---
title: "#124: A 33 Point API Security Checklist"
publication: "StatusCode Weekly"
issue: 124
published_at: "2017-07-12"
canonical_url: "https://weekly.statuscode.com/issues/124"
---

WebOps Weekly 124   . 

The latest Web operations, HTTP, and Web performance news -[Read this on the Web](https://webopsweekly.com/issues/124) 

[![WebOps Weekly\](https://webopsweekly.com/images/webops-header.png)](https://webopsweekly.com) Issue 124 — July 12, 2017     

[How Discord Scaled Elixir to 5 Million Concurrent Users](https://blog.discordapp.com/scaling-elixir-f9b8e1e7c29b?utm_source=webopsweekly&utm_medium=email) story Voice and text service Discord now handles five million concurrent users and millions of events per second. Stanislav Vishnevskiy [Improving Critical Infrastructure Rollouts](https://labs.spotify.com/2017/06/22/improving-critical-infrastructure-rollouts/?utm_source=webopsweekly&utm_medium=email) story How using Docker inspired Spotify to build a service, Tsunami, that lets them gradually roll out stack upgrades over the course of days or weeks. David Xia [Full Stack Fest 2017 - Barcelona, 4-8 Sept.](https://2017.fullstackfest.com) Are you a curious mind? Full Stack Fest is a week-long conference that peeks into the web of tomorrow. Serverless, Blockchain, WebVR, Distributed Web, Progressive Web Apps. Tickets available with a 10% discount using the code `WEBOPSWEEK` Full Stack Fest Barcelonasponsored[![\](https://copm.s3.amazonaws.com/8e8d11cb.jpg)](https://2017.fullstackfest.com) [Wildcard Certificates Coming to Let's Encrypt](https://letsencrypt.org//2017/07/06/wildcard-certificates-coming-jan-2018.html?utm_source=webopsweekly&utm_medium=email) news Don’t get _too_ excited just yet, however, as they’re not due until the start of 2018. Let's Encrypt [A 33 Step API Security Checklist](https://github.com/shieldfy/API-Security-Checklist?utm_source=webopsweekly&utm_medium=email#readme) code A simple checklist of 33 (so far) security considerations when deploying a Web-facing API. Shieldfy [Is Ruby Too Slow For Web-Scale?](https://www.speedshop.co/2017/07/11/is-ruby-too-slow-for-web-scale.html?utm_source=webopsweekly&utm_medium=email) opinion A detailed look at the fallacy of benchmarks and what really matters when it comes to creating webapps. Nate Berkopec [Netlify's Recent DDoS Attack and What's in a (C)NAME?](https://www.netlify.com/blog/2016/01/12/this-weekends-ddos-attack-and-whats-in-a-cname/?utm_source=webopsweekly&utm_medium=email) story Your DNS setup can have a great effect on performance and resilience against DDoS attacks. Matt Biilmann Jobs [Site Reliability Engineer (London, UK)](https://jobs.lever.co/yelp/5fb956a7-4777-48d2-bc5e-ef49b5a2e300/apply?lever-source=WebOpsWeekly) Work in the dev and systems world, tackling [interesting challenges](https://engineeringblog.yelp.com/2017/05/taking-zero-downtime-load-balancing-even-further.html). Yelp [Get Your Next Tech Job Faster. Get Hired on Hired.](https://hired.com/join/?utm_source=petercooperpress&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-swe%29%28q3-17-webops-weekly%29) Save time on your job search. Hired delivers multiple, high-quality job offers to you. Sign up today. Hired In brief [An NGINX Security Advisory (CVE-2017-7529)](http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html?utm_source=webopsweekly&utm_medium=email) news A potential overflow condition can occur with a specially crafted request on versions 0.5.6 through 1.13.2. NGINX [GitHub Now Using Kubernetes in All Non-API Web Requests](https://twitter.com/AaronBBrown777/status/884920896422633474?utm_source=webopsweekly&utm_medium=email) news Aaron Brown on Twitter [DigitalOcean Introduces 'High CPU' Droplets](https://blog.digitalocean.com/introducing-high-cpu-droplets/?utm_source=webopsweekly&utm_medium=email) news DigitalOcean [How to Defend Your Site with ZIP Bombs](https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html?utm_source=webopsweekly&utm_medium=email) tutorial Not sure how useful this is but the idea is interesting. Christian Haschek [Creating A Form Forwarding Service for AWS Lambda](https://medium.com/@danielireson/creating-a-form-forwarding-service-for-aws-lambda-aec07af9f951?utm_source=webopsweekly&utm_medium=email) tutorial A service, created with JavaScript, that makes setting up email form forwarding easy. Daniel Ireson [Using Heroku's 'Expensive Query' Dashboard to Speed Up an App](https://blog.heroku.com/expensive-query-speed-up-app?utm_source=webopsweekly&utm_medium=email) tutorial Richard Schneeman [How Ride Sharing Service 'Grab' Scaled Their Cache](http://engineering.grab.com/how-we-scaled-our-cache-and-got-a-good-nights-sleep?utm_source=webopsweekly&utm_medium=email) story Gao Chao [High-Reliability OCSP Stapling and Why It Matters](https://blog.cloudflare.com/high-reliability-ocsp-stapling/?utm_source=webopsweekly&utm_medium=email) story A deep dive into a new enhancement to Cloudflare’s HTTPS service. Cloudflare [Introducing BDDA: The Infrastructure Workflow Atlassian Use for Kubernetes](https://developer.atlassian.com/blog/2017/07/kubernetes-workflow/?utm_source=webopsweekly&utm_medium=email) story It stands for _Build-Diff-Deploy-Apply_. Atlassian Developers [Track Deployments With Codeship + OpsGenie](https://documentation.codeship.com/general/integrations/opsgenie/?utm_source=email-sponsorship&utm_medium=cpc-webops-weekly-secondary&utm_campaign=cooper-docs-opsgenie-campaign) tools The Codeship + OpsGenie integration lets you send alerts and notifications about critical events, like failed builds, to your on-call or development team. Codeshipsponsored [Life Will Get Harder for Sites Not Using HTTPS](https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/?utm_source=webopsweekly&utm_medium=email) opinion Increased numbers of warnings in browsers will make users think twice. Troy Hunt [Thoughts and Predictions for the Direction of Serverless Platforms](https://www.morethanseven.net/2017/06/26/predictions-for-the-direction-of-serverless-platforms/?utm_source=webopsweekly&utm_medium=email) opinion Gareth Rushgrove [Comparing Terraform and Spinnaker](http://blog.armory.io/comparing-terraform-and-spinnaker/?utm_source=webopsweekly&utm_medium=email) opinion Both tools for managing infrastructure. Colin Mo / Armory [RIP Systems Administrator, Welcome DevOps](https://www.informationweek.com/devops/rip-systems-administrator-welcome-devops/a/d-id/1329208?utm_source=webopsweekly&utm_medium=email) opinion Santosh Balan / Fujitsu America [Kubernetes's Days May Be Numbered As Open Source Changes](http://www.infoworld.com/article/3204597/open-source-tools/kubernetes-days-may-be-numbered-as-open-source-changes.html?utm_source=webopsweekly&utm_medium=email) opinion A controversial but intriguing opinion. Matt Asay [Catch Errors Before Your Users Do 🎣](https://rollbar.com/webopsweekly) tools Always know whats broken & why. Rollbar detects and alerts you when code breaks. Catch errors before users do. ROLLBARsponsored [binctr: Create Static, Unprivileged, 'Containers As Executable' Binaries](https://github.com/jessfraz/binctr?utm_source=webopsweekly&utm_medium=email) tools Jess Frazelle [Sapient: Application-Layer Cryptography for PHP 7+](https://github.com/paragonie/sapient?utm_source=webopsweekly&utm_medium=email) code Secures PHP apps’ server-to-server HTTP(S) traffic. Paragon Initiative Enterprises [Magma: A Fully Featured, Commercial-Grade Email Server](https://magmadaemon.org/?utm_source=webopsweekly&utm_medium=email) code An encrypted email system with support for SMTP, POP, IMAP, HTTP and MOLTEN. Lavabit LLC    [Read this issue on the Web](https://webopsweekly.com/issues/124) [See our archives](https://webopsweekly.com/issues) [Change your email address](*|UPDATE_PROFILE|*)  [Stop getting this newsletter](*|UNSUB|*)  

Published by [Cooperpress](https://cooperpress.com/)
Fairfield Enterprise Centre, Lincoln Way, Louth, LN11 0LS, UK