May 2021 Summaries

Content Security Policies (CSPs) help prevent cross-site scripting and clickjacking attacks by approving specific content types, which are then enforced to prevent unauthorized access. A CSP defines trusted content sources and allows browsers to submit error reports when violations occur, which can be integrated into monitoring dashboards for better visibility. The policy has two modes: enforcing and actively blocking resource loading and execution, or collecting errors in a "report-only" mode that provides real-time insights without disrupting customers. Implementing a CSP requires careful consideration of directives and their order to ensure broad coverage and resilience against attacks.

At Sentry, they've shifted their focus from fully-distributed remote work to an ethos of flexibility, allowing employees to collaborate in-office three days a week and work remotely the other two; providing flexible working hours and empowering team leaders to figure out the best collaboration model for their teams. They believe that investing in flexible solutions while maintaining office hub benefits is key to long-term sustainability. The company prioritizes creating spaces that cater to different work styles, needs, and boundaries between work and home life, aiming to foster environments where employees can do their best work and live their best lives. By maintaining an office-first culture, they aim to make deep human connections, which are valuable in-person interactions that encourage intentional and thoughtful communication.

This is how no-code AWS Lambda monitoring was developed as a result of addressing the tedious process of manual code instrumentation, using Amazon CloudWatch and Sentry through an automated instrumentation approach with AWS CloudFormation stack and Kinesis Data Firehose. The initial prototype had limitations such as not grouping logs into issues or displaying stack traces like Sentry. Instead, it utilized AWS Lambda Extensions to instrument functions, allowing real-time tracing, formatted stack traces, in-context environment variables, and customizable sample rates. Although there were minor downsides like requiring a specific SDK for every programming language, the outcome was a user-friendly UI that enabled easy auto-instrumentation of AWS Lambda functions with benefits such as increased developer adoption and recognition from AWS.

The consequences of poor application performance can be severe, including lost customers, team trust issues, and developer confidence problems. To mitigate these risks, developers often rely on application monitoring tools like Sentry, which helps them identify and fix errors more efficiently. By using Sentry's features such as error grouping and merging, prioritization by user impact and frequency, and automated release planning, developers can improve their application's performance and reduce the time spent on resolving issues. For example, Eventbrite used Sentry to create a list of prioritized errors, while Cloudflare set up an automated release plan to streamline its deployment process. Similarly, Volley improved its Apdex score and reduced launch times by optimizing its codebase with Sentry's performance monitoring features. By adopting Sentry, developers can gain complete visibility into their application's performance, identify issues quickly, and resolve them more efficiently.

In the modern era of web development, measuring success is no longer about clever metrics like WTFs per minute, but rather about objective data that communicates code quality and stability. For Measurement May, Sentry is building features to deliver the right metrics, allowing organizations to drive outcomes. The platform now offers custom dashboards with prebuilt widgets, as well as a query builder called Discover, which enables users to build their own visualizations. Project Details provides a unified monitoring experience across all aspects of a project, while Org Stats offers insights into codebase resource usage. These features aim to provide developers with the information they need to control spend, manage quotas, and create efficiencies.

The Android operating system uses dynamic loading to load native libraries from APKs, which are saved directly in memory instead of being extracted to disk. This approach saves disk space but presents challenges when trying to query the list of loaded libraries. The `/proc/X/maps` format provides a way to parse and process ELF files, which contain virtual address mappings for executables and libraries. To support loading libraries from APKs, developers must find alternative methods to obtain the list of loaded libraries, as querying the dynamic loader is not possible on older Android systems. A new approach involves tracking readable mappings, file offsets, and gaps in between them, and processing ELF headers to extract library information. This solution still has unanswered questions and potential issues, but it addresses a common problem faced by developers working with native Android libraries.

Google's Web Vitals will measure three key user experience metrics: Largest Contentful Paint (LCP), First Input Delay (FID), and Cumulative Layout Shift (CLS) to evaluate a page's loading, interactivity, and visual stability. With the upcoming Page Experience update, Google will consider these four metrics: Mobile Friendliness, Safe Browsing, HTTPS, and Non-Intrusive Interstitials. Web Vitals data can impact website rankings in search, but its aim is not to be strict but to raise the conversation around content created with user experience in mind. E-commerce services will benefit from increased Web Vitals and site performance due to their complexity and dependence on search. Sentry's Performance monitoring helps compare user metrics against Web Vitals thresholds, while Trace Navigator provides visibility of data across projects and identifies dependencies between traces. Optimizing for Web Vitals can distinguish a website from others and improve customer engagement.