Samsul Hoque Choudhury

Samsula Chaudhry. I have done my graduation and post-graduation in computer science. And after that, I did teaching for almost 2 years in a college where I should teach graduate and post-graduate students. After that, I came to Bangalore. I look at it here, and then I started working with a start-up, which I do real estate. And I got my initial days of training into web development, testing, AWS infrastructure, and all those necessary elements that are required for development. So I worked there for 1 year. The company got closed, unfortunately, and then I moved to a consultancy where I was working on product as well as projects. And then I had the opportunity to work on different kinds of projects, which helped me gain more technical skills to learn about different technologies, like.NET and all. I was working with PHP, then I also learned.NET. And then towards the end, I started learning Node.js using Express. So that was a thing. And then I started working with Microsoft. And since 2017, I've been working at Microsoft. And since then, I've been working remotely. After that, whatever companies I've joined, I've been working remotely with them. So I used to collaborate with teams who are based out of the United States or the UK, and they're in different places. So I used to collaborate with them. Initially, I used to work in their time zone. And then later on, I started working in my time zone so they could collaborate better. But during all this process, I also learned a couple of more technologies using Python and all. So gradually, I started focusing my shift towards back-end mostly because I want to expand my knowledge and my expertise more towards back-end than front-end. But it doesn't mean that I'm not interested in front-end or working with them. I'm familiar with Angular. Last time I worked with Angular 6, and then I worked with Vue. And then recently, I've worked with React. Just 6 months back, I worked on React. I've used MySQL, MSSQL, MongoDB with my current project. I'm working with AWS DynamoDB as well and PostgreSQL. Apart from that, I have experience in microservices architecture, in serverless architecture as well. I've participated in different kinds of client interactions also along with designing the application from scratch. That also experience I have, especially with SaaS products. So with my previous experience with my previous employer, I've built a whole SaaS product along with 7 different engineers from scratch. The whole architecture was laid out, and there were a couple of iterations to evolve the whole thing. And then we built the whole thing with.NET and then a couple of modules in Python as well. Right now, my main motivation is to be with a company where I can stay for a very long time, be a part of the team where I can be for a very long time, and grow with them personally as well as professionally. So that's the main motivation behind it. Apart from that, I have an interest in learning new things, and I'm learning AI, ML, and blockchain. So that will also add more skill sets to my profile, and I may help in a better way, proposing better solutions in the future. Thank you.

I have not exactly worked on the Genkis' automation process, but one thing I can tell you is that if there's any kind of project, whether it's in TypeScript, Python, or.NET, it doesn't matter. First of all, we have to create a Docker container, which will encapsulate the whole project and all its dependencies. So we will create a Docker image. We'll create a Docker image, and that will encapsulate the whole project, including its dependencies, into one single place. And then we will create all the dependencies, like databases and internal networking and other stuff, volumes and all, into that Docker Compose file. And once these changes are deployed into CICD, we can create a CICD pipeline, which would pull the latest changes, implement this Docker container, run the tests, and validate everything. Once it's validated, then we are going to publish it using Jenkins to the respective servers. Jenkins can help act as a mediator to see what has changed, if any actions have been triggered or not. So Jenkins takes care of all these things. So, basically, I rely on the CICD workflow pipelines, and Jenkins acts as a mediator or orchestrates to take all these charges and make metrics. I can do things manually on the Jenkins application, but I don't remember exactly how to automate that using a step or something like that. Thank you.

So there are a couple of dimensions that need to be covered when you're talking about security, any restful APIs, not only about Proteus. First of all, we have to understand that any restful API is going to access some kind of resource in the back end. It could be data files or it could be talking to any cloud resources over there. So we had to be very specific about what that particular API is meant for and what versioning we are going to follow so that in future, we can implement all the security measures for all the different versions over there. Apart from that, we have to make sure it should be always communicated over any kind of secure layer like SSL and all. So that gives more security if you are communicating with the restful APIs or HTTPS rather than HTTP. For development purposes, fine. But for manual production, HTTPS is the core thing that you should be doing first. And then there should be authentication and authorization. The authentication can be done in any way. You can use both. You will go for JWT authentication. There are numerous ways that can be done over there. And then we can have that put in over there into some API gateway or double load balances where you can implement that one. Then we can add the authorization process based on the role-based access, whether the particular call is being made or not. And then we can also implement some rate limiting and rate throttling as well. Otherwise, there'll be bottleneck. There'll be charts of videos over there. So we should avoid that by implementing the rate limiting or rate throttling. So that also gives them more added security over there. And whatever data we are fetching, we should not be open to returning every data. We should be very specific to what access we are giving to the resource we are accessing, or what intent, and what are the different filters, and what kind of data we are trying to fetch from there. So all these things make the data as well as the restful API more secure, that we are not exposing anything unnecessary to the outside world. And, also, we need to implement the cost policy, because it's also very important. If you know very particularly that this particular API is going to be accessed from certain domain, then we should be incorporating that into our cost policy in the back end. And anything that is not done from that identified resource from the front end or any other source, that should not be entertained. So these are a couple of things that we can do to make sure that the APIs are very secure and they are working smoothly whenever we are trying to interact with them from any either mobile application or from the front end application. Thank you.

When you're talking about sessions, there are different things we can do. One is we can use cookies. Cookies can be stored over there. Cookies can tell us about what the sessions are all about. Then we can use JWT. In JWT, when we're implementing, we can have refresh tokens. Apart from access tokens, we can have refresh tokens. So access tokens allow you to access that resource at that particular API, with certain limitations between which you can access that particular resource. So refresh tokens are also used by the front end to see whether the session can be there or not. And if that particular timeline is over, it again costs a new fresh access token, and the back end will renew that whole access token once again for the next interval of time. And this different token is stored in the database in the back end, or you can store it in Redis or any other caching mechanism also to make it much faster. Based on that whole behavior, we can store if since we are storing it somewhere, we always have the option to kick out that session from that particular storage either from Redis or database, whatever is your preference. And that really helps us. But the main thing is there are certain constraints out there which we need to always keep in mind. Since we are storing it somewhere either in Redis, it's much faster. But again, if there is one Redis instance where every session is being stored, then that becomes a bottleneck. And if there are multiple instances, then that improves the whole performance. But then there is some kind of turnaround time, which becomes very slow, which may reduce it to certain microseconds. That would be a difficult issue. So it depends on what is the size of the project and what kind of interaction we're talking about, how much traffic will get, and how frequently the sessions will be in change, how will they be managed, how long they will persist. All these are various factors that are used to keep in mind while designing the sessions for a particular application. In my previous project, as well as my recent project, we are using a single instance which keeps track of all the sessions, all the JWT sessions over there. So we have a key-value pair. The key is basically the refresh token, and the value is the access token. So and we have this in such a way that whenever there is a refresh token that gets expired, it again goes back to the back end. It requests this process, which updates the refresh token and access token and sends back the access token and updates the cache also. And next time onwards, you keep checking from the cache rather than coming to the back end. Thank you.

Okay, so this is a very, you know, the name is hotfixes. Well, the issue is also with hotfix. So, basically, we create individual tasks for each of the features as well as, you know, for the bugs and fixes that we are doing over there. So, ideally, the practice that I follow is to have the fee to first mention the environment, in-depth UAT or production, then hyphen and then the ticket number over there, and then hyphen, and then I give a description for that one. So that helps us to, you know, do the things parallelly as well as since there are different tickets allotted to different issues. Even if there's a parallel feature going on, that will have a separate ticket for that one in Jira. And then for the hotfix also, this over there. So, whenever it's a hotfix over there, it's in a rich production environment, and we mark it and also mentioned that in the tag and also in Git when we create a pull request, there are certain labels over there, which give us the priority. So, whoever is the reviewer of that branch, he will know based on the level that this is on high priority. And based on that, they will review. Even I do the code review. Sometimes I do peer review as well. So, based on the level, I check first what's the priority. If it's a high priority, and that goes into the review first. If it's a normal priority or if it's a low priority, then I take it accordingly. So, usually, that's the whole structure: the environment name, the ticket name, and the branch name. If there's a hot fix, then that is marked towards the end with the capitalized saying that it's a fix or a bug or a hot fix over there. Thank you.

Okay. So when we're talking about tight deadlines, we have to first be very sure that what a tight deadline means, whether it's a day or hours over there. Sometimes it's days. So, basically, what we do is practice test-driven development. So, what happens with test-driven development is that related to the feature or the bug that we're fixing, I write the test first. So that covers the main aspect of the whole feature over there. Then, based on what changes I made, what refactoring I did, whatever the new methods I might have created, I add a few more tests. Those are secondary testing elements over there. I know that reduces the coverage of the code if it goes into production without those tests, but I think that can always be improvised. However, the tests written in the context of the feature are non-negotiable. So, that's why I write the test first in test-driven development. And then I write the feature according to the tests that I have written. Since my tests cover all the aspects of the scenarios of the requirement, there's no loophole, and there's no mistake over there. That also gives me an advantage, even though the deadline isn't near, then I'm not missing on the crucial aspects of that whole development, that the feature and its functionalities and their respective tests are already there. The refactoring, after the refactoring, I might have created a few more functions. And if that misses out in order to meet my deadline, that's absolutely okay because I feel that can be taken up in the next release or the next cycle as well. I can make a note of it, and I can do it later, but that's not going to be a very important one in terms of the feature that I'm developing. Always the priorities related to the feature functionality and its testing over there are met in the first place. So, there's nothing like that can go wrong in that one. And definitely, code coverage is always there. So, I keep on checking my code coverage every 15 days to make sure that it is somewhere around 75 to 78, 80%, depending on what the standard that the whole team is following. My personal standard is that it should always be 80% or less. If it goes beyond that one, that is something that we have already missed, and that needs to be addressed in the retrospective meeting. Thank you.

It clearly shows that we are first fetching all the users, and then we are trying to find in that collection. So instead of doing that, we can do something like find by ID and pass the specific ID to return that exact data that you're looking for instead of searching the whole dataset once again. What has been written. So, first of all, the line where we are doing await user dot find is giving us all the data. I don't know how many calls will be there, 100,000, 10000. And record all the reports. So let's start from the database. And then once it's there, then we are like trying to go find method over there, which will again iterate to all the list over in the dataset that has been returned in the previous line. So these two will become the bottleneck. So the best way is to index is to create an index to the ID field. If it's not there, then they should be created. And since it is created over there, if it's already there, then if you're doing the find by ID and we pass the ID over there, then if you return that specific record that we are in you know, having that we're interested in, basically. And definitely, it is the whole turnaround time as well as this bottleneck will also go away.

So what can you see over here? Like, you know, this will capture just a general exception. If something goes wrong by touching the resource, then that will catch the whole thing. But we are not checking what the response code is from that particular API, which is very much important. We should always console or we should always return data if the status code is acceptable. It was 200, 201, 202, whatever it is, we decide at the time of designing the API contract or how the whole functionality is going to be. And then if there's something else, like 400 and then, 500, could be anything. Anything other than 200 should give a proper error message. And then if you want to handle it in such a way that it should always go to the catch part, then if you encounter a status code other than 200, you can always throw that and the catch will receive it over there. So, yeah, I think that should handle everything over there. And, yeah, I think they should be.

Now I'm not very sure about cloud native Node JS application. I've never handled that kind of thing, but just trying to understand the whole problem is that there are hundreds of failure scenarios. So this comes to when we are talking about how we design the whole system over there. So if I take it from that perspective, not taking it in terms of specific cloud printing, just an application. I'm just giving you a rough idea based on my understanding: all the failure scenarios are already listed when we design the whole system so that we know how to deal with them. Maybe that's a failure with data consistency. Maybe it's a failure of data availability. We can create replicas. We can create multiple instances. We can scale them all the time. So that's already in place. In terms of unpredictable failure scenarios, we're talking about availability. We should always make sure that there are more than one instances running of whatever application we're talking about. If it's going to be only a single instance, then whenever there's a high network traffic or high load, that prediction may not address that one. So there's one more thing that can happen. We can always scale horizontally. At least have at least three instances when there's a scenario. There's a possibility that our applications will be hosted in such an environment and we're exposing it to high traffic. So in that case, we can be ready, be cautious about the whole scenario, and have a few more resources already running. And that can be done by Kubernetes and load balancer with AWS and all those. So I think these are the general measures that can be used for handling general scenarios. Apart from that, all the predictable scenarios mean we are already aware of the exceptions and other errors that might happen, and that can break the solution and take it down. So that should be done in a very graceful way. I'm not saying they should take it down in a graceful way. I'm saying that they should handle the errors and exceptions gracefully rather than exiting the whole application. So that should never happen. In terms of predictable and unpredictable scenarios, something goes wrong, so there should be one more instance that's running, and that should always make sure that the application is available. Now in both scenarios, one of the key aspects is that we should have logs. Without logs, we cannot tell what went wrong. Even if we have already listed every scenario and error and everything, and even if it fails, logs are the go-to place where we can go and check what went wrong and how we can mitigate that immediately. So that can be done in many ways. There are different levels of logging and different types of logging. So that's up to how we design the system and what kind of measures we are taking to ensure this logging is happening without failure. So, yeah, that's how I would like to handle this whole problem scenario.

So when you're talking about middleware, we are trying to basically delegate a couple of redundant tasks or some things that are done by other processes separately. And once that is done correctly, we are actually trying to give access to the back-end resource to any particular API and the microservice. So, basically, what middleware can really help us is part of authentication, authorization, which I've already explained in previous questions. So all the middleware stuff, authentication, authorization, security, caching can go into the middleware level where the general things and the redundant things can be handled. That does not have to be very specific to any particular service or any particular resource in the back end. So these are general elements that have to happen at every interaction. So that's why we always keep implementing one or two in the middleware and all the error handling, all the different scenarios, like what one or two will respond from over there because we are trying to integrate a couple of other third-party elements over there. Like, it could be Google. It could be LinkedIn. It could be Facebook. It could be anything. So they have their own signature. They have their own request-response cycle over there. They have their own status code. They have their own response methods. The response structure, not method, they have their own response structure over there. So based on the integration that we're doing, we can do all these things into middleware. That also ensures that tomorrow if you're able to change anything or you want to introduce or remove anything, that will be done in that one single place rather than going into all other services or microservices or whatever back-end resources we have to or whatever servers we are running in the back end. So they will remain unaffected, and all the security-level things are being handled in the middleware. So the changes pertaining to that will always remain at one place. So one change, one place, and that reduces the complexity of being in the middleware. And that also ensures that whatever changes are being done are being followed by all other services, they are following the same thing that will go through that part. Thank you.

How do you see the security server? Payment system integrations. I have no practical knowledge of payment system integrations over there. I have done integrations with ERP APIs, specifically SAP APIs. So I can tell you in terms of that. I'm not sure how much that is applicable in terms of payment integration because payments are a totally different domain. But based on my experience with integrating with SAP APIs, the thing is that we have to first understand the documentation, go through that and see what the request and response architecture is, what contracts they have given, what are the limitations they have given in terms of request patterns and the response structure over there. And based on that, we can define our own APIs, because we cannot go beyond the scope of their API design that they have given. Whatever they're exposing will keep us within that boundary only. So based on the documentation and understanding and what they have designed already and what was in place, we can write our own APIs according to that. We can have our own level of security, which is obviously very much feasible. But then you have to also adhere to and comply with the security measures that the third party has given. I believe these are common lendees that we can follow in terms of any third-party integration, be it payment, be it SAP, or be it some other application. I think that also applies here as well. Now, payment integration can have a few more things because there are moderate transactions involved and a couple of very fast transactions involved over there. So that can go to different levels over there. So again, you have to check the whole application, how it works. Based on that, I can go through that and maybe in the near future, I can give you a better answer for this one. Thank you.