November 2017 Summaries

Serverless functions are a great option for backend services, especially when used with mobile apps. Using Kotlin as the programming language can simplify development and improve security. A serverless function hosted on IBM's Cloud Function can be created by adding dependencies to a Gradle project, creating a new Kotlin file, and deploying it using bx wsk action create. Once deployed, the function can be invoked using a URL or through an Android application. By using a serverless function, developers can avoid scaling concerns and focus on writing logic-free code. The use of Twilio's SDK simplifies SMS message sending, and multiple functions under the same namespace make deployment and maintenance easier.

SendGrid offers an open-source set of transactional email templates called "Paste" to streamline the process for new users setting up accounts and sending emails via their API. These templates cater to common use cases such as password resets, email confirmations, welcome letters, receipts, and digests, and are designed to be easily customized to match a user's brand. Available on GitHub, the templates allow users to modify elements like logos, background colors, buttons, and typography, using HTML and inline styles. The templates incorporate feedback and contributions from the SendGrid community, particularly during Hacktoberfest, and are intended to expedite the setup process while ensuring compatibility across various email clients. Users are encouraged to experiment with the templates, provide feedback, and contribute to the open-source repository to improve and expand the template offerings.

A serverless and codeless way to try out Twilio's communications features is now available through TwiML Bins, a new visual tool in the Twilio Console. With TwiML Bins, users can quickly build and prototype with popular features like Cloud-based Voicemail or SMS masking and forwarding without writing any code. The process starts by choosing a suitable number from the Twilio Phone Numbers Console, then creating a new TwiML Bin to define the desired behavior for incoming messages or calls. Users can use pre-built templates and customize their TwiML Bins with minimal setup, making it easy to implement features like SMS Forwarding or Cloud Voicemail in under 20 minutes. The tool is designed to be user-friendly and allows developers to focus on building new applications without the need for server management or coding expertise.

In this article, Kelley Robinson introduces readers to Scala, a JVM language that combines Object-Oriented and Functional programming styles. The author sets up a basic Scala project using SBT (the Scala Build Tool) and the Twilio API to send text messages from the command line. They cover topics such as setting up dependencies, handling user input, and adding resiliency to error handling. The article concludes by encouraging readers to explore further with Scala's vast ecosystem, including its compatibility with the JVM, support for big data processing through Apache Spark, and various resources available for learning and practicing Scala.

Introducing Console Projects in the Twilio Console allows customers to create and manage multiple projects within a single account, providing better segmentation control, easier navigation, and access to specific information related to usage, bug reports, and billing. The new version of the Twilio Console features two key updates - Project Navigation Bar and Project Dashboard, designed to meet the changing needs of its diverse customer base, ranging from individual developers to large enterprises.

Our approach to tackling GDPR is centered around meeting our customers' expectations and raising the bar for data protection worldwide, as per Twilio CEO Jeff Lawson. We're taking a comprehensive approach to compliance by scoping tasks, providing resources such as a whitepaper, FAQ, video, and blogs, and inviting developers to join us for a talk to learn more about our approach. Our goal is to help teams navigate the journey to compliance and provide support through our resource library and developer community hub.

The European Union's Payment Services Directive 2 (PSD2) requires Strong Customer Authentication (SCA), which aims to ensure consumers can use new payment technologies safely. PSD2 introduces new rules, including direct access between merchants and customers' bank accounts, requiring stronger authentication methods like 2FA. Twilio is a leading communications platform as a service that delivers 2FA solutions that satisfy PSD2 rules and regulations, offering push authentication and customer notifications through APIs, making it easier for financial institutions to comply with the new requirements.

The Authy app is a two-factor authentication (2FA) tool that generates security codes without the need for them to be sent via SMS. While using SMS for 2FA has its vulnerabilities, such as phone porting attacks or SIM swapping, it's still more secure than having no 2FA protection at all. However, users can avoid these risks by downloading mobile 2FA apps like Authy or Google Authenticator that generate Time-based One-Time Passcodes (TOTP) directly within the app. The Authy app uses SMS during installation to verify the user's phone number but poses low security risk since typically, users don't have any accounts protected by Authy 2FA at this stage. To further secure their use of the Authy 2FA app, users can set a backup password, install Authy on more than one device, turn off the multi-device feature, and follow the 24-hour account recovery process if necessary. The Twilio API, which is embedded into an application's code, can also provide additional security measures to defend against SMS vulnerabilities.

The Authy API configuration has been moved to the Twilio Console, providing improved management and settings for Two-factor Authentication and Phone Verification APIs. The change leverages Twilio's systems, scale, and expertise to enhance deliverability, reliability, and user experience. Customers can now access new features such as improved user management, Authenticator SDK settings, and Verify insights within the console. While Authy.com remains a valuable resource for 2FA information and app downloads, the transition marks a significant improvement in Twilio's offerings, making it easier for customers to manage their account security products.

Dominik Kundel discusses enhancing the security of Express applications, a popular Node.js web server framework, by implementing best practices and using middleware such as Helmet and Express-CSP-Header. Express, while flexible and easy to use, doesn't automatically follow security best practices, but the addition of Helmet can significantly improve security by adding HTTP headers that protect against vulnerabilities. These headers include X-DNS-Prefetch-Control, X-Frame-Options, Strict-Transport-Security, X-Download-Options, X-Content-Type-Options, and X-XSS-Protection, each serving a specific security purpose like preventing MIME sniffing or cross-site scripting (XSS) attacks. Additionally, setting up a Content Security Policy (CSP) can further safeguard applications by controlling resource loading and blocking unwanted code execution. The article emphasizes the importance of staying vigilant about web security and provides resources for further learning, including securityheaders.io and the Open Web Applications Security Project (OWASP).

The Canadian government's CASL (Canada Anti-Spam Legislation) has led to a growing trend where wireless carriers are blocking SMS traffic from long codes, which can prevent users from signing up and logging into applications. This issue affects companies using SMS for two-factor authentication logins or phone verification, particularly in Canada, where short codes are preferred over long codes due to increased filtering of A2P traffic. To address this issue, Twilio offers APIs that are pre-configured to comply with carrier policies, including Authy and Verify, which can help avoid blocking and ensure smooth user experience for applications using SMS for 2-factor authentication or phone verification.

To receive and respond to text messages with Hanami and Twilio, developers need to install the necessary gems, create a new Hanami project, generate an app for webhooks, configure it to return XML responses, and write an action to handle incoming SMS messages. The action can be generated using a generator, but also requires writing code to bypass templates and views if desired. Once the action is in place, the application can be connected to a Twilio phone number using ngrok, and tests can be written to verify its functionality. Throughout this process, developers will learn about Hanami's architecture, its ability to accommodate different apps with varying configurations, and its flexibility in separating concerns and bypassing unnecessary objects.

Twilio is a platform that powers millions of conversations, and as a customer, you need to ensure GDPR-compliance to protect your data. The General Data Protection Regulation (GDPR) covers five major areas: Access control, Historical data - Deletion and Download, Encryption, Store and Process, and Audit and logging. To manage these requirements, Twilio customers need to restrict access to personal data, track interactions with EU residents, obtain consent or "other lawful basis" for storing and processing phone numbers and other personal data, use encryption, store and process data securely, and log all access to personal data. Twilio is providing resources and features to help customers comply with GDPR, such as the Data Processing Addendum (DPA), Access Tokens, Message Vault, and Monitor Event Log. As a customer, you need to work on your legal framework, implement these measures, and be prepared for the future by knowing what data you've sent to each customer and being able to delete or fetch it upon request.

A recent security report revealed that some Android and iOS mobile apps contain hard-coded Twilio credentials, potentially exposing associated account data to unauthorized parties. The issue is not with the Twilio platform itself, but rather a mistake made by developers who didn't follow best practices for securing API keys. Fortunately, if developers have taken steps to secure their APIs, their accounts are safe from this risk. Twilio offers resources and support to help developers re-architect their apps, check for suspicious activity, and rotate their API keys to mitigate the issue.

Today, we're excited to announce bulk updates for Programmable Wireless SIMs in the Console, a much-requested feature by customers to simplify provisioning of logically grouped devices. Previously, making changes required writing scripts using our SIM Rest API. We've made it easier by adding UI features to the SIMs tab of the Console. To use bulk actions, order SIMs through Console, create a Rate Plan, select the SIMs to update, click Actions and choose new settings, then Apply Changes. This feature is part of Twilio's IoT connectivity platform and allows users to easily manage their fleet with best practices.

To build a simple chat app using JavaScript, Node.js and Twilio, start by creating a Twilio Chat Service in the console, setting up an API key and secret, and cloning a GitHub repository that provides a starter codebase. The backend code is written in server.js, which uses the Twilio library to generate an access token for users based on their identity. This token is used by the Twilio client SDK to interact with the Chat Service. Meanwhile, the frontend code references scripts and styles from the Twilio Chat client SDK, including a micro-template for chat messages.

Twilio engineers improved their core services' availability by implementing Chaos Engineering and Ratequeue HA, which eliminated the need for human intervention in common faults involving their queueing-and-rate-limiting system. The team designed a custom solution leveraging existing Twilio services to automate failover, detecting primary host failure, promoting a replica, and ensuring data integrity. They also implemented Ratequeue Chaos, a tool that simulates failures, monitors recovery, and validates the effectiveness of their automated failover system. This approach increased system resilience and availability, with the complete automated failover completing in under a minute after detection.

You are Plushcap, a helpful and succinct AI assistant with knowledge of software development and developer marketing.

Here's a neutral and interesting summary of the text in one paragraph: The article discusses how the SOLID principles (Single Responsibility Principle, Open-Closed Principle, Liskov Substitution Principle, Interface Segregation Principle, and Dependency Inversion Principle) can be applied to software development. The author uses an example of building a Slack integration that sends a random Magic: The Gathering card as an image response. They demonstrate how each principle is implemented in the code, including dependency injection using Spring Boot's constructor injection feature. The article also covers the challenges of deploying and setting up the app on Heroku, Slack, and Twilio, highlighting the importance of following SOLID principles in software development to make the code more maintainable and extendable.

GDPR emphasizes "Data Protection Privacy By Design and Default," which shares similarities with the security development lifecycle (SDL) concept of "Secure By Design, By Default and In Deploy." While GDPR requires "privacy by design" explicitly, it does not use the term "secure by design." To effectively implement both privacy and security by design, organizations can start with threat modeling to identify potential vulnerabilities and then conduct a privacy impact assessment (PIA) to understand how data is being used and recommend mitigations. Integrating these two approaches holistically can help anticipate future threats and ensure compliance with GDPR regulations.

This summary provides an overview of building an SMS-equipped Twilio Weather Station using an ESP8266, Amazon AWS IoT, and Lambda. The system consists of a weather station that sends reports over SMS with Twilio and receives incoming messages to update settings. The architecture includes API Gateway, Lambda functions for handling incoming messages, and AWS IoT for persisting device state. The code is written in C++ and uses various libraries such as Arduino, WebSockets, and MQTT. The system can be controlled through an SMS message or by modifying the device shadow state directly. Additionally, there are three avenues to change settings on the station: through the shadow state directly, via an SMS from the master cell phone, or by publishing to the update topic. The system also includes remote monitoring capabilities, allowing users to customize and extend the application with various add-ons.

The company Twilio has announced that their Elastic SIP Trunking now supports Caller ID Name (CNAM) Lookup, a feature that allows businesses to identify callers and make informed decisions about which calls to answer. This feature is part of the existing Calls REST API and can be enabled by navigating to the Twilio Console page and selecting the Origination page. With CNAM Lookup, businesses can retrieve caller information on an in-progress call and use it to surface relevant customer data from their system of record.