Simplicity is a form of art...

When I started looking into the architecture of Large Language Models (LLMs), I got confused when I encountered Retrieval Augmented Generation (RAG).

I once read a blurb about the benefits of bureaucracy, and how it is intended to resist political influences, autocratic leadership, priority-of-the-day decision-making, silo'ed views, and more things that we generally see as "Bad Things™️".

Core to the Digital Operational Resilience Act is the notion of a critical or important function.

One of the topics that most financial institutions are (still) currently working on, is their compliance with a European legislation called DORA.

IT architects generally use architecture-specific languages or modeling techniques to document their thoughts and designs.

For one of the projects I'm currently involved in, we want to have a better view on sustainability within IT and see what we (IT) can contribute in light of the sustainability strategy of the company.

The IT world is littered with frameworks, best practices, reference architectures and more.

At work, as with many other companies, we're actively investing in new platforms, including container platforms and public cloud.

One of the main IT processes that a company should strive to have in place is a decent IT asset management system.

This time a much shorter post, as I've been asked to share this information recently and found that it, by itself, is already useful enough to publish.

In a perfect world, using infrastructure or technology services would be seamless, without impact, without risks.

No, not Diphtheria, Tetanus, and Pertussis (vaccine), but Development, Test, Acceptance, and Production (DTAP): different environments that, together with a well-working release management process, provide a way to get higher quality and reduced risks in…

Nowadays it is impossible to ignore, or even prevent open source from being active within the enterprise world.

I am not an advocate for hybrid cloud architectures.

Transparent encryption is relatively easy to implement, but without understanding what it actually means or why you are implementing it, you will probably make the assumption that this will prevent the data from being accessed by unauthorized users.

Security vendors are touting the benefits of "zero trust" as the new way to approach security and security-conscious architecturing.

Not that long ago, a vulnerability was found in Microsoft Azure Cosmos DB, a NoSQL SaaS database within the Microsoft Azure cloud.

Naming conventions.

In this last post on the infrastructure domain, I cover the fifth and final viewpoint that is important for an infrastructure domain representation, and that is the location view.

In my previous post, I started with the five different views that would support a good view of what infrastructure would be.

IT architects try to use views and viewpoints to convey the target architecture to the various stakeholders.

The public cloud is a different beast than an on-premise environment, and that also reflects itself on how we (should) look at the processes that are actively steering infrastructure designs and architecture.

In my job as domain architect for "infrastructure", I often come across stakeholders that have no common understanding of what infrastructure means in an enterprise architecture.

As I mentioned in An IT services overview I try to keep track of the architecture and designs of the IT services and solutions in a way that I feel helps me keep in touch with all the various services and solutions out there.

TOSCA is an OASIS open standard, and is an abbreviation for Topology and Orchestration Specification for Cloud Applications.

Software as a Service (SaaS) solutions are often a quick way to get new capabilities into an organization’s portfolio.

My current role within the company I work for is “domain architect”, part of the enterprise architects teams.

At my workplace, I jokingly refer to the three extra layers on top of the OSI network model as a way to describe the difficulties of discussions or cases.

When an organization has an extensively large, and heterogeneous infrastructure, infrastructure architects will attempt to make itless complex and chaotic by introducing and maintaining a certain degree of standardization.

As I mentioned previously, recently my latest installment of "SELinux System Administration" has been released by Packt Publishing.

IT is complex.

After a long hiatus, I'm ready to take up blogging again on my public blog.

Thanks to updates from Vignesh Jayaraman, Anton Hillebrand and Rolf Eike Beer, a new release of cvechecker is now made available.

With the configuration baseline for a technical service being described fully (see the first, second and third post in this series), it is time to consider the validation of the settings in an automated manner.

In the first post I talked about why configuration documentation is important.

A good configuration baseline has a readable structure that allows all stakeholders to quickly see if the baseline is complete, as well as find a particular setting regardless of the technology.

IT teams are continuously under pressure to set up and maintain infrastructure services quickly, efficiently and securely.

One of the features present in the August release of the SELinux user space is its support for ioctl xperm rules in modular policies.

A few days ago, Jason "perfinion" Zaman stabilized the 2.7 SELinux userspace on Gentoo.

In order to further secure access to my workstation, after the switch to Gentoo sources, I now enabled two-factor authentication through my Yubico U2F USB device.

Yesterday I've switched to the gentoo-sources kernel package on Gentoo Linux.

You've might already read it on the Gentoo news site, the Hardened Linux kernel sources are removed from the tree due to the grsecurity change where the grsecurity Linux kernel patches are no longer provided for free.

This is a long read, skip to “Prioritizing the projects and changes” for the approach details...

Many organizations struggle with the all-time increase in IP address allocation and the accompanying need for segmentation.

Today I was attempting to update a local repository, when SSH complained about a changed fingerprint, something like the following: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

I have been a long time user of Cyanogenmod, which discontinued its services end of 2016.

A new release is now available for the cvechecker application.

I recently created a new article on the Gentoo Wiki titled Certificates which talks about how to handle certificate stores on Gentoo Linux.

After a long time of getting too little attention from me, I decided to make a new cvechecker release.

I sadly had to miss out on the FOSDEM event.