Django 3.0 and ASGI: what actually changes inside the request
Django 3.0 runs under ASGI, yet views, middleware and the ORM stay synchronous. What the new asynchronous handler really enables, and what it defers to the DEP 0009 roadmap.
Read moreBlog
Articles on AI governance, cybersecurity and systems architecture.
2020
WireGuard lands in the Linux kernel with 5.6
On 29 March 2020 Linux 5.6 brings WireGuard into the mainline kernel: an encrypted tunnel of a few thousand lines, non-negotiable cryptography, and a Noise IKpsk2 handshake. What changes against IPsec and OpenVPN, and what still has to be built around it.
Read more
Mass telework and VPN concentrator security
When telework shifts from exception to rule in a matter of days, the VPN concentrator becomes the most exposed part of the infrastructure. Technical notes on patching, authentication and capacity, starting from CISA alert AA20-073A.
Read more
Paediatric short bowel syndrome: why the data is hard to model
Technical notes on applying machine learning to paediatric short bowel syndrome cohorts: the shape of longitudinal clinical data, target definition, and the constraint of small sample size.
Read more2019
Convolutional networks for skin-lesion classification
The state of convolutional networks for skin-lesion classification in mid-2019: where the public benchmarks hold, and where integration into a laboratory workflow remains the open problem.
Read more
FHIR R4 and the first Normative portion of the standard
FHIR Release 4 (4.0.0, December 2018) is the first version with Normative content: the REST API, XML/JSON formats, base datatypes and a few clinical resources leave Trial Use with a backward-compatibility commitment. A technical note on the boundary of the Normative set and what changes for those building clinical systems.
Read more
Jetson Nano: the datacentre CUDA stack on a 5-watt module
The Jetson Nano announced at GTC 2019 puts 128 Maxwell cores and CUDA 10 into a 99-dollar, 5-10 W device. The interesting part is the continuity of the stack between training on desktop GPUs and inference at the edge, not the price.
Read more
Falco: detecting anomalous behaviour in running containers
Falco reads the Linux kernel system-call stream and matches it against declarative rules to flag anomalous behaviour in running containers. Architecture, the new Kubernetes audit-event source in 0.13.0, and the limits of the model.
Read more
Loki: indexing log labels instead of content
At KubeCon Seattle (December 2018) Grafana Labs presented Loki, an alpha-stage log aggregator that indexes only the labels of each stream and keeps the compressed content on object storage. Notes on the Cortex-derived architecture and on the cost-versus-search trade-off.
Read more
Podman and daemonless Linux containers
Podman manages containers with a fork-exec model rather than a persistent daemon. Technical notes on the architecture, on rootless via user namespaces, and on current limits, at version 0.12.
Read more2018
nnU-Net: configuring the pipeline instead of changing the network
The nnU-Net preprint (arXiv 1809.10486) argues that, for medical image segmentation, a well-configured standard U-Net beats architectural variants. Notes on the data fingerprint, the three configurations and the provisional Medical Segmentation Decathlon results.
Read more
TLS 1.3 and the one-round-trip handshake
RFC 8446 cuts the TLS handshake to a single round-trip, makes forward secrecy mandatory and takes legacy cryptography out of the standard. Reading notes on what it means in practice for people running servers.
Read more
Machine learning on health data: what changes outside the lab
By 2018, models on clinical records and diagnostic images beat the published baselines, but the constraint that decides everything is the data: scarcity, quality, treatment regime, and GDPR.
Read more
GDPR Article 9 and the exemptions for health data
From 25 May 2018 processing health data starts from a prohibition and ten exhaustive derogations. The Article 9(2) derogation you invoke decides who reads the data, where it may travel, and when a clinical dataset must stay separate from a research one.
Read more
NestJS: Angular's decorators on the Node backend
NestJS, a Node.js framework in TypeScript with decorators, dependency injection and modules borrowed from Angular. What the 4.x line offers, and where the cost of the abstraction sits.
Read more
Automatic TLS certificates in Kubernetes with cert-manager
With cert-manager the TLS certificate lifecycle becomes a declarative cluster resource. Project status, the CRD model, and the ACME constraints as of February 2018.
Read more2017
Sigma: a detection rule written once
Sigma is a YAML format for detection rules that a compiler translates into the search syntax of whichever SIEM is in use. Technical notes on the format, the sigmac converter, and where it breaks down.
Read more
containerd joins the CNCF, CRI-O grows in the Kubernetes incubator
On 29 March 2017 the CNCF accepted containerd as an incubating project, while CRI-O matured in the Kubernetes incubator. Two answers to the Container Runtime Interface introduced in Kubernetes 1.5.
Read more
SNOMED CT, LOINC and ICD: three vocabularies for three different jobs
Controlled clinical terminologies are not interchangeable: SNOMED CT describes the clinical picture, LOINC names observations and reports, ICD classifies for statistics and reimbursement. Boundaries, licensing and Italian adoption as of 2017.
Read more
Grafana: metric storage and visualisation, kept apart
Grafana neither collects nor stores metrics: it queries external sources through data source plugins and draws dashboards. Technical notes on a decoupled architecture and on the Apache 2.0 licence.
Read more