

Subscribe to Implementing 💻

👨‍💻 Let's implement together

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/hello-world-lambda

You will need the setup I showed here:

Initialize project

let's create a serverless project, to do so we can open the terminal and run the command:

sls // or "serveless"

we choose:

AWS / Node.js / Simple Function

and then:

Skip Adding An App

choose a project name, once done enter the project folder and initialize an NPM project with:

npm init -y

within the project you will see that there are two files:

• serverless.yml

• handler.js

Subscribe to Implementing 💻

serverless.yml

serverless.yml is a configuration file used in serverless applications.

It defines the functions, events, and resources for your serverless service. With this file, you can specify how your functions should be deployed, what triggers them, and what permissions they need. It simplifies managing and deploying serverless functions.

This is an example:

org: implementing
service: hello-world-lambda

provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-2

functions:
  hello:
    handler: handler.hello

the sections we find are:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I show you how to configure all the tools you will need to u…

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

This episode of Implementing is a bit different from the previous ones, you will find:

• 🎉 Achievements, subscribers and views.

• 🌟 Announcement of the paid plan.

• 🤝 Start collaborations with founders to sponsor launches on Product Hunt.

Subscribe to Implementing 💻

🎉 1,000+ Subscribers!

Last week Implementing reached 1,000+ subscribers, an achievement I never imagined six months ago when I started the newsletter.

Thank you! 🙏

Knowing that so many people read my posts makes me happy and motivates me to keep going.

Writing for Implementing allows me to do what I love: explore new technologies, discover new approaches, meet people and create mini projects.

🌟 Paid plan

I've decided to introduce a paid plan, this will help me to:

• Cover the costs of tools and services like Heroku, OpenAI API, Bubble, Canva, AWS, and Grammarly.

• Buy online courses to learn new technologies.

• Have a budget to invest in enhancing Implementing.

What is included in the paid plan?

Paid plan is a single subscription that allows you to:

• Use all the tools I develop: with the free plan you can still use them but a limited number of times.

• Read all posts of Implementing: for free subscriptions a paywall will be applied to all posts older than one month from the current day.

Among the projects you can use, there are:

1. Youtube video summarizer: get YouTube video summaries in your preferred language sent directly to your email.

   

2. Substack articles summarizer: summarize Substack articles directly in your preferred language.

   

3. Email sequence for Substack creators: I have created a system for sending recurring emails on Substack, you simply create a post draft and select filters to retrieve the users you want to send the email.

   

4. Free subscription to Quickview's paid plan: every day sends an email with summaries of Youtube videos on cryptocurrencies by top creators. With Implementing paid subscription you receive Quickview paid plan for free.

Subscribe to Implementing 💻

🤝 Sponsor Product Hunt launches

Product Hunt is a platform where you can discover and share new products, apps, and tech innovations. Users post their latest finds, and the community votes on the best ones, helping you stay updated on the coolest new tools and gadgets.

Before I started with Implementing, I worked on various projects with the goal of launching them on Product Hunt. As good developers, we can build great systems, but we face challenges when it comes to market them.

That's why I decided to open up to collaborations to support the launch of tools on Product Hunt. In each episode you will find a short section with a picture of the tool, a description, and a link to support the product on the platform.

The goal is to help the founders to increase their visibility and let you know about their great products.

If I can, I'll try to get some discounts! 😁

Sponsor your launch 📣

🌟 Top lectures of the week

How Instagram Scaled to 2.5 Billion Users

I Created a Google Sheet for Devs in Europe to Share Salaries and Saving Rates

UML Class Diagram Explained with Examples

5 Toxic Behaviors to Avoid if you are a Software Engineer

And that’s it for today! If you are finding this newsletter valuable, consider doing any of these:

1. 🍻 Read with your friends — Implementing lives thanks to word of mouth. Share the article with someone who would like it.

   Share

2. 📣 Provide your feedback — We welcome your thoughts! Please share your opinions or suggestions for improving the newsletter, your input helps us adapt the content to your tastes.

   Leave a comment

3. 💬 Chat with me — If you have any doubts or curiosity, please write to me, I will be happy to answer you!

I wish you a great day! ☀️

Marco

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I will introduce the Bcrypt algorithm, compare it to SHA-256, and a possible implementation in Node.js.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/bcrypt-user-password

Subscribe to Implementing 💻

⚠️ Why it is important to avoid storing passwords in plain?

Storing passwords in plain text is a serious security risk.

If a database is hacked, all user passwords are exposed, potentially resulting in unauthorized access to accounts and sensitive information.

Attackers can easily exploit passwords in the clear, causing identity theft, financial losses and damaging an organization's reputation.

To safeguard user data, you can use secure hashing algorithms. These algorithms encrypt passwords, making them extremely difficult for attackers to crack.

Bcrypt algorithm

Bcrypt is a widely used cryptographic hash function.

It employs a technique called adaptive hashing to protect passwords from brute force and rainbow table attacks.

Bcrypt uses a salted hashing approach, adding a random string to each password before hashing, which increases security by preventing the use of pre-calculated hash tables.

Subscribe to Implementing 💻

🔒 How does Bcrypt work?

The information the algorithm needs includes:

• password

• cost factor: a number indicating how many iterations the algorithm must perform before producing the result. Higher values require more time.

From this information, the algorithm produces a 22-character salt that is added as a prefix to the resulting hashed password. The salt makes hash dictionary and brute force attacks virtually impossible.

The output of the algorithm will always be 60 characters, structured as follows:

The cost factor is what makes the algorithm secure; it determines the number of iterations that must be performed, influencing the time and resources required to produce the final hash.

Password verification

Let's imagine we generated this hash: $2y$10$n0UIs5kJ7naTuTFkBy1veuKOkSxUFXfua0KdOKf9xYTOKKIGSJwFa from the password implementing.

The algorithm extracts the salt (n0UIs5kJ7naTuTFkBy1veu), the cost factor (10), and applies the hashing procedure again to the given password.

The computation will require 2^cost_factor (10) iterations before producing the final hash.

If the final hash matches the initial hash, the password is correct, otherwise, it is incorrect.

If we add a pepper?

A classic approach to enhancing password security is to use a pepper, an additional secret string added to the password, similar to a salt, before hashing.

The pepper is typically stored as an environment variable or in a secrets manager.

However, applying a pepper with the Bcrypt algorithm is not necessarily a good idea for several reasons:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I'll show you how to use Redis to efficiently manage leaderb…

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I show you how you can summarize Substack articles using OpenAI and scraping, at the end of the article you will find a graphical interface through which you can summarize your favourite articles.

You can summarize the articles for free via this link: https://substack-summarizer.bubbleapps.io/version-test

Subscribe to Implementing 💻

👋 Introduction

Over time, I have subscribed to numerous newsletters, each of which offers interesting and valuable content. However, the volume has become excessive and it is impossible for me to read them all. To solve this problem, I decided to implement an article summary.

This tool allows you to paste the link to any article and provides a concise summary of the content. In addition, it can translate the summary into any language you prefer, making it easier and smoother to read.

I implemented a similar solution to summarize YouTube videos in the user's preferred language, you can retrieve the episode here, inside you will find a link to access the UI:

Subscribe to Implementing 💻

🛠️ Solution design

The idea is to use scraping and OpenAI's chat completions API as shown below:

1. The user initiates the process by entering the desired language and the URL of the Substack article they want to summarize and translate.

2. The client sends a request to the server using the GET /summarize-article API endpoint. This request includes the language and URL provided by the user.

3. The server performs web scraping on the provided Substack URL to retrieve the article content. This involves fetching the webpage and extracting the text of the article.

4. The Substack platform responds to the server's request by returning the full content of the specified article.

5. The server sends the content of the article together with the specified language to the OpenAI API. It asks OpenAI to generate a summary of the article and translate it into the desired language.

6. The OpenAI API processes the server's request, generating a summary of the article and translating it into the specified language. The results are then sent back to the server.

7. The server returns the result of the operation to the client.

8. The client receives the summarized content and displays it to the user.

   Subscribe to Implementing 💻

👨‍💻 Let's implement together

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/substack-summarizer

We start as usual with the backend template for Node.js that I have shown you here:

Model

we start by creating the Article.js model, with the aim of retrieving the content by scraping and summarizing it via the OpenAI chat completions API:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I want to show you the differences between the offset-based and cursor-based approach to pagination and a possible implementation in Node.js.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/pagination-offset-cursor

Subscribe to Implementing 💻

📃 Pagination

Imagine having millions of records stored in a database and having to retrieve them via an API. This can become problematic as the huge volume of data causes delays and performance problems.

With such a large volume of data, the recovery process can quickly become resource-intensive. The size of the data set introduces challenges such as latency issues, where the time required to retrieve and transmit data increases as the volume increases. In addition, the pressure on server resources increases, potentially leading to slowdowns or even system crashes.

Pagination is a simple but effective solution to this problem, consists of dividing the data into manageable parts or “pages”, facilitating retrieval and processing for the server and management on the client, as displaying a lot of data on the interface can cause performance problems due to the size of the data to be managed.

In detail, we will analyse two techniques:

• Offset-based pagination

• Cursor-based pagination

Subscribe to Implementing 💻

🔢 Offset-based pagination

select *
from customers
order by id asc
limit 3
offset 0

Pagination based on limit and offset is a common technique used in databases to retrieve a subset of data at a time.

• limit: The limit refers to the maximum number of records that you want to retrieve in a single query. For example, if you set the limit to 10, the query will return a maximum of 10 elements.

• offset: The offset refers to the starting point from which you wish to retrieve data. It indicates the number of records you wish to skip before starting to retrieve data. For example, if you set the offset to 3, the query will start retrieving data from the 4 record onwards, skipping the first 3 records.

To retrieve subsequent data, simply increase the offset as shown below:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I'll explain what HTTP response payload compression is, including the algorithms involved and how to implement support for them in a Node.js server.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/magic-link-auth

Subscribe to Implementing 💻

👋 Introduction

Consider that you have an API needs to transmit a large JSON file over the Internet. Sending such a large file could take a long time to transfer and could consume a significant amount of bandwidth.

Compression techniques allow the API to reduce the size of the JSON file before sending it over the Internet. By compressing the file, the data is encoded more efficiently, resulting in a smaller packet. This compression process not only speeds up transmission times, but also reduces the bandwidth required for the transfer.

Therefore, when the API compresses the JSON file before sending it, it benefits in several ways. Firstly, it ensures that the data reaches its destination more quickly, improving overall efficiency. Secondly, it reduces the pressure on Internet resources, making the transmission lighter.

How to request compression from the server?

It is the client that decides to request compression and uses the Accept-Encoding header where it makes explicit all the compression formats it can handle.

the server receives the API call, processes it and before returning the response to the client, compresses it by choosing one of the algorithms made explicit by the client, if supported.

Finally it returns the compressed response to the client by adding the Content Encoding header, so the client knows how to decompress the response to process it correctly.

Pros vs cons

In addition to the benefits of lower bandwidth occupancy and consequent reduction in overall latency, compression introduces inefficiencies.

Pros include:

• ✅ Reduced file size: compression significantly reduces file size. This enables faster transfer of data over the network, especially in conditions of limited bandwidth such as mobile devices.

• ✅ Improved website performance: file compression helps to reduce the loading time of web pages. As file sizes are reduced, browsers can download content faster, improving the user experience and helping to reduce site abandonment rates.

• ✅ Reduced latency due to smaller payloads: Compression leads to smaller file sizes, resulting in reduced latency. Compressed files take less time to be transferred over the network because there is less data to transmit. As a result, HTTP requests can be processed faster, reducing the overall response time of the server.

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I introduce the concept of foreign keys in relational databases such as MySQL by showing the advantages and disadvantages of using them

Subscribe to Implementing 💻

👋 Introduction

Imagine we want to represent a reality where we have customers and the orders they have placed, with a one-to-many relationship.

In UML we could represent it like this:

that in MySQL is reflected in this DDL:

CREATE TABLE customers
(
    id    INT AUTO_INCREMENT PRIMARY KEY,
    name  VARCHAR(50),
    email VARCHAR(100)
);

CREATE TABLE orders
(
    id          INT AUTO_INCREMENT PRIMARY KEY,
    customer_id INT,
    order_date  DATE,
    amount      DECIMAL(10, 2)
);

To establish a 1-to-many relationship, we create the foreign key customer_id in the orders table. This allows each order to be associated with the respective customer who placed it. In this way, we created a connection from the orders table to the customers table.

Foreign keys

The purpose of foreign keys is to facilitate navigation and linking between two tables, managed through a CONSTRAINT in the database. This means that when inserting new records in tables containing foreign keys, the database ensures that the value entered for the FK exists in the reference table, thus guaranteeing so-called referential integrity.

The foreign key constraint is specified during the definition of the database tables. In the previous example of customers and orders, we can make the constraint explicit like this:

CREATE TABLE customers
(
    id    INT AUTO_INCREMENT PRIMARY KEY,
    name  VARCHAR(50),
    email VARCHAR(100)
);

CREATE TABLE orders
(
    id          INT AUTO_INCREMENT PRIMARY KEY,
    customer_id INT,
    order_date  DATE,
    amount      DECIMAL(10, 2),
    FOREIGN KEY (customer_id) REFERENCES customers (id)
);

this constraint introduces advantages and disadvantages in its use, which will be addressed in the following sections.

Subscribe to Implementing 💻

Pros

✅ Database consistency

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode I want to show you how to create a rate limiter using Redis with its atomic and transactional methods.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/redis-rate-limiter

Subscribe to Implementing 💻

👋 Introduction

Rate limiting is a technique employed to restrict the number of requests a client can make to a server, ensuring the security and stability of the application. By implementing rate limiting, we can prevent overload scenarios that may impact essential resources such as the database.

This technique is crucial in countering various cyber attacks, including:

• Brute force attacks: By limiting the number of requests, we prevent attackers from using server resources to systematically attempt to guess user passwords and gain unauthorised access to the application.

• Denial of Service attacks (DoS): Rate limiting prevents attackers from flooding the server with a barrage of requests, thus limiting attempts to overload and disrupt the server's operations.

• Scraping: Limiting the number of requests per IP address prevents attackers from scraping sensitive data from our application by restricting their ability to make excessive requests.

Possible solutions

We can use various strategies to implement a rate limiting mechanism in our application, one does not exclude the other, in fact mixed systems are usually employed:

• Fixed-window: this consists of checking how many calls are made by the client in a fixed window such as 1 minute, if more are made then all subsequent calls are rejected until the start of the next window.

• Sliding-window: differs from fixed-window in that the window runs over time, e.g. we could take into account the calls made in the last 5 minutes, this approach allows us to better adapt to traffic spikes.

• Token bucket: a bucket is used which contains tokens, each of which represents a call that can be made and with each invocation the tokens are decremented. Once finished, the client cannot call again until the tokens in the bucket are restored, so the server can manage the rate of calls. This approach is efficient in memory but may be susceptible to race conditions in multi-threaded environments or when processes share the same resources.

In our case, we are going to implement the fixed-window mechanism using Redis via the atomic function INCR and the use of TTL.

Subscribe to Implementing 💻

✅ Fixed-window strategy

1. The client calls the server API identifying itself by the API key.

2. The server queries the database to verify the validity of the API key.

3. The database returns the result of the key validity check to the server.

4. The server verifies the use of the API key in the cache.

5. The cache increments the API key usage counter within the time window.

6. The cache checks whether the API key usage is within the limits allowed by the time window.

7. If the API key usage is within limits, cache informs the server that the usage is within limits.

8. If the API key usage is within limits, server tells the client that it can continue with processing.

9. If the API key usage exceeds the allowed limits, cache informs the server that the usage has exceeded the limits.

10. If the API key usage exceeds the allowed limits, server stops API execution by responding to the client that API key usage has exceeded limits.

    Subscribe to Implementing 💻

    ---

⚡️ Redis: MULTI, INCR and EXPIRE commands

I used Redis in this way to limit requests within a fixed window of one minute:

First, I created a key in this format: "rate_limit/{api-key-id}/{time-format}/{time}", where:

• api-key-id: is the ID of the API key in our database.

• time-format: is the format used, in our case is minutes ("m").

• time: represents the specific minute when a client makes a call.

if a call is made at minute 3 of the api key with ID 1 we would have the following Redis key:

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode I show you how to introduce a caching system like Redis by showing you how I did it for the Magic Link-based authentication app.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/magic-link-auth

Subscribe to Implementing 💻

👋 Introduction

Let us imagine that we have an API that aims to retrieve information from the database and then serve it up on a web page by the client.

Managing numerous database calls that repeatedly return very similar data can cause inefficiency problems because the database must be queried each time, consuming time and resources to obtain the same data over and over again.

Employing a cache can significantly alleviate this problem.

By caching frequently accessed data, subsequent requests for the same data can be served directly from the cache, reducing the need to query the database repeatedly. This speeds up response times and reduces the load on the database server, resulting in improved overall system performance.

What if the data are changed?

Cache introduces a trade-off between consistency and performance.

While caching can still improve performance by reducing the number of database queries, it may lead to stale data being served from the cache if updates are not properly synchronized.

In such cases, the system must balance the benefits of improved performance against the risk of serving outdated information. Strategies such as implementing cache invalidation mechanisms or setting shorter cache expiration times can help mitigate this trade-off by ensuring that the cached data remains relatively fresh.

It's essential to carefully evaluate the requirements of the application and the frequency of data updates to determine the most suitable caching strategy.

Subscribe to Implementing 💻

✅ Cache aside strategy

One possible strategy that can be used to introduce a caching mechanism is Cache Aside (or Lazy loading).

Data is cached only when it’s requested.

When an application requests data, it first checks if it is present in the cache, if present, it is returned directly from the cache otherwise it is retrieved from the source (e.g. a database), stored in the cache for future requests and then returned to the application.

in this way we obtain the following advantages:

1. Reduced latency: frequently requested data is cached, reducing the time required to access it compared to retrieval from slower storage systems such as databases.

2. Scalability: by reducing the load on back-end systems such as databases, the effective use of caching can help improve the overall scalability of the system.

3. Improved user experience: By serving frequently accessed data from the cache, users experience faster response times and smoother interactions with applications or websites. This leads to a more satisfying experience.

and disadvantages:

1. Waste of resources: when storing infrequently used data.

2. Data consistency: introduces the need to manage synchronization and cache invalidation to ensure that the data are up-to-date and consistent with the source.

   ---

👤 User caching in the Magic Link login app

Once the user has logged in, the client calls the server api GET /users/me to retrieve the user's data, here we can introduce a caching mechanism to avoid querying the database.

Let us introduce the mechanism using the following sequence diagram:

1. Client calls the server api GET /users/me.

2. Server checks if the user is in the cache.

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I show you how the Bloom Filter data structure works and a possible implementation in Redis.

You can find the implementation here: https://github.com/marcomoauro/magic-link-auth/blob/main/src/usernameBloomFilter.js

Subscribe to Implementing 💻

🎲 Bloom Filter

A Bloom Filter is a probabilistic data structure, it allows representing a large amount of data using minimal memory. Its main feature is the ability to decisively state the absence of an element while admitting a certain probability for its presence.

It is represented by a finite array of bits, which are initially set to 0.

Unlike a HashMap, a Bloom filter doesn't save the actual values of the elements in the domain. Instead, it uses a bit array to store 0 and 1.

This efficiency is achieved through the use of K hash functions, which map elements onto a bit array. However, due to the finite size of the array and potential hash collisions, false positives can occur, indicating the presence of an element that isn't actually there.

The size cannot be changed once it has been established since doing so would result in the loss of references between bit array locations with hash function results. Changing the size requires recreating the filter all over again.

This efficiency makes Bloom Filters a top choice in many applications where fast operations and memory-saving are key priorities.

Hash functions

To ensure swift performance, it's essential for hash functions to distribute the domain values evenly across the filter and generate collisions infrequently. It's good practice to test the filter with elements from your domain to understand its performance and make adjustments as necessary.

Typical hash functions used are:

• SHA256

• MurmurHash

• Fowler–Noll–Vo (FNV)

Search of an item

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

in this episode I will explain how the magic link authentication mechanism works by showing you an example of the implementation.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/magic-link-auth

Subscribe to Implementing 💻

👋 Introduction

Passwordless login is a modern authentication method that allows users to access their accounts without entering a traditional password.

Instead of relying on passwords, users receive a secure authentication link or code via email, SMS, or other communication channels. This approach enhances security by reducing the risks associated with password-based authentication, such as password theft or phishing attacks.

This approach provides a seamless and user-friendly authentication experience while maintaining a high level of security

Substack login

Substack also uses this approach for its users' logins.

If the login is successful, a session token is generated. It is configured as a Set-Cookie, so each time the client contacts the server, the token is automatically sent, ensuring correct identification. This approach is stateful, meaning that a state is managed on the database side.

How do I know this information?

I made a system that allows email sequences to be sent in Substack, to make it I used the internals calls that the client makes to the backend, to make them work I reverse engineered the platform to understand how the communication happens. I documented everything in this episode:

JSON Web Tokens simplify this mechanism. Firstly, the protocol is stateless, which means the token contains all necessary information for verification such as issuer, expiration, and authenticity. It also allows for a payload (claim) to store useful information like user ID or email. This payload mustn't contain sensitive information since the claim is often sent with only Base64 encoding; for sensitive data, encryption is recommended.

Are you curious about how JSON Web Tokens work and the encryption methods that can be used? Sign up, I'll share a post with you in the upcoming weeks!

Subscribe to Implementing 💻

❓ How it works

We can use this sequence diagram to explain how magic link authentication works:

1. User starts the registration process by entering their email address

Read more

As a software engineer, I created this newsletter to share my first-hand knowledge of the development world. Each topic we will explore will provide valuable insights, with the goal of inspiring and helping all of you on your journey.

In this episode, I'll show you how to set up an email sending system using Node.js with a Gmail account.

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/mailer

Subscribe to Implementing 💻

👋 Introduction

One of the first projects I did was to create a simple script for sending e-mails. I was excited about the idea of sending messages for free, just like most websites do.

Email is a straightforward and effective system. All you need is an address to send a message.

We will refer to Gmail, but the same applies to other email providers. If you are interested in how to do the setup, let me know in the comments.

Leave a comment

Alternatives

Another simple notification system, besides e-mail, could be the use of a Telegram group where a Bot sends messages to the channel via Webhook.

A downside is that, unlike e-mail, it requires an initial set-up where users have to be added to the group.

I show how to create Telegram bots and set up webhooks in this post:

Subscribe to Implementing 💻

⚙️ Configure Gmail account

To use your Gmail account for sending emails, you'll first need to create a new “app” within your account settings. Here are the steps to follow:

• enable 2FA

Go to the Security panel of your Google account via this link https://myaccount.google.com/u/2/security and activate the two-step verification, it is a necessary step to proceed with the creation of the app.

• create new app

from this link https://myaccount.google.com/apppasswords proceed to create the app, all you have to do is choose a name. A password will be generated, which you will use to send emails with the nodemailer library.

I found this information on stackoverflow, it saved me from wasting hours trying to configure it myself. 🙏

Subscribe to Implementing 💻

👨‍💻 Let’s get down to practice

You can download all the code shown directly from my Github repository: https://github.com/marcomoauro/mailer

Nodemailer

For sending e-mails, I relied on the nodemailer library, which is the default solution for most Node.js users.

Implementation

For the implementation I used my template in Node.js, you can find it here:

Set up the environment variables by specifying in the .env file the email and password previously generated

MAILER_USER=<YOUR-GOOGLE-MAIL>
MAILER_PASSWORD=<APP-PASSWORD>

We create the file mailer.js, it takes care of exposing the primitives of the nodemailer library to enable the correct sending of e-mails:

import nodemailer from 'nodemailer';
import log from "../log.js";

import {strict as assert} from 'assert';

assert(process.env.MAILER_USER, 'MAILER_USER env is required, define it in .env file')
assert(process.env.MAILER_PASSWORD, 'MAILER_PASSWORD env is required, define it in .env file')

const transporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: process.env.MAILER_USER,
    pass: process.env.MAILER_PASSWORD
  }
});

export const sendMailApi = async ({email, subject, body}) => {
  log.info('API::Mailer::sendMailApi', {email, subject, body});

  const response = await transporter.sendMail({
    from: process.env.MAILER_USER,
    to: email,
    subject,
    text: body,
  });

  return response;
}

we create the controller mailer.js which will be responsible for receiving parameters from the api and sending them to the service:

import log from "../log.js";
import {sendMailApi} from "../api/mailer.js";

export const sendMail = async ({email, subject, body}) => {
  log.info('Controller::Mailer::sendMail', {email, subject, body});

  await sendMailApi({email, subject, body});

  return {
    message: 'Mail sent'
  };
}

and finally create a new api in the router.js file:

import {sendMail} from "./controllers/mailer.js";

router.post('/send-mail', routeToFunction(sendMail));

How to test

You can verify the proper operation by starting the server with:

yarn serve:development

and making a call to the new endpoint with:

curl --location 'http://localhost/send-mail' \
--header 'Content-Type: application/json' \
--data-raw '{
  "email": "marcomoauro@hotmail.it",
  "subject": "Test Subject from Node.js Mailer",
  "body": "Example body for Implementing post"
}'

Deploy

Read more