KHOI | Blog

How to create swap file to deploy NextJS and Docker app on Ubuntu VPS

Khoi Nguyen — Sun, 22 Dec 2024 00:00:00 +0000

What is a swap space

I ran into an issue where building a NextJS app on Docker would take forever. Then, I found out I could solve this by adding a swap space to my Ubuntu VPS.

So what is a swap space?

Swap space is a designated area on a hard drive (HDD or SSD) that acts as an extension of a computer’s physical RAM. When the RAM is full, the operating system moves inactive or less frequently used data from RAM to this swap space to free up memory for active tasks. This process is known as “swapping.”

How to create a swap space

To create a swap file on an Ubuntu Linux VPS for building a Docker and NextJS application, follow these steps:

Check existing swap space:
```
sudo swapon --show
```
If this command returns no output, you don’t have any swap space configured.
Create swap file
```
sudo fallocate -l 2G /swapfile
```
This creates a 2GB swap file (it worked in my case). Adjust the size as needed.
Set permissions
```
sudo chmod 600 /swapfile
```
This restricts access to root only, enhancing security.
Set up swap area
```
sudo mkswap /swapfile
```
This formats the file as swap space.
Activate swap
```
sudo swapon /swapfile
```
This enables the swap file.
Make swap permanent Edit /etc/fstab:
```
sudo nano /etc/fstab
```
Add this line:
```
/swapfile none swap sw 0 0
```
This ensures the swap file is mounted on reboot.
Verify swap:
```
sudo swapon --show
```
This should now display information about your new swap space.

After that, running my docker build script worked just fine!

Troubleshooting ENOSPC no space left on device — Docker

Khoi Nguyen — Thu, 01 Aug 2024 00:00:00 +0000

Recently ran into an issue where I deployed a NextJS app with Docker on my DigitalOcean Ubuntu VPS and it logged this out while building: ENOSPC no space left on device.

So I ran df -h to view how much space on my disk left. This is what I got:

Filesystem  ...     Use%   Mounted on
/dev/vda1   ...      100%   /

Fortunately, I found this Stackoverflow article, and realized that my Docker app had been creating containers and those became orphaned or unused. This is not so obvious, since running docker ps and docker image ls did not show these orphaned containers (or maybe my skill issue).

So to clean these up, all I had to do was running docker system prune --all and said Yes to the CLI prompt. Now, running df -h again showed me this:

Filesystem  ...     Use%   Mounted on
/dev/vda1   ...      59%   /

Then, I ran the command to rebuild and deploy the Docker app. Everything worked as usual!

Fixing NextJS 14 package issue

Khoi Nguyen — Fri, 19 Jul 2024 00:00:00 +0000

Recently upgraded a NextJS app to version 14.2.5 from version 14.2.4, and during the process, I ran npm update and got some stuff messed up, and the NextJS app was not running well, eg: logging in did not work.

This took me a while to solve so I figured to document it here, and to be honest I still did not know the root cause, but I guess it had something to do with package-lock.json. Here is how I fixed it.

I was on the dev branch with the troubling NextJS app. I git checkout to main (which was still on next@14.2.4) and noticed that if I ran npm ci then npm run dev, the app worked as expected.

Then, I copied main’s package.json and package-lock.json to a different folder, then I git checkout to dev, and pasted the 2 files to dev.

Next, I ran npm ci to do a clean install, then I ran npm rm next to uninstall next@14.2.4, and npm i next@latest to install next@14.2.5.

And, voila it worked again!

Tips for technical co-founder

Khoi Nguyen — Tue, 12 Mar 2024 00:00:00 +0000

My notes from from YC Tips for technical co-founder — Diana Hu.

Ideating

Build prototype ASAP in a matter of days.
Create 90/10 solution.
- Focusing on a minimal viable product (MVP) that covers 90% of the essential features while leaving out the remaining 10% for future iterations.
Choose tech for iteration speed.

The only tech choices that matter are the ones tied to your customer promises.

Prototype mistakes:

Over-building.
Not talking to users.
Not letting go of bad ideas.

Launched stage

Launch in a few weeks.

Quickly iterate with hard & soft data.

Make sure you have set up analytics before launch.
Pick something simple: Google Analytics, Mixpanel, Amplitude, etc.

Continuously launch.

Balancing building vs fixing.

Tech debt is fine. Balance it.

How the role evolves

Decide what engineering culture will look like.

Evolve into leading a small team of engineers.
First hires are likely friends.
Start to have communication overhead.
Your role is morphing
- 2-5 engineers: 70% time to code
- 5-10 engineers: coding <50%

Learning Go — Week 5

Khoi Nguyen — Sun, 03 Mar 2024 00:00:00 +0000

Have not made any update to my Golang journey, because I had been busy building my first Golang project over the past few weeks.

This project was built with NextJS on the frontend and Go as the API backend server.

How it started

Having learned Golang for a while, I was looking for an idea of what to build. Luckily, one day, a close friend/co-worker of my aunt hit me up and asked if I could build an online storefront for him.

Of course, I said yes! Given a deadline of 4 weeks, my goal was to get it done fast, and works well enough. Also, I had to use Golang, yes, forcing myself to learn Golang hands-on in 4 weeks.

The tech

After researching, I decided to use SQLite (no need to setup a SQL user, ROLE, etc.) → KISS — Keep It Stupid Simple!

SQLite works great as the database engine for most low to medium traffic websites… The amount of web traffic that SQLite can handle depends on how heavily the website uses its database… any site that gets fewer than 100K hits/day should work fine with SQLite… SQLite has been demonstrated to work with 10 times that amount of traffic. — SQLite.org

To interact with the SQLite database, I used Gorm — a Golang ORM.

Object-Relational Mapping (ORM) simplifies how programmers interact with databases by bridging the gap between relational data stored in databases and objects used in programming languages. Eg: translating object-oriented code into SQL queries.

And instead of using Go’s pure net/http package, I used Fiber — a NodeJS Express-inspired web framework written in Go, so I could have the syntax familiarity from Express and still the high performance of Go.

Result

After making many changes for the client, finally launched the site — 5Pieces Clothing!

You can check out the open source version as well!

Reflection

Go is very strict about types. There were times I wanted to build fast, but had to go back to fix the type issues. Oh, and Go also doesn’t like the unused variables, too.

Using Gorm was quite a pain, I might’ve have used raw SQL instead 😅.

Thank you for reading! Feel free to contribute to NextJS + Go Ecommerce CMS!

Learning Go — Week 4

Khoi Nguyen — Mon, 08 Jan 2024 00:00:00 +0000

Error handling

I love how Go does error-handling!

Error handling is not done via exceptions in Go. Instead, errors are normal values of types that implement the built-in error interface. The error interface is very minimal. It contains only one method Error() that returns the error message as a string. — Exercism

Super minimal!

However, this gives you the responsibility to be specific about your error message.

I didn’t know that by convention, the error message starts with a lowercase letter and not end with a period.

Since most functions in Go include an error as one of the return values, you will see/use the if err != nil pattern all over the place in Go code.

You can use a struct to create a custom error type, as shown below:

type MyCustomError struct {
  message string
  details string
}

func (e *MyCustomError) Error() string {
  return fmt.Sprintf("%s, details: %s", e.message, e.details)
}

func someFunction() error {
  // ...
  return &MyCustomError{
    message: "...",
    details: "...",
  }
}

Besides this, I also learned about Go’s regexp.

Zero values

Go does not have a concept of empty, null, or undefined for variable values. Variables declared without an explicit initial value default to the zero value for their respective type.

Type	Zero Value
boolean	false
numeric	0
string	“”
pointer	nil
function	nil
interface	nil
slice	nil
channel	nil
map	nil

First class functions

This is the last concept on Exercism that I need to learn.

Functions are first-class values. This means that you can do with functions the same things you can do with all other values - assign functions to variables, pass them as arguments to other functions or even return functions from other functions.

For instance:

import "fmt"

func engGreeting(name string) string {
	return fmt.Sprintf("Hello %s, nice to meet you!", name)
}

// greeting is a variable of type func(string) string
greeting := engGreeting
fmt.Println(greeting("Alice"))

func dialog(name string, greetingFunc func(string) string) {
	fmt.Println(greetingFunc(name))
	fmt.Println("I'm a dialog bot.")
}
dialog("Alice", greeting)

Learning Go — Week 3

Khoi Nguyen — Sat, 06 Jan 2024 00:00:00 +0000

It’s been a while! Yeah, I just graduated and spent some time traveling with my parents!

Recently, I’ve been doing Go challenges on Exercism. I’ve learned a few more concepts like: pointers, strconv, struct, interface. In my opinion, pointers seem like the most confusing concept to grasp when I started learning Go. After doing some challenges and slowly reading how it works, I love it now!

Pointers help you share memory with other parts of our program. When we have a large amount of data, making copies to pass between functions is inefficient. By passing pointers, you can access the single copy of the data directly → any changes made by one function are immediately visible to other parts of the program when the function ends.

I also tried to solve Advent of Code challenges using Go, and learned new syntax as I went. It was tough, at least for me. Here is my attempt to solve AoC challenges. Please don’t judge my inconsistency. It was quite a challenge!

As you can see, I still have a few more Go concepts to go, then I’ll build some projects with it.

Learning Go — Week 2

Khoi Nguyen — Tue, 28 Nov 2023 00:00:00 +0000

Speed-running has been my method of learning Go for the past week. Having learnt Python and C, I skipped some parts of A Tour of Go that I felt confident. Also, doing exercises on Exercism — Go track helps a lot!

The parts that I think I need to work on more are probably pointers (since I’ve worked with Python more than C) and choosing between _a value or pointer receiver for functions, still haven’t done much of that part.

I also found this guide, Twelve Go Best Practices, which I thinks is useful for Go learners like me. I still need to work on more apps to get these best practices in my head.

Anyway, I was just bored that I found this guide on how to build a basic RESTful API with Go and Gin. It’s fun to build some small projects to learn. Also, love how Go’s package manager is already built in with the Go CLI. If you want to install a package, just do:

go get <package name / GitHub URL>

Learning about Go’s approach to format time is interesting. Go uses a special time string value 2006-01-02 15:04:05 for its layout. You can tweak this layout string to create multiple time formats. Eg:

const layout = "2006-Jan-02"
tm, _ := time.Parse(layout, "2014-Feb-04")

const layout = "Jan 2, 2006 at 3:04pm (MST)"
tm, _ := time.Parse(layout, "Feb 4, 2014 at 6:05pm (PST)")

Setting up CI/CD for your blog

Khoi Nguyen — Sat, 25 Nov 2023 00:00:00 +0000

In this blog post, let’s learn how to set up a CI/CD workflow for your blog with CircleCI, GitHub, and a Linux Virtual Private Server (VPS) with NGINX installed.

Note that I’m using Eleventy as a static site generator for my blog.

Prerequisites

A CircleCI account.
A GitHub account.
A Linux VPS from AWS / Azure / DigitalOcean / etc. (just make sure you have set up SSH and create a new sudo user for it).

Setup user for deployment

SSH into your VPS (as a sudo user) and create a new user called circleci. Run:

sudo useradd -m -d /home/circleci -s /bin/bash circleci

Setting up SSH for the new circleci user.

On your local machine, to generate an SSH key pair, run:

ssh-keygen -m PEM -t rsa -f ~/.ssh/circleci

Copy & paste the content of the public key .pub and add it your VPS /home/circleci/.ssh/authorized_keys file.

sudo nano /home/circleci/.ssh/authorized_keys

If the directory /.ssh doesn’t exist, create it with:

sudo mkdir /home/circleci/.ssh

then create the authorized_keys file:

sudo touch /home/circleci/.ssh/authorized_keys

Give the circleci user its directory permissions so that it doesn’t run into permission issues during deployment.

sudo chown -R circleci:circleci /home/circleci

On your local machine, test the new circleci setup with:

ssh circleci@<your_server_ip> -i ~/.ssh/circleci

If it works, you are now logged in as circleci!

Setup SSH connection with GitHub. This allows us to do git fetch, git pull, and cloning private repos.

Install Node

SSH to your VPS with the user circleci as we’ve set up above.
Install node (I find installing Node using the Node Version Manager to be more convenient).

Run node -v to make sure node is installed
Run npm -v to make sure npm is installed.

Run npm i -g pnpm to install pnpm globally.

Run pnpm -v to make sure pnpm is installed.

Setup deployment environment

Create a folder for our deployment, then move to that folder:

mkdir web && cd web

Clone your blog from GitHub:

git clone <repo-url / ssh-string>

Eg: git clone git@github.com:KhoiUna/my-blog.git (I prefer using an SSH string since we’ve setup SSH connection with GitHub).

Note that in my GitHub repo, I’ve created a .circleci/ folder with a config.yml file.

# .circleci/config.yml
version: 2.1

# Define the jobs we want to run for this project
jobs:
    pull-and-build:
        docker:
            - image: arvindr226/alpine-ssh
        steps:
            - checkout
            - run: ssh -o StrictHostKeyChecking=no $USER@$IP "./deploy-blog.sh"
            # I tell CircleCI to SSH to my VPS,
            # and run my `deploy-blog.sh` script.

# Orchestrate our job run sequence
workflows:
    version: 2
    build-project:
        jobs:
            - pull-and-build:
                  filters:
                      branches:
                          only:
                              - main

Create deploy-blog.sh script: vi ~/deploy-blog.sh with this content:

# /home/circle/deploy-blog.sh
#!/bin/bash

# replace this with the path of your project on the VPS
cd ~/web/my-blog

# pull from the branch
git pull origin main

# followed by instructions specific to your project that you used to do manually
export PNPM_HOME="/home/circleci/.local/share/pnpm"
export PATH="$PNPM_HOME:$PATH"

# Install dependencies
pnpm i

# Build my static blog.
# I'm using 11ty so the out dir will be `_site/`
pnpm build

Login to your CircleCI account, create a new project and connect it to your blog repo.
Go to your Project Settings, create 2 environment variables: USER=circleci and IP=<your_server_ip>.
Under Additional SSH Keys, add your private key that you’ve created for circleci user.

Setup NGINX

SSH into your server as a sudo user, not as user circleci.
Make sure NGINX has been installed and is running:

To make sure NGINX has been installed:

nginx -v

To make sure NGINX is running:

sudo systemctl status nginx

If it says Active, proceed to the next step. If not, start NGINX with: sudo systemctl enable nginx && sudo systemctl start nginx

Create our NGINX site config file at /etc/ngixn/sites-available/:

sudo vi /etc/nginx/sites-available/my-blog.conf

with this content:

# /etc/nginx/sites-available/my-blog.conf
server {
                listen 80;
                listen [::]:80;

                root /home/circleci/web/my-blog/_site;
                index index.html index.htm index.nginx-debian.html;

                server_name yourdomain.com;
                error_page 404 = /404.html;

                location /404.html {
                        internal;
                }

                location / {
                        try_files $uri $uri/ =404;
                }
}

Check our NGINX config file:

sudo nginx -t

If it says OK, proceed to the next step!

Restart NGINX:

sudo systemctl restart nginx

Your blog is now live at yourdomain.com!

A few notes

From now on, each time you git push successfully to the main branch, CircleCI will run the steps in our .circleci/config.yml file in our repo.
Make sure to not make user circleci a sudo user for security purposes.
Make sure to have export PATH in your deploy-blog.sh script. This is important as CircleCI won’t have access to user circleci’s $PATH when SSH to our VPS (p/s: I spent hours fixing this bug).

References

How To Automate Deployment Using CircleCI and GitHub on Ubuntu 18.04 | DigitalOcean

SOAR Playbooks

Khoi Nguyen — Fri, 24 Nov 2023 00:00:00 +0000

This is Week 9 at CodePath's Intermediate Cybersecurity course!

SOAR

SOAR stands for Security Orchestration, Automation and Response.

It is a technology solution that aims to streamline and automate the security operations process by integrating various security tools and processes (eg: SIEM, threat intelligence, etc.) into a single platform.

SOAR platform can automatically collect and analyze security alerts from multiple sources, correlate events to identify potential threats, and initiate a response based on pre-defined playbooks.

→ Help organizations respond more quickly and effectively.

SOAR Playbooks

SOAR platforms typically provide a range of pre-built playbooks that can be customized to meet an organization’s specific security needs. These playbooks are based on industry-standard frameworks and best practices. These include:

COPS — provides a standardized way for SOAR platforms to communicate with different systems & devices to ensure that security policies are consistently enforced across an organization’s IT infrastructure.
OASIS CACAO — defines a set of reusable & shareable artifacts, including use case templates, workflows, & playbooks.
RE&ACT — provides a standardized way for SOAR platforms to exchange info & automate security operations. By using a common language and framework, RE&ACT aims to improve the ability of organizations to protect their assets & data.

Learning Go — Week 1

Khoi Nguyen — Sat, 18 Nov 2023 00:00:00 +0000

Here are a few things I found interesting about Go:

Go is sort of Object-Oriented.
- Go has no classes → no type inheritance.
- You can define custom interfaces, custom structs (structs — data structures — can have member fields).
- Custom types can implement 1 or more interfaces. Custom types can have member methods.
There’s only one way to write a loop — the “for” loop. There is no “while…do…” or “do…while…”.
Designed as a next-gen lang for C. Go borrows syntax from C, Pascal, etc.

CompTIA Roadmap

Khoi Nguyen — Tue, 14 Nov 2023 00:00:00 +0000

I attended the National Cyber Summit a few months ago and got this flyer. I think it might be helpful to share!

_{CompTIA pathway to jobs}

Hosting my own ActivityPub server

Khoi Nguyen — Sun, 12 Nov 2023 00:00:00 +0000

Intro

I love self-hosting. The idea of running someone else’s software is beautiful and satisfying. Like learning how to bake a cake from a recipe, if it turns out great, you relish the sweet taste of both success and independence.

Lately, I have been passionate about the idea of decentralization. For me, decentralization in a not technical way is independence. It is equality giving power to everyone.

This leads me to experiment with platforms like Mastodon. Digging a bit deeper, the underlying tech that powers these platforms is a protocol — ActivityPub. With a shared protocol, developers build social apps that can talk to each other, build creative and sleek clients to interact with users on these platforms, sort of like emails.

In this post, I’ll compare 2 open-source ActivityPub servers that you can run on your own VPS — GoToSocial and Pleroma. These two are pretty lightweight compared to Mastodon so they won’t eat up your server’s resources.

GoToSocial vs Pleroma

Note: GoToSocial at this time of writing is still in alpha.

	GoToSocial	Pleroma
Programming language	Go	Elixir
Ease of deployment	Easier in my opinion. Offers running from binary and Docker. However, you can customize more if running from binary.	Has more compilation steps.
User interface	Doesn’t have a web UI like Pleroma or Mastodon, so you’ll have to look for a web client. It only has a web UI for settings and profile page that you can customize.	Has its own web UI and you can customize it. However, it’s hard to maintain, not recommended.

Another issue I encountered was trying to use DNS proxy with Cloudflare. GoToSocial works fine, but not Pleroma. I had to disable Proxied with Cloudflare in my DNS settings in order to access Pleroma.

Now, go ahead and set up your own ActivityPub server then tell me what you think.

Here are my favorite client apps to interact with the Fediverse:

To comment or give feedback on this blog post, you can leave them here.

Threat hunting vs Security analytics

Khoi Nguyen — Fri, 10 Nov 2023 00:00:00 +0000

This is Week 8 at CodePath's Intermediate Cybersecurity course!

Hypothesis-driven investigation

This involves developing a specific hypothesis or theory about a potential security threat, based on available data or information, and then conducting investigations to confirm or refute the hypothesis.

The hypothesis may be derived from various sources to gather evidence that supports or contradicts the hypothesis:

Threat intelligence
Network analysis
System logs
User behavior analysis

→ Allows cybersecurity professionals to focus their investigations on potential threats that are most likely to pose a risk to their organization, rather than trying to identify and investigate every potential threat.

→ Speed up the investigation process by providing a clear direction for the investigation and enabling analysts to prioritize their efforts based on the level of risk posed by the threat.

Scenario

Hypothesis: A malicious actor has gained unauthorized access to a company’s network and is exfiltrating sensitive data.

Investigation:

Collect network logs and analyze them for any suspicious activity, such as unusual login attempts or data transfers.
Check endpoint logs to see if any devices are communicating with known malicious domains or IP addresses.
etc.
If the hypothesis is confirmed, take appropriate actions to remediate the threat, such as isolating affected devices and updating security protocols.

→ By using a hypothesis-driven approach, the investigation is focused on a specific threat scenario and prioritizes the collection and analysis of data that is most likely to confirm or refute the hypothesis.

Threat Hunting vs Security Analytics

	Threat hunting	Security analytics
Focus	A proactive approach that focuses on finding and mitigating threats that may have gone undetected by other security controls	A reactive approach that analyzes data after an event has occurred to identify indicators of compromise (IoCs) and prevent similar incidents in the future.
Approach	Hypothesis-driven approach that involves formulating hypotheses about potential threats and searching for evidence to confirm or refute them.	Data-driven approach that involves analyzing large volumes of data to identify patterns and anomalies that may indicate a potential threat.
Human expertise	Relies on human expertise and intuition to formulate hypotheses, identify potential threats, and make decisions about remediation.	Can be automated and relies on algorithms and machine learning models to analyze data and identify potential threats.
Timeframe	An ongoing, continuous process that involves regular assessments of the environment and searching for potential threats.	Typically focused on a specific timeframe, such as analyzing data from the past 24 hours or analyzing data related to a specific incident.

Guide to renting

Khoi Nguyen — Fri, 10 Nov 2023 00:00:00 +0000

I’m about to graduate and looking to rent an apartment. Here’re some takeaways that I learned from these videos:

Check them out!

Apartment vs Condo

Apartment	Condo
1 owner for entire complex	Separate owner for each unit
Likely to raise rent	Less likely to raise rent; more responsive to repair requests

Cost of renting

There are fees to consider:

Application fees
Parking fees
Pet fees
Move-in and move-out fees

Pro tip: avoid buying new furniture and ask about utilities cost.

Evaluate the unit

Check the area: neighborhood, pests, etc.

Check out Trulia and SpotCrime.

Consider buying renter’s insurance.

Record a video of your unit before you move in.

Do not pay a deposit or sign a lease until you have visited the place!

How much rent can you afford

Use after-tax income for your rent budget.

Rule of thumb: 25% of your monthly take-home pay after taxes

Try out this calculator!

Threat intelligence APT and MISP

Khoi Nguyen — Sun, 29 Oct 2023 00:00:00 +0000

This is Week 7 of CodePath.

Advanced Persistent Threat (APT)

APT aims to infiltrate a company’s computer systems and steal information or disrupt operations. APT is persistent, meaning they keep trying even if they fail at first, and adapt their tactics to get around defenses. They attack over a long period of time, trying to achieve their goals.

Who is concerned about APTs?

Governments
Corporations
Any organizations holding sensitive info

Who uses APTs?

Nation-States — steal military secrets or to gain access to sensitive government systems.
Criminal Organizations — steal credit card information or other valuable data that can be sold on the black market.
Insiders — steal data or intellectual property from their own organization for personal gain.

Dangers of APTs

They are persistent: they will continue to try to penetrate defenses until they succeed.

They are adaptive: they can change their tactics as defenders improve their security measures.

They are a serious threat: cause significant financial harm and/or compromise national security.

Threat Intelligence & Response

Adversarial Tactics, Techniques & Common Knowledge (ATT&CK): a framework that describes different tactics and techniques used by attackers during a cyber attack.

Cyber Analytics Repository (CAR): A collection of analytics and rules that can be used to detect and respond to cyber threats. CAR is like a set of tools that help an organization monitor its network for signs of an attack.

Common Attack Pattern Enumeration and Classification (CAPEC): a catalog of different types of attacks that organizations might face; helps security teams understand the tactics and techniques used by attackers to exploit known weaknesses in cyber-enabled capabilities (e.g., SQL Injection, XSS, Session Fixation, Clickjacking); is like a dictionary of different cyber attacks, with each attack type having a unique identifier and description.

The exchange of relevant data and insights about potential cyber threats among individuals or organizations.

Occurs via formal agreements or informal networks, and can involve the sharing of indicators of compromise, malware samples, or other data that can help identify and mitigate threats.

It’s like sharing information about suspicious activities with your neighbors so that everyone can take measures to protect themselves and their properties.

Sharing threat indicators with other organizations is mutually beneficial but comes with challenges as well.

You need to make sure not to share confidential information. You need to share it in a way that makes it both timely and actionable. etc.

Malware Information Sharing Platform (MISP) is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and ICT professionals or malware reversers to support their day-to-day operations to share structured information efficiently.

Threat Intelligence Feeds

These are continuous streams of valuable info that provide timely and actionable details about potential or current threats. This info is collected from a variety of sources, analyzed, and then distributed by organizations dedicated to improving cybersecurity awareness. The content of these feeds varies widely, from comprehensive lists of malicious IPs and URLs to detailed malware analysis reports and risk ratings.

Advantage

Visibility: By adding this feed, you get visibility into potential threats that are using the TOR network to mask their activities.

Threat Intelligence: This feed helps you understand and identify trends or patterns that might indicate a threat.

Incident Response: If you detect activity from an IP address on this list, it could be an indicator of a security incident that needs to be investigated.

Caching a feed

When you cache a feed in MISP, you are essentially storing a local copy of the feed data in your MISP instance allowing you to:

Access and analyze the data faster because you don’t need to fetch the data from the feed source each time.
Reduces the load on the feed source and can help prevent your access from being rate-limited or blocked if the feed source has such restrictions.

You don’t want to repeatedly ask the source for the exact same data!

Incident response — NIST vs SANS

Khoi Nguyen — Tue, 24 Oct 2023 00:00:00 +0000

This is part of Week 6 of CodePath's Intermediate Cybersecurity course.

NIST and SANS

National Institute of Standards and Technology (NIST) is a U.S. government agency that specializes in all kinds of tech. The NIST Cybersecurity Framework is one of the most popular methodologies for better understanding and managing cybersecurity risk.

Sysadmin, Audit, Network, and Security (SANS) is a private org that researches and educates industries in the 4 key cyber disciplines. The SANS framework primarily focuses on security as opposed to NIST, which has a wider domain of operation.

Comparing NIST and SANS incident response steps

NIST	SANS
1. Preparation	1. Preparation
2. Detection and Analysis	2. Identification
3. Containment, Eradication, and Recovery	3. Containment
	4. Eradication
	5. Recovery
4. Post-Incident Activity	6. Lesson Learned

Placed side-by-side, NIST and SANS have all the same components and the same flow.

The biggest difference lies in Step 3, where NIST believes that containment, eradication, and recovery overlap – meaning you should not wait to contain all threats before beginning to eradicate them.

Preparation

No organization can spin up an effective Incident Response (IR) on a moment’s notice. A plan must be in place to both prevent and respond to events.

Defining the CSIRT (Computer Security Incident Response Team)
Developing and updating a plan
Acquiring and maintain the proper infrastructure tools
Possessing up to date threat intelligence capabilities

Having tools and resources available that may be of value during an incident handling.

Incident Handler Communication Facilities: Contact information for IR team members, incident reporting mechanisms (such as phone numbers, email addresses, forms, etc), smartphones, war room, secure storage facility.
Incident Analysis Hardware & Software: Laptops, digital forensics workstations, blank removable media, portable printer, packet sniffers, digital forensic software.
Incident Analysis Resources: Port lists, documentation (for OSs, applications, IDS, antivirus), network diagrams and lists of critical assets, current baselines, cryptographic hashes.
Incident Mitigation Software: Access to images of clean OS and application installations for restoration and recovery purposes.

Preventing incident: Keeping the number of incidents reasonably low with recommended practices: risk assessments, host and network security, malware prevention, user awareness and training.

Detection and Analysis

Attack vectors: Some common ones include: external/removable media, attrition, web, email, etc.
Signs of an incident
Incident analysis: Once identified, the IR team has to determine if a precursor or indicator is part of an attack or if it is a false positive.
Incident documentation: If the signal proves valid, the IR team must begin documenting all facts in relation to the incident and continue logging all actions taken throughout the process.
Incident Prioritization: NIST designates this step as the most critical decision point in the IR process. The IR team can’t simply prioritize incidents on a first come, first serve basis. Instead, they must score incidents on the impact it will have on the business functionality, the confidentiality of affected information, and the recoverability of the incident.
Incident notification

Containment, Eradication, & Recovery

The purpose of the this phase is to halt the effects of an incident before it can cause further damage. Once an incident is contained, the IR team can take the time necessary to tailor its next steps.

Containment: an essential part of containment is decision-making (e.g. shut down a system, disconnect it from a network, disable certain functions). Criteria for determining the appropriate strategy include:
- Potential damage to & theft of resources, need for evidence preservation, service availability, time & resources needed to implement strategy, effectiveness of strategy, & duration of solution.
- In some cases, the attacker is redirected to a sandbox so that they can monitor the attacker’s activity.
Evidence gathering and handling
Identifying the attacking hosts
Eradication and recovery: during eradication, it is important to identify all affected hosts within the organization so that they can be remediated. For some incidents, eradication is either not necessary or is performed during recovery.

Post Incident Activity

Every incident should be an opportunity to learn and improve, but many organizations give little time or attention to this step.

Lessons learned: each incident response team should evolve to reflect new threats, improved technology, and lessons learned. If an organization doesn’t improve their systems after an incident, they are bound to have a repeat of events
Using collected incident data: this data can be put back into the risk assessment process, ultimately leading to the selection and implementation of additional controls.
Audit: Audits will identify problems and deficiencies that can then be corrected.
Evidence retention: A policy for how long evidence from an incident should be retained. Most choose to retain all evidence for months or years after the incident ends depending on data retention policies, cost, and potential legal actions.

What are SIEM and UEBA?

Khoi Nguyen — Wed, 18 Oct 2023 00:00:00 +0000

Week 5 of my CodePath's Intermediate Cybersecurity course!

Security Information & Event Management (SIEM)

SIEM tools use rules and statistical correlations to turn log entries and events from security systems into actionable information.

Detect threats in real time
Manage incident response
Forensic investigation on past security incidents
Prepare audits for compliance purposes

SIEM combines 2 functions:

SIM — security information management.
SEM — security event management.

→ Makes SIEM more well-rounded and an ubiquitous tool for any Security Operation Center (SOC).

Some SIEM tools include: Splunk Enterprise Security, Datadog Security Monitoring, Fortinet FortiSIEM, etc.

In short, SIEM is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations. — Microsoft

Next-gen SIEM capabilitites

Next-gen SIEM utilizes User and entity behavior analytics (UEBA) to go beyond rules and correlations, leveraging AI and deep learning techniques to look at patterns of human behavior.

Security orchestration and automation response (SOAR): Next-gen SIEMs integrate with enterprise systems and automate incident response. Eg: SIEM detects an alert for ransomware → SIEM performs containment steps automatically on affected systems before attackers encrypt the data → simultaneously creating communications or other notifications.
Complex threat identification: Correlation rules can’t capture many complex attacks, because they lack context, or can’t respond to new types of incidents. With automatic behavioral profiling, SIEMs detect behavior that suggests a threat.
Detection without rules or signatures: Many threats can’t be captured with manually-defined rules or known attack signatures. SIEMs use machine learning to detect incidents without pre-existing definitions.
Lateral movement: SIEMs analyze data from across the network and multiple system resources to detect lateral movements — attackers move across network, IP addresses, etc.
Entity behavior analysis: Critical assets on the network — servers, medical equipments, etc. — have unique behavioral patterns. SIEMs learn these patterns and automatically discover anomalies suggesting a threat.

User and entity behavior analytics (UEBA)

UEBA provides information on the behavior of users and other entities in the corporate network — malicious insider, compromised user, etc.

3 pillars of UEBA

Analytics: detects anomalies using a variety of analytics approaches — machine learning, statistical modeling, etc.

Data sources: ingest data from a general data repository such as a data lake or data warehouse, or through a SIEM. Can be from:

Business context
HR and user context
External threat intelligence
Events and logs
Network flows and packets

Insider threats

Negligent insider: An employee with privileged access to IT systems unintentionally puts their org at risk because they don’t follow the procedures.

Malicious Insider: employee intends to perform a cyber attack against the org.

Compromised insider: infiltrate an org and compromise a privileged user account.

_{Source: Varonis}

Slowloris DDoS & how to mitigate with NGINX

Khoi Nguyen — Mon, 16 Oct 2023 00:00:00 +0000

Content

What is denial-of-service (DDoS) attack?

It’s a malicious attempt to disrupt the normal traffic of a targeted server by overwhelming the target with a flood of Internet traffic.

A DDoS attack is like an unexpected traffic jam clogging up the highway, preventing regular traffic from arriving at its destination.

Different types of DDoS attacks target varying components of a network connection. A network connection on the Internet is composed of many different components or “layers”.

The OSI model is a conceptual framework used to describe network connectivity in 7 distinct layers.

Slowloris DDoS

A Slowloris DDoS attack is a type of DDoS attack targeting Layer 7 of the OSI model.

It was designed to overwhelm a single computer, web server, database, or API by opening and maintaining many simultaneous TCP connections to a target Fully Qualified Domain Name (FQDN) and generating a low rate and/or volumes of HTTP requests or HTTP connections per connected session.

FQDN is written with the hostname and the domain name, including the top-level domain, in that order: [hostname].[domain].[tld].
Eg: www.microsoft.com, en.wikipedia.org, etc.

This type of DDoS attack is a simple but elegant method that allows an attacker to take down a web server with very low complexity.

Traditional application DDoS attacks are designed to take down a server by flooding it with an overwhelming number of HTTP requests. In contrast, a Slowloris attack only requires a few hundred requests at long, low, and regular intervals, rather than tens of thousands of HTTP requests on an ongoing basis.

Fun fact: it’s named after the slow loris — a slow-moving, Asian primate.

Slowloris attack occurs in 4 steps

Attacker opens multiple connections sending multiple partial HTTP request headers to the targeted server.
The targeted server opens a thread for each incoming request with the intent of closing the thread once the connection is completed, or if a connection takes too long, the server will timeout the exceedingly long connection, freeing the thread up for the next request.
To prevent the target from timing out the connections, the attacker periodically sends partial request headers to the target in order to keep the request alive. In essence saying, I’m still here! I’m just slow, please wait for me.
The targeted server is unable to release any of the open partial connections, eventually, the server will be unable to respond to additional requests made from regular traffic, resulting in DoS.

Best way to stop a Slowloris attack

Rate limit incoming requests
- Limiting the number of connections a single IP address may request to open.
- Increasing the minimum transfer speed allowed for any connection.
- Limiting the time a client is allowed to stay connected.
Increase server availability
- Increasing the maximum number of clients making requests to the server will increase the number of connections the attacker must make before they can overload the server. Realistically, an attacker may scale the number of attacks to overcome server capacity regardless of increases.
Cloud-based protection
- Use a service that can function as a reverse proxy, protecting the origin server.
- Deploying robust cloud mitigation services, configuring robust load balancers, using web application firewalls (WAFs) or other virtual patching techniques, and rate-limiting the number of requests per source.

Mitigate DDoS with NGINX

NGINX is designed to be a shock absorber for your site/application. It has a non‑blocking, event‑driven architecture that copes with huge amounts of requests without a noticeable increase in resource utilization.

Here are some code snippets to do so.

Limit the rate of requests

limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;

server {
    # ...
    location /login.html {
        limit_req zone=one;
    # ...
    }
}

Limiting the Number of connections

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    # ...
    location /store/ {
        limit_conn addr 10;
        # ...
    }
}

Closing Slow Connections

server {
    client_body_timeout 5s;
    client_header_timeout 5s;
    # ...
}

Denylisting IP Addresses

location / {
    deny 123.123.123.0/28;
    # ...
}

location / {
    deny 123.123.123.3;
    deny 123.123.123.5;
    deny 123.123.123.7;
    # ...
}

Allowlisting IP Addresses

location / {
    allow 192.168.1.0/24;
    deny all;
    # ...
}

Blocking Requests

location /foo.php {
    deny all;
}

Or if you discover that DDoS attack requests have a User-Agent header value of foo or bar, you can block those requests.

location / {
    if ($http_user_agent ~* foo|bar) {
        return 403;
    }
    # ...
}

Limiting the Connections to Backend Servers

upstream website {
    server 192.168.100.1:80 max_conns=200;
    server 192.168.100.2:80 max_conns=200;
    queue 10 timeout=30s;
}

There’re probably way more! But as an intermediate cyber enthusiasts, I only got my hand on a few of these.

Thank you for reading this blog!

Also, check out this free tool to monitor requests for your NGINX server!

References

Cloudflare | What is a DDoS attack?

Cloudflare | Slowloris DDoS attack

Akamai | What Is a Slowloris DDoS Attack?

NGINX | Mitigating DDoS Attacks with NGINX and NGINX Plus

10 ways to prevent zero-day attacks

Khoi Nguyen — Mon, 16 Oct 2023 00:00:00 +0000

Content

What is a zero-day?

A zero day (or 0-day) vulnerability is a security risk in a piece of software that is not publicly known about and the vendor is not aware of. These are severe security threats with high success rates as businesses do not have defenses in place to detect or prevent them. The attacker releases malware before the developer or vendor has had the opportunity to create a patch to fix the vulnerability.

The term “zero day” comes from the world of pirated digital media, since the pirated version is published zero days after the official version.

10 ways to prevent zero-day attack prevention tips

Vulnerability scanning: Can detect zero-day exploits, but scanning alone isn’t enough. Organizations need to act on the results of a scan, perform code review and sanitize code accordingly. The entire process is time-consuming providing windows of opportunity to hackers.
Patch management: Critical, but can be time-consuming. Enterprises with a large number of endpoints should consider streamlining patch management through automation - from identifying missing patches, to testing patches, deploying them, updates and producing reports.
Firewall: A firewall reviews all incoming and outgoing network traffic based on predetermined security rules, filtering out malicious inputs that might target security vulnerabilities.
Advanced threat intelligence: Invest in advanced threat intelligence services in order to get real-time info about emerging vulnerabilities.
XDR/XPR: Extended Detection and Response (XDR) and Extended Prevention and Response (XPR) technology integrates data from a variety of sources to offer a comprehensive overview of an organization’s cyber security posture. This helps security teams detect and respond to threats more quickly and effectively.
Cloud-specific measures: Extend your zero-day prevention efforts to cloud environments. Implement cloud-specific cyber security measures, such as Security Information and Event Management (SIEM), data encryption, configuration management best practices, cloud-native security tools and zero-trust for cloud.
Consolidation: A unified security platform is essential in preventing zero-day attacks. A single solution that offers visibility and control across an organization’s entire IT ecosystem has the context and insight required to identify a distributed cyber attack.
Incident response plan: Every org needs this. Include a mission statement, formal documentation around roles and responsibilities during a possible attack, a recap of primary cyber threat vectors likely to affect a given organization, policies around making payments to cyber attackers, incident classification guidelines and under what circumstances an incident must be reported to law enforcement (and how quickly).
Data backups: Follow the 3-2-1 rule. Reliable backups provide peace-of-mind.

The 3-2-1 Rule: 3 copies of data on 2 different media with 1 copy being off-site.

Third-party risk management: Ensure 3rd-party partners are enforcing standards that protect your business, and standardize your 3rd-party risk management (instead of using spreadsheets and consequently chasing business partners via email in the event of a major security threat).

TLDR

Vulnerability scanning
Patch management
Firewall
Advanced threat intelligence
XDR/XPR
Cloud-specific measures
Consolidation
Incident response plan
Data backups
Third-party risk management

References

Fortinet | What Is a Zero Day Attack?

CyberTalk.org | 10 top zero-day attack prevention tips

Taking driver license test for international students in the US

Khoi Nguyen — Sun, 15 Oct 2023 00:00:00 +0000

Intro

In the US, you need to pass 2 rounds to get the official permit:

Computer test - tests you about rules, car signals, traffic signs, etc.
Road test - a examiner will sit next to you and see how you drive, then evaluate.

What you need to bring

Always bring a physical copy! Make sure to print the latest document!

To take a driver’s license (both computer test and road test) in the US, YOU will need your:

I-20
I-94
Letter of Good Standing — request this from your school’s Office of Internation Affairs/DSO; expires after 30 days.
SSN or Letter of authorization to bypass SSN
Passport

For taking the road test, the CAR’S OWNER has to provide his/her:

Driver license
Insurance ID Card
Car tag info

Schedule a driver license test in Alabama

Since I study at the University of North Alabama, here are the links I use the most at my closest DMV:

Renew your driver license

To renew, you need:

I-20
I-94
Letter of Good Standing — request this from your school’s Office of Internation Affairs/DSO; expires after 30 days.
SSN or Letter of authorization to bypass SSN
Passport

Make sure the program end date on your latest I-20 is at least 150 days away (may differ between states) from the day you try to renew your driver license. Or, you have to wait for your EAD card to arrive to renew, but not before.

It’s good practice to renew your driver license six months ahead of the expiration date.

In short, don’t apply for OPT unless you’ve renewed your driver license.

It’s illegal to drive with an expired driver license, and fines can be costly.

Unlocking Enterprise Sales: The Power of Permissionless Pilots

Khoi Nguyen — Tue, 10 Oct 2023 00:00:00 +0000

Content

Intro

I recently learned about Permissionless Pilots - a new pattern that’s enabling startups to close big contracts, fast.

As we know, enterprise sales cycle is slow, and the faster your product can deliver that wow feeling to customers, the better. However, too many products take forever to deliver that moment, due to a long slog of sales calls, procurement, contract negotiation, and technical integration.

The catch-22

I’ll give you my data once I know it works on my data.

Enterprise software products generally require customer’s data to work. To get around this, demos use fake dummy data to simulate a theoretical user experience. It’s like watching someone else drive a car at the dealership. It’s a lot more exciting to test drive it yourself!

But most prospects don’t give away their employer’s data until they’re convinced it’ll be worth their while. Getting the green light to share company data with a 3rd party involves jumping through hoops.

How to create a permissionless pilot

The 3 basic steps to a permissionless pilot are:

Get the public data. Eg: open-source repos, rental listings, YouTube videos, job postings, etc.
Build a tool for it.
Drive demand to that tool.

To help with idea generation, start by writing down all the public data sources relevant to your product. Next, ask yourself: What could my product do assuming it never got any proprietary customer data, but could ingest all those public data sources?

In terms of your answer, you’re aiming for a demo that does something cool. Cool is the adjective that tends to come to mind for builders when they picture it. It doesn’t have to be perfect. It doesn’t have to be something customers would pay for.

Something cool is a good start.

Conclusion

Not every company is a candidate for permissionless pilots, but the steady proliferation of public data in the last 10 years means there are certainly untapped opportunities for more wow moment demos. Recent advances in ML techniques like computer vision, and natural language processing with LLMs allow us to structure vast amounts of unstructured data, creating additional permissionless pilot opportunities.

Apply permissionless pilots to your advantage!

What is a DNS SOA (Start of Authority)

Khoi Nguyen — Sun, 08 Oct 2023 00:00:00 +0000

Content

Intro

I was trying to set up 4 VMs to configure a DNS as a class assignment, and boy, are they confusing!

There are so many things I’ve taken for granted like how easy it is to buy a domain, then you just have to configure the A and CNAME record all on the domain registrar’s dashboard.

As a result, I spent more time to learn a few things about DNS, and that’s how SOA (Start of Authority) became the subject of this blog post. Here is a brief intro to SOA!

What is an SOA

The DNS SOA record stores important information about a domain or zone such as the email address of the administrator, when the domain was last updated, how long the server should wait between refreshes, etc.

All DNS zones need an SOA record in order to conform to IETF standards. SOA records are also important for zone transfers.

In DNS, zone is an area of control over namespace. A zone can include a single domain name, one domain and many subdomains, or many domain names. In some cases, zone is essentially equivalent with domain, but this is not always true.

What makes an SOA

Given this SOA record:

name	example.com
record type	SOA
MNAME	ns.primaryserver.com
RNAME	admin.example.com
SERIAL	1111111111
REFRESH	86400
RETRY	7200
EXPIRE	4000000
TTL	11200

Serial number: is a version number for the SOA record. In the example above, the serial number is listed next to SERIAL. When the serial number changes in a zone file, this alerts secondary nameservers that they should update their copies of the zone file via a zone transfer.
MNAME: is the name of the primary nameserver for the zone. Secondary servers that maintain duplicates of the zone’s DNS records receive updates to the zone from this primary server.
REFRESH: The length of time (in seconds) secondary servers should wait before asking primary servers for the SOA record to see if it has been updated.
RETRY: The length of time a server should wait for asking an unresponsive primary nameserver for an update again.
EXPIRE: If a secondary server does not get a response from the primary server for this amount of time, it should stop responding to queries for the zone.

Below is what SOA looks like on a Debian VM (that’s what I used for the assignment):

$TTL    604800
@       IN      SOA     ns1.computingforgeeks.local. root.ns1.computingforgeeks.local. (
                              3         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
;@      IN      NS      localhost.
;@      IN      A       127.0.0.1
;@      IN      AAAA    ::1

;Name Server Information

@        IN      NS      ns1.computingforgeeks.local.

;IP address of Name Server

ns1     IN      A       192.168.1.12

;Mail Exchanger

computingforgeeks.local.   IN     MX   10   mail.computingforgeeks.local.

;A – Record HostName To Ip Address

www     IN       A      192.168.1.13
mail    IN       A      192.168.1.14

;CNAME record

ftp     IN      CNAME   www.computingforgeeks.local.

Hope you learn something today!

Resources

ComputingforGeeks - Configure BIND Master DNS Server on Debian 11/10

Limitations of lean startup

Khoi Nguyen — Sun, 08 Oct 2023 00:00:00 +0000

I recently read an interesting paper on lean startup. The paper points out 3 challenges of lean startup.

Challenge 1: Applying lean manufacturing to startups

Lean got its origin from manufacturing.

Toyota’s lean production system: the approach seeks to address a series of operational issues, such as inventory management (just-in-time), waste reduction, the optimization of supply chains and continuous improvement in manufacturing.

The lean startup movement explicitly builds on these lean manufacturing principles. However, the central challenge is that lean production techniques were explicitly developed for continuous and incremental improvement of existing processes and products.

Challenge 2: Experimentation and customer validation

Lean startups should quickly develop an MVP (minimum viable product) and get rapid customer feedback/input. Business plans are discouraged because business plans fail on contact with customers. Instead, founders and managers are told to interact with potential customers as soon as possible to iterate.

It’s hard to disagree with the importance of focusing on customers. But the question is, precisely when (and for what types of products) does engaging with customers make sense? This is the reason Apple has historically shied away from the type of customer interaction suggested by lean startup. The problem is customer imagination is delimited by what is presently there.

Steve Jobs:

It isn’t the consumers’ job to know what they want.

Henry Ford:

If I’d asked customers what they wanted, they would have told me, a faster horse!

Startup founders need to, in some sense, look beyond the present and into some unknown future - beyond existing products and realities.

Challenge 3: Canvas, business models and experimentation

Lean startup features a popular tool - the business model canvas.

The canvas features 9 distinct boxes (key partners, key activities, key resources, value propositions, customer relationships, channels, customer segments, cost structure, and revenue streams) to fill in. The hope is that by addressing the 9 elements of the canvas that valuable hypotheses will emerge.

However, in the authors’ perspective, the initial step is not to broadly canvas the environment in search of a full-fledged business model, but rather to develop a unique and potentially valuable hypothesis, built around an entrepreneur’s unique beliefs and coherent theory of value. This theoretical hypothesis development must be more than a mere guess. As in science, hypotheses originate and derive from sound theoretical logic, which at its best provides guidance for what to look for in the first place.

In short, the entrepreneurial exercise should begin by deciding what to look for not cataloging what you see.

Startup strategy: Theory and commitment

Lean startup prompts low-cost ideas: beta products can be rapidly developed; customers and investors can already easily understand and agree/disagree with what a startup is doing.

Well-composed theory enables experiments that permit unique and clearer conclusions about a startup theory’s merits leading to faster and more productive pivots.

Entrepreneurs who were taught to carefully frame their problems, formulate falsifiable hypotheses, and compose rigorous experiments (before taking up lean startup) are more likely to avoid pursuing bad ideas longer than they should, and unpromising ideas.

Customers of course are the ultimate test. But listening to them prematurely - before a compelling theory of value is formed and testable hypotheses derived - may lead startups astray, or toward incremental value.

The authors suggest that instead of quickly focusing on low-cost MVPs and customer feedback, startup founders may find social proof a particularly important signal of value. Eg: funding sources, who join your startup, etc. However, they also note that public markets are poor at assessing truly novel strategies, and therefore alternative forms of validation and funding are needed.

The mechanism of self-selection (into and out of organizations) then is a powerful tool for not only assessing the prospects of organizations in decline, but also the viability and potential of nascent organizations and startups.

The most valuable entrepreneurial ideas are those that are unlikely to permit an easy, immediately recognizable experiment. They require some kind of contrarian belief, vision about and commitment toward a counterfactual world that may not easily be recognizable by other market actors.

My conclusion

If there is anything to take out from this paper, it is acknowledging lean has its limitations, as anything else. However, there are a few good points to notice:

Lean increases the value of existing products incrementally.
Startup founders need to look beyond existing products and realities.
Entrepreneurial exercise should begin by deciding what to look for not cataloging what you see.
The most valuable entrepreneurial ideas are those that are unlikely to permit an easy, immediately recognizable experiment. They require some kind of contrarian belief that may not easily be recognizable by other market actors.

Presenting at Huntsville National Cyber Summit

Khoi Nguyen — Fri, 06 Oct 2023 00:00:00 +0000

I am proud to have presented at Huntsville’s National Cyber Summit for the cybersecurity startup that I had interned with called Ossillate Inc.

We build a tool called Packj with a goal to stop Solarwinds, ESLint, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies (“weak links”) in your software supply-chain.

For me, I was fortunate to have this opportunity if not for my boss, Ashish Bijlani. While interning at Ossillate, I told him to sign up for NCS, which I thought could help the company to reach out to more customers. But not long after (maybe a few months) I finished my internship, Ashish reached out to me again to present at NCS for him, since it was a long trip for him to come to Huntsville and travel compensation was not provided.

So there you go, here are some photos of me presenting at the conference!

What are packet sniffers & how to use Snort

Khoi Nguyen — Tue, 03 Oct 2023 00:00:00 +0000

Content

Packet sniffers

How they work

Packet sniffers work by intercepting and logging network traffic via the wired or wireless network interface on its host computer.
Once the raw packet data is captured, the packet sniffing software analyzes it and presents it in a readable form so that the person using the software can make sense of it.

Ways to intercept traffic

Port Mirroring: Used on a network switch to send a copy of network packets seen on one switch port to a network monitoring connection on another switch port.

Network Tap: A device that allows you to monitor and access data that is transmitted over a network.

Tools To Perform Packet Capture

Wireshark
Tcpdump
Snort: a packet sniffer that monitors network traffic, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.

Snort

What it is

Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world.

Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.

Snort has 3 primary uses:

As a packet sniffer like tcpdump.
As a packet logger - which is useful for network traffic debugging.
As a full-blown network intrusion prevention system.

How it works

Snort works by taking in a text file - where you define all the rules - as an input, then Snort will act based on these rules.

The below picture shows you what makes a Snort rule:

_{Source: https://cyvatar.ai/write-configure-snort-rules/}

How to use

To use Snort, first I write my rule in local.rules file:

alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid:10000001; metadata:policy security-ips alert;)

This rule alerts me any icmp traffic on the network. Make sure to change Snort config file snort.lua to include the local.rules file.

ips =
{
  enable_builtin_rules = true,
  include = RULE_PATH .. "/local.rules",
  variables = default_variables
}

Then run:

sudo snort -c /usr/local/etc/snort/snort.lua -i eth0 -A alert_fast -s 65535 -k none

sudo: This command is run with superuser privileges, as Snort typically requires administrative access to capture and analyze network traffic.
snort: This is the actual Snort command-line tool.
-c /usr/local/etc/snort/snort.lua: This option specifies the configuration file for Snort. In this case, it points to the configuration file located at /usr/local/etc/snort/snort.lua.
-i eth0: This option specifies the network interface to monitor. In this case, it’s set to eth0, which is a common network interface name in Linux systems. Snort will listen on this network interface to capture network traffic.
-A alert_fast: This option specifies the alerting mode to use. The alert_fast mode is a more efficient alerting mode that quickly alerts on suspicious traffic without extensive packet logging.
-s 65535: This option sets the snaplen (snap length) for packet capture. It determines the maximum number of bytes to capture from each packet. A snaplen of 65535 means that Snort will capture the entire packet, up to the maximum allowed by the Ethernet frame size.
-k none: This option specifies how to handle sticky buffers. In this case, it’s set to none, meaning that sticky buffers are not used.

That’s it! Hope you enjoy this brief intro to Snort!

Windows logs vs Linux logs & how they help with Vulnerability Scanning

Khoi Nguyen — Mon, 02 Oct 2023 00:00:00 +0000

Windows vs Linux

Here’s a pretty simple to table showing the differences:

Windows	Linux
Proprietary	Free and open source
Graphical	Can be terminal only

Windows Event Log

Is an in-depth record of events related to the system, security, and application stored on a Windows operating system.

Event logs can be used to track system and some application issues and forecast future problems.

Event logs ensure our server stay available. Ensure our files remain untampered.

Main elements of Windows Event Log

Log Name: Name of the event log to which events from different logging components will be written. Events are commonly logged for system, security, and applications.

Event Date/Time: Includes the date and time when the event occurred.

Task Category: Identifies the type of recorded event log. Application developers can also define task categories to serve as extra information about the event.

Event ID: This Windows identification number helps network administrators uniquely identify a specific logged event.

Source: Name of the program or software causing the event log.

Level: Event level represents the severity of the recorded event log. These include information, error, verbose, warning, and critical.

User: Name of the user who logged onto the Windows computer when the event occurred.

Computer: Name of the computer logging the event.

Types of Windows Logs

Application: events related to a software/application.

Security: related to safety of system. Eg: failed logins, file deletions, etc.

Setup: occur during installation of Windows OS. On domain controllers, this log record events related to Active Directory.

Domain controller — a server that responds to security authentication requests within a network domain.

Active Directory — think of it as team grouping.

System: related to system & its components. Eg: failure to load boot-start driver.

Linux Event Logs

Kernel is the brain of the computer.

To view logs in Linux, here’re quite a few locations:

/var/log/syslog or /var/log/messages
- RedHat-based systems store info in the messages folder while Debian-based store in syslog folder.
/var/log/auth.log or /var/log/secure — authentication & authorization logs
/var/log/kern.log — kernel activity logs, including custom kernels.
/var/log/faillog — failed login attempts
/var/log/maillog or /var/log/mail.log — track issues like spam emails, suspicious use of postfix or smtpd.

Vulnerability Scanning

Enables organizations to monitor their networks, systems, and applications for security vulnerabilities.
Vulnerabilities can include (but aren’t limited to):
- Open ports
- Unpatched machines
- Out of date software
- SSL certificate anomalies
- Malware on a device

Remember to close unused ports for security!

Vulnerability Scanning & CVEs

Vulnerability scan may include CVE numbers in your results.

CVE: Common Vulnerabilities and Exposures — refers to publicly known system vulnerabilities.

In the world of vulnerability scanning, there are 2 main types of system.

Host-based Intrusion Detection System (HIDS)

This system is completely passive.

Analyzes traffic that passes through the network. If it sees something that is abnormal it’s going to send an alert.

Host-based Intrusion Prevention System (HIPS)

This system is active.

Monitors a single host for suspicious activity by analyzing events occurring within that host.

HIPS aims to stop malware by monitoring the behavior of code.

How to format a USB drive in Linux?

Khoi Nguyen — Fri, 29 Sep 2023 00:00:00 +0000

No BS. Just the terminal and straightforward steps to format a USB drive in Linux:

Locate the USB drive.
Unmount and format the USB drive.
Verify the process was successful.

1. Locate the USB drive

Use this command to locate your USB drive. In my case (when I plugged in my USB on my PopOS desktop), it is /dev/sda.

df

Man page:

df - report file system disk space usage

2. Unmount and format

We will use FAT32 filesystem, because it is ideal since it offers maximum compatibility on Windows, Mac, and Linux. To build FAT32 filesystem on your USB drive, run:

sudo mkfs.vfat /dev/sda

Make sure to use your location. I used /dev/sda because it is my location.

Man page:

mkfs - build a Linux filesystem

mkfs.fat - create an MS-DOS FAT filesystem

3. Verify the process

sudo fsck /dev/sda

Man page:

fsck - check and repair a Linux filesystem

A USB drive with no files indicates successful formatting. Something like this:

/dev/sda: 0 files, ......

DONE!

What is a network layer?

Khoi Nguyen — Mon, 25 Sep 2023 00:00:00 +0000

I am getting into Cybersecurity and trying to learn a few things about the fundamentals.

What is a network?

A network is a group of two or more connected computing devices.

Usually all devices in the network are connected to a central hub — for instance, a router. A network can also include subnetworks, or smaller subdivisions of the network.

Subnetworking is how very large networks, such as those provided by ISPs, are able to manage thousands of IP addresses and connected devices.

Think of the Internet as a network of networks: computers are connected to each other within networks, and these networks connect to other networks. This enables these computers to connect with other computers both near and far.

What is a packet?

All data sent over the Internet is broken down into smaller chunks called packets.

At the network layer, networking software attaches a header to each packet when the packet is sent out over the Internet, and on the other end, networking software can use the header to understand how to handle the packet.

A header contains information about the content, source, and destination of each packet (somewhat like stamping an envelope with a destination and return address).

💡 Protocol is an agreed-upon way of formatting data so that two or more devices are able to communicate with and understand each other.

OSI model

TCP/IP model

4. Application layer: This corresponds, approximately, to layer 7 in the OSI model.

3. Transport layer: Corresponds to layer 4 in the OSI model.

2. Internet layer: Corresponds to layer 3 in the OSI model.

1. Network access layer: Combines the processes of layers 1 and 2 in the OSI model.

Should you start a startup?

Khoi Nguyen — Sat, 24 Jun 2023 00:00:00 +0000

YC YouTube Video

Don’t worry about starting motivations. Curiosity is enough.
Worst case scenario analysis.
Find smart people to talk ideas with.
Turn ideas into side projects and launch them!
If you enjoy the process: make the jump!

Pivoting Out of a Tarpit Idea

Khoi Nguyen — Sat, 24 Jun 2023 00:00:00 +0000

YC YouTube video

What are tarpit ideas?

Tarpit ideas are ideas that people try but don’t pivot out quickly enough. It’s a cause of death for many companies.

Tarpit tends to be a great place to find fossilized remains. The reason is that tarpit resembles fresh water ponds so animals come across and get stuck, then die.

Tend to be consumer ideas

Why It’s Difficult

The bar is high. Founders don’t realize how good the current products are, or how many have been built and failed.

Timing

In 2000s, there was a boom in consumer products.

In 2010s, consumer mobile apps were booming.

Why They Don’t Work

The usual pitch: an app to discover new things …

Web3

Web3 opens up many possibilities that things can be rebuilt. However, these startups are pretty theoretical.

Eg: OpenSea is not theoretical at all. They have a product that’s easy to understand.

My Job Resources

Khoi Nguyen — Fri, 14 Apr 2023 00:00:00 +0000

As an international student from Vietnam studying in the US. I am currently pursuing a Dual Degree BBA in Computer Information Systems and BS in Information Technology at the University of North Alabama (UNA).

Throughout my time here, I have applied for a lot of internships, faced lots of rejections, and eventually landed some in the most unexpected way.

I will share with you some resources that has been useful to me along the way to pursue a career in the US.

Tips

Invest in yourself.

Buy reputable online courses & certificates to specialize your skills.
Post contents on LinkedIn, Twitter, YouTube, etc.

Post what you learn and don’t overthink it. Make sure you are providing values or showcase your knowledge.
Go to networking events, career fairs, and conferences.

In addition, you can reach out to professors and alumnis.

Luck matters! Don’t underestimate yourself! Try to increase your luck surface area. Check out this tweet on luck.

Tools

Symplicity - this link is for my school, but your university might have its own, or they might use the next one…

This is how I landed my first internship at GrubSouth!
Handshake - this site is good for job hunting. You can also chat with other students and recruiters.
LinkedIn - this is crucial. LinkedIn profile is your own brand. Don’t be shy to post!

This is how I landed my second internship (a Vietnamese startup) at Vucar. The founder actually reached out to me on LinkedIn after seeing some of my coding project videos!

I also landed my third internship (the most interesting one) at Ossillate. We had a chat before on LinkedIn and the founder reached out to me for a software engineering role.
Simplify - this browser extension helps you autofill job applications in seconds!
Work at a Startup - a job site from YC. Startups are always on the hunt!

I landed a gig doing bug hunting for a startup on this site.
Otta - they have a mobile app with Tinder-like UI (not that I use Tinder a lot) that recommends relevant jobs for you.

Curricular Practical Training (CPT) - for international students

Below is the process of applying for CPT at UNA. If you study at a different college, the process might be slightly different.

CPT is part of an established curriculum within a school so you have to register a course for it.
Two types of CPT:
- Part-time CPT: 20 hours or less per week
- Full-time CPT: 20 hours or more
  
  If you do 12 months or more of full-time CPT, you are not allowed to do OPT.

Instructions:

Talk to your employer and have them sign these forms:
- Have them write a formal job description including job title, job responsibilities, your pay rate, your start and end date.
- UNA Experiential Learning Program Memorandum of Understanding
- International Student CPT Authorization Request
Go to UNA Lion Jobs page and click ADD New to fill out the Experiential Learning experience/CPT. Upload the signed forms here as attachments.
Email instructor/professor of the internship course and have them signed.
Bring the signed International Student CPT Authorization Request form to your DSO.
Wait for approval.

Before the Startup

Khoi Nguyen — Fri, 24 Feb 2023 00:00:00 +0000

Paul Graham’s Before the Startup

1. Counterintuitive

Startups are so weird that if you trust your instincts, you’ll make a lot of mistakes. If you know nothing more than this, you may at least pause before making them.

You can, however, trust your instincts about people. And in fact one of the most common mistakes young founders make is not to do that enough. If you’re thinking about getting involved with someone — as a cofounder, an employee, an investor, or an acquirer — and you have misgivings about them, trust your gut. If someone seems slippery, or bogus, or a jerk, don’t ignore it.

2. Expertise

It’s not that important to know a lot about startups. The way to succeed in a startup is not to be an expert on startups, but to be an expert on your users and the problem you’re solving for them.

3. Game

Starting a startup is where gaming the system stops working. Gaming the system may continue to work if you go to work for a big company. Depending on how broken the company is, you can succeed by sucking up to the right people, giving the impression of productivity, and so on.

4. All-Consuming

Startups are all-consuming. If you start a startup, it will take over your life to a degree you cannot imagine. And if your startup succeeds, it will take over your life for a long time: for several years at the very least, maybe for a decade, maybe for the rest of your working life.

5. Try

Starting a startup will change you a lot. So what you’re trying to estimate is not just what you are, but what you could grow into.

6. Ideas

So if you want to start a startup one day, what should you do in college? There are only two things you need initially: an idea and cofounders. And the m.o. for getting both is the same. Which leads to our sixth and last counterintuitive point: that the way to get startup ideas is not to try to think of startup ideas.

How do you turn your mind into the type that startup ideas form unconsciously?

Learn a lot about things that matter.
Work on problems that interest you with people you like and respect.
Incidentally, is how you get cofounders at the same time as the idea.

Why to not not start a startup

Khoi Nguyen — Thu, 23 Feb 2023 00:00:00 +0000

Takeaway from Paul Graham’s Why to not not start a startup

1. Too young

When you’re a little kid and you’re asked to do something hard, you can cry and say “I can’t do it” and the adults will probably let you off. As a kid there’s a magic button you can press by saying “I’m just a kid” that will get you out of most difficult situations. Whereas adults, by definition, are not allowed to flake. They still do, of course, but when they do they’re ruthlessly pruned.
The other way to tell an adult is by how they react to a challenge. Someone who’s not yet an adult will tend to respond to a challenge from an adult in a way that acknowledges their dominance. If an adult says “that’s a stupid idea,” a kid will either crawl away with his tail between his legs, or rebel. But rebelling presumes inferiority as much as submission. The adult response to “that’s a stupid idea,” is simply to look the other person in the eye and say “Really? Why do you think so?”

2. Too inexperienced

The best way to get experience if you’re 21 is to start a startup. So, paradoxically, if you’re too inexperienced to start a startup, what you should do is start one.
I’d advise people to go ahead and start startups right out of college. There’s no better time to take risks than when you’re young. Sure, you’ll probably fail. But even failure will get you to the ultimate goal faster than getting a job.

3. Not determined enough

How can you tell if you’re determined enough, when Larry and Sergey themselves were unsure at first about starting a company? I’m guessing here, but I’d say the test is whether you’re sufficiently driven to work on your own projects. Though they may have been unsure whether they wanted to start a company, it doesn’t seem as if Larry and Sergey were meek little research assistants, obediently doing their advisors’ bidding. They started projects of their own.

4. Not smart enough

You may need to be moderately smart to succeed as a startup founder. But if you’re worried about this, you’re probably mistaken. If you’re smart enough to worry that you might not be smart enough to start a startup, you probably are.
If you don’t think you’re smart enough to start a startup doing something technically difficult, just write enterprise software. Enterprise software companies aren’t technology companies, they’re sales companies, and sales depends mostly on effort.

5. Know nothing about business

You don’t need to know anything about business to start a startup. The initial focus should be the product. All you need to know in this phase is how to build things people want. If you succeed, you’ll have to think about how to make money from it. But this is so easy you can pick it up on the fly.

6. No cofounder

Not having a cofounder is a real problem. A startup is too much for one person to bear. And though we differ from other investors on a lot of questions, we all agree on this. All investors, without exception, are more likely to fund you with a cofounder than without.

7. No idea

Find something that’s missing in your own life, and supply that need—no matter how specific to you it seems.

8. No room for more startups

Nearly everyone who works is satisfying some kind of need. Breaking up companies into smaller units doesn’t make those needs go away. Existing needs would probably get satisfied more efficiently by a network of startups than by a few giant, hierarchical organizations, but I don’t think that would mean less opportunity, because satisfying current needs would lead to more.

9. Family to support

What you can do, if you have a family and want to start a startup, is start a consulting business you can then gradually turn into a product business. Empirically the chances of pulling that off seem very small. You’re never going to produce Google this way. But at least you’ll never be without an income.

10. Independently wealthy

I’ve come close to starting new startups a couple times, but I always pull back because I don’t want four years of my life to be consumed by random schleps. I know this business well enough to know you can’t do it half-heartedly. What makes a good startup founder so dangerous is his willingness to endure infinite schleps.
There is a bit of a problem with retirement, though. Like a lot of people, I like to work. And one of the many weird little problems you discover when you get rich is that a lot of the interesting people you’d like to work with are not rich. They need to work at something that pays the bills. Which means if you want to have them as colleagues, you have to work at something that pays the bills too, even though you don’t need to. I think this is what drives a lot of serial entrepreneurs, actually.

11. Not ready for commitment

If you start a startup that succeeds, it’s going to consume at least three or four years. (If it fails, you’ll be done a lot quicker.) So you shouldn’t do it if you’re not ready for commitments on that scale. Be aware, though, that if you get a regular job, you’ll probably end up working there for as long as a startup would take, and you’ll find you have much less spare time than you might expect.

12. Need for structure

In a good startup, you don’t get told what to do very much. There may be one person whose job title is CEO, but till the company has about twelve people no one should be telling anyone what to do. That’s too inefficient. Each person should just do what they need to without anyone telling them.

13. Fear of uncertainty

Well, if you’re troubled by uncertainty, I can solve that problem for you: if you start a startup, it will probably fail.
No one will blame you if the startup tanks, so long as you made a serious effort. I asked managers at big companies, and they all said they’d prefer to hire someone who’d tried to start a startup and failed over someone who’d spent the same time working at a big company.
Nor will investors hold it against you, as long as you didn’t fail out of laziness or incurable stupidity.

14. Don’t realize what you’re avoiding

Software companies don’t hire students for the summer as a source of cheap labor. They do it in the hope of recruiting them when they graduate. So while they’re happy if you produce, they don’t expect you to. That will change if you get a real job after you graduate. And since most of what big companies do is boring, you’re going to have to work on boring stuff. Easy, compared to college, but boring.
The thing that really sucks about having a regular job is the expectation that you’re supposed to be there at certain times. Even Google is afflicted with this. And what this means, as everyone who’s had a regular job can tell you, is that there are going to be times when you have absolutely no desire to work on anything, and you’re going to have to go to work anyway and sit in front of your screen and pretend to. To someone who likes work, as most good hackers do, this is torture.
In a startup, you skip all that. There’s no concept of office hours in most startups. Work and life just get mixed together. But the good thing about that is that no one minds if you have a life at work. In a startup you can do whatever you want most of the time. If you’re a founder, what you want to do most of the time is work. But you never have to pretend to.

15. Parents want you to be a doctor

A significant number of would-be startup founders are probably dissuaded from doing it by their parents. One is that parents tend to be more conservative for their kids than they would be for themselves.
The other reason parents may be mistaken is that, like generals, they’re always fighting the last war. If they want you to be a doctor, odds are it’s not just because they want you to help the sick, but also because it’s a prestigious and lucrative career.

16. A job is the default

This leads us to the last and probably most powerful reason people get regular jobs: it’s the default thing to do. Defaults are enormously powerful, precisely because they operate without any conscious choice.

Startup at uni

Khoi Nguyen — Thu, 23 Feb 2023 00:00:00 +0000

Some time in 2021

Avish and I were aspiring entrepreneurs at the University of North Alabama. We met at the Generator — a facility for innovators, engineers, designers, etc. at our uni.

Around Sep 2022

We had an idea to work on NFC cards. We were surfing for a niche and decided to build NFC cards for student resumes since we had looked at Popl, Linq, Dot, etc. and thought the market for networking-type NFC was already saturated.

We came up with the name nTap. However, it matched with the stock ticker from the company NetApp so we spent 4 hours to find another name and decided to go with NFC Orange, then bought the domain nfcorange.com.

We applied to pitch at Idea Audition (hosted by Shoals Incubator) trying to go after the B2C and B2B model, and did not make it. However, we continued to work on our product.

Late Nov 2022

We were after the B2C model, trying to sell the cards to students and roaming around campus at night to stick flyers.

Late Dec 2023

We figured it was hard to go after B2C since they did not have the incentive to purchase the cards. We pivoted our product to B2B completely and decided that our uni should be our first customer.

It was difficult to talk to the head of the department so things got delayed and went downhill…

Christmas & New Year’s Eve

I was the sole programmer, so coding through the holiday was my motto.

Thanks to Mr. Steven Puckett, we built a NFC reader for recruiters that read our NFC Orange cards and save students’ info to their dashboard.

Feb 10 2023

We finally met with the Head of Sales Deparment and the Dean of College of Business and Technology at our uni to pitch him our product. They liked it and gave some feedback. The Dean said he would fund the project.

We took their feedback and after a week, we added new features.

Feb 21 2023

We purchased 100 printed NFC cards and they came out with the wrong color printed (this was the night before our first public launch). Avish was frustrated.

Later that night, some of the code did not work properly and a few hours spent fixing it. Then, we had to manually scan to write our URL to the NFC cards since we had not known how to do it more efficiently. We stayed up until 1 AM.

Feb 22 2023

We got 20 cards written for giving out.

4 PM: We did our first launch - a small one! A bit more than 20 students came to the info session. And, no one seemed to care about the color. They were hooked with the tech. So, game on until March 8th when we did our first NFC Orange reader trial with Boeing recruiter visit at our uni.

March 6 2023

We had another info session to distribute our NFC cards. This was the last session. I was in class hearing some friends talking about this digital resume cards. My expectation rose, not only me, Avish as well.

Here came 4 PM on a Monday. Two students came. We were disappointed as the Boeing Recruiter Visit was approaching. Not only that, our NFC reader was also unstable and loose. Need to fix it tomorrow with Mr. Puckett!

March 8 2023

The Boeing Recruiter Visit went well. One of the recruiters - Melissa Smalley — gave a compliment on the dashboard UI saying it was “user-friendly”. After that, we nervously waited for their feedback email and thought they might have forgotten. Finally, here is what they sent us.

After the feedback, we added the search bar and prepared to launch more features.

March 29 2023

Things slowed down again, but this time, it put our startup on the verge of collapse. Avish’s time was running out. He had to leave the US because of his visa expiration.

To go all-in, Avish and I sat down to craft our pitch deck and sent to VCs that could help with immigration.

We even built a company LinkedIn page and change our job title.

April 7 2023

We got rejected by Unshackled Ventures — the one we hope for the most.

April 9 2023

I think at this point, it is best to discontinue NFC Orange. We have had our ups and downs, however, these downs are still nothing compared to the real world.

Avish might go back to India and start something of his own. I will pursue something else, learn about a new tech.

And, we think this is part of entrepreneurship. You fail something, then you start all over again. The point is to keep trying and learn from your mistakes.

September 25 2023

At this point, it is confirmed that Avish has to go back to India. I do not think I have energy left to continue pursuing NFC Orange.

I joined Side Hustle Expo at our uni (we missed last time) to promote the product. Sold 2 cards. Got many rejections. That’s how it goes.

I will graduate in December 2023 and will be looking for a full-time job soon.

As an international student, it is either finding a job or going home to stay in the US (I have no plan to pursue a Master’s Degree), so I will spend more time on that.

November 12 2023

Today, I sent Avish a text message “im gonna open-source NFC Orange. Time to move on”. Yes, all the source code, all of our time and effort has been made public. You can view it here.

Avish agreed it was time to move on and texted back “I can try to keep the legacy alive.”

I believe the journey of our entrepreneurship is not over.

This is the end of my college startup journey. Stay tune for my startup journey!

How to get & evaluate startup ideas?

Khoi Nguyen — Thu, 23 Feb 2023 00:00:00 +0000

YC YouTube video

4 most common mistakes

Not solving a real problem.
- Do not make solutions in search of a problem.
- Fall in love of a problem → Find a high-quality problem.
Getting stuck on tarpit ideas.
- What causes tarpit ideas?
  - Widespread problem that lots of potential founders encounter.
  - Seems like it could be easily solvable with a startup.
  - There’s a structural reason why it’s very difficult to solve.
- How to avoid?
  - Google! Look for previous founders who have tackled this.
Not evaluating your idea.
Waiting for the perfect idea.

…your initial idea as a good starting point…ideas morph over time. - Paul Graham

10 Key questions to ask

Founder market fit
- Are you the right team?
- Pick a good idea for your team.
How big is the market?
- 2 good markets for startups: big now & small but growing rapidly.
How accute is the problem?
Do you have competition?
- Most good ideas have competition.
Do you want this personally or know people who want this?
Did this recently become possible or become necessary?
- Eg: Checkr (API for background check) took off when Doordash, Uber were hiring a pool of gig workers.
Are there good proxies?
- Proxy: large company that does something similar to your startup.
Is this an idea you want to work on for years?
Is this scalable?
- Software is highly scalable.
Is this a good idea space?
- Idea space: one level abstraction out from a particular startup ideas. It’s a class of closely related startup ideas. Eg: software for hospitals, etc.
- If you are in a good idea space, the success rate is astonishingly high. Idea space becomes hot and cold over time.

3 things that make an idea seem bad, but actually make it good

Hard to get started. Eg: Stripe
Boring space. Eg: Gusto
- The day to day stuff is gonna be the same anyway.
Existing competitors.
- Eg: Dropbox. When Dropbox was launched, there were 20 file storage companies. Dropbox found out that their UI suck. Competitors didn’t have a way to sync directly with the local filesystem.

Set yourself up

Become an expert on something valuable.
Work at a startup
Build things you find interesting. Eg: Replit

Generating startup ideas (ordered by most likely)

Start with what your team is especially good at. → Founder market fit.
Start with a problem you’ve encountered.

Think of every job you’ve had (+ internships + life experience) What are problems/opportunities you’ve been in a special condition to see?
Think of things you personally wish existed.
Look for things in the world that have changed recently. Eg: Gathertown - fun way to hang out online during COVID.
Look for new variants of successful companies. Eg: Nuvo Cargo - logistics/Flexport for LatAm.
Talk to people and ask them what problems they have.
- However, you need to have lots of skills.
- First, pick an idea space and talk to people within that space. Talk to founders in that space
Eg: AtoB.
1. They picked an idea space - Trucking industry.
2. Drove to truck stops and talk to potential users.
3. Asked other founders about the industry.
4. Evaluated several ideas before picking fuel cards.
Look for big industries that seem broken.
Look for a co-founder.

Antifragile

Khoi Nguyen — Fri, 20 Jan 2023 00:00:00 +0000

Don’t chase happiness. Become antifragile by Tal Ben-Shahar

What is antifragile?

There is this misconception of a happy life is that one should always be happy. However, learning to embrace and accept painful emotions is part of a happy life.

Antifragile means putting pressure on a system and make it grow stronger and harder. For instance, we, humans, are antifragile. Think when we go to the gym and lift weights.

On a psychological level, it is called PGT (Post Traumatic Growth). The role of science of happiness is to teach us what conditions we can put in place to increase the likelihood of growing from hardship.

From research by Iris Moss and others, it can be seen that happiness is a good thing, however, valuing it is problematic. So, the way to be happy is to pursue it indirectly. Here is the SPIRE model:

Spiritual: finding a sense of meaning in life, at work, at home.
Physical: reduce stress, do more recovery.
Intellectual: curious people tend to live longer and be happier. In addition, they’re deeply engaging with material (text, work of art, nature, etc).
Relational: quality time with people we care and who care about us.
Emotional: cultivate gratitude.

Antifragile: Things That Gain from Disorder by Nassim Nicholas Taleb

In reality, we cannot measure risk.

Nassim Nicholas Taleb used to work as an option trader, and option traders view the world in two dimensions: things that don’t like volatility and things that like volatility.

_{Fragile graph (source: Antifragille: Things That Gain from Disorder | Nassim Nicholas Taleb | Talks at Google)} _{Antifragile graph (source: Antifragille: Things That Gain from Disorder | Nassim Nicholas Taleb | Talks at Google)}

Here are some key takeaways from his talk:

Anthing organic communicates with its environment via stressors.
A system that works very well is a system that has layers.
- For instance, the restaurant business works well because they are fragile.
- However, in California (the epicenter of things), businesses strive because failure rates are converted into benefits for the system. → We should encourage entrepreneurs to fail, and remove the stigma.
- The reason we are healthy is because there’re fragile cells in us that break first under stress. → You always have the top layer require the fragility of a lower layer.

References

Don’t chase happiness. Become antifragile | Tal Ben-Shahar | Big Think

Antifragile: Things That Gain from Disorder | Nassim Nicholas Taleb | Talks at Google

My first Chrome extension

Khoi Nguyen — Tue, 03 Jan 2023 00:00:00 +0000

As I was doing my final project for Harvard CS50x, I decided to build a Chrome extension because, why not, I had never built one before so it would be a good learning experience for me.

Planning

As this was my first time developing a Chrome extension, I did not want to start with something big.

My principle: start small when you want to learn something.

I would like to keep it small and simple, and more importantly, it had to solve a problem that was relevant to me.

So I came up with an idea: a Chrome extension that notifies me to drink water while working (as I am too focus sometimes and forget to take a sip). I know it sounds simple, and there has to be similar extensions out there, but hey, this is for learning!

So this blog post will guide you through my thought process.

Development

So the goal was to build an extension that sent me a notification to take a sip every 15 minutes.

Building the user interface was simple. The popup used basic web technologies such as HTML, CSS, and JavaScript.

While developing, I encountered a problem. If the extension popup disappeared, the timer would restart. In order to avoid this, a script called background.js running in the background would help. However, the script had to be defined in manifest.json :

"background": {
    "service_worker": "background.js"
}

To use the notifications feature, you have to declare it in manifest.json as well:

"permissions": ["notifications"]

In the end, manifest.json should look like this:

{
  "manifest_version": 3,
  "name": "Sip & Work",
  "description": "Helps you stay hydrated while working",
  "version": "1.0",
  "action": {
    "default_popup": "popup/popup.html",
    "default_icon": "images/icon-128.png"
  },
  "icons": {
    "16": "images/icon-16.png",
    "32": "images/icon-32.png",
    "48": "images/icon-48.png",
    "128": "images/icon-128.png"
  },
  "permissions": ["notifications"],
  "background": {
    "service_worker": "background.js"
  }
}

Production

To use this locally, you can:

Go to Manage extensions in your browser and turn on Developer mode.
Then, click Load unpacked and you should see it in your extensions.

To make it publicly available for everyone to download from the Chrome Store, you first have to register as a Chrome Web Store developer that requires paying a one-time registration fee. After that, follow these steps here to submit your extension for publishing.

Source code

GitHub - KhoiUna/sip-and-work-extension: Chrome extension that reminds users to drink water every 15 minutes

Resources

Extensions - Chrome Developers

Declare permissions - Chrome Developers

Manifest file format - Chrome Developers

Manage events with service workers - Chrome Developers

Strategies for ICPC

Khoi Nguyen — Tue, 20 Dec 2022 00:00:00 +0000

International Collegiate Programming Contest (ICPC) is an algorithmic programming contest for college students. Teams of three, representing their university, work to solve the most real-world problems, fostering collaboration, creativity, innovation, and the ability to perform under pressure. Through training and competition, teams challenge each other to raise the bar on the possible. Quite simply, it is the oldest, largest, and most prestigious programming contest in the world.

As I am about to participate in my first ICPC, I think it is a good idea to learn some strategies from the best. Here is my summary after watching Day Zero: Strategies from MIPT Coach Mikhail Tikhomirov.

Read the statement carefully. Don’t rush to code!
Don’t submit right away! Always test before submitting.

Go slow and steady.
A computer time is spend when you work on one problem and your teammates work on the others.
Communicate with your teammates as much as possible.

Sometimes all you need is an outside view.
Proper training schedule is important. Have at least one training per week.

Steady schedule > lots of training.
Good to have a coach.

The Optimal Morning Routine

Khoi Nguyen — Fri, 18 Nov 2022 00:00:00 +0000

I have recently watched a video by @AfterSkool on how to have The Optimal Morning Routing.

Here is what I learn:

The number one important thing is sleep. You should try to get good sleep 80% of the time.
Get natural light in your eyes within 1-hour of waking up
- Try to get 5-10 minutes of sunlight in the morning.
- This sets your level of alertness, focus and mood.
- You need photons in sunlight. The light from your digital device is not enough.
- This triggers dopamine — which drives motivation, craving and pursuit. Dopamine is not a molecul of pleasure.
Delay the intake of caffeine 60-90 minutes after waking up.
Excercise: hydrate and train to clear out adenosine.

💡 Try to increase your body temperature during your time awake. Eg: cold shower can increase your body temperature.

Lessons learned from web designing for a small company

Khoi Nguyen — Thu, 03 Mar 2022 00:00:00 +0000

TL;DR

My friends and I created a website for a small business. Here are some things I learn:

Looking into the company’s current tool
Leverage the web editor’s template
Goals can change

I have recently had a chance to work with a small company to develop a website for them. With a team of 3 people, our goal was to ship the website as soon as possible (during 1 month) under the budget of $200.

This is our first time to do something like this. Therefore, drawbacks happenned. If we were to start again from the beginning, here are what we should have done.

Looking into the company’s current tool: Instead of spending time picking a better web editor, we should have utilized the company’s current tool, in this case, Wix. In the beginning, we spent too much time comparing what advantages other editors had. However, in the end, we chose Wix, because after taking a look at the company’s billing history, we noticed they had already purchased a 2-year plan. Plus, it would be easier to use Wix in the beginning, since they had their domain set up on Wix so we would not have to deal with transferring domain later.

Leverage the web editor’s template: We should have taken a look at the editor’s pre-designed templates before designing our own. Templates is a fast way to make a website good-looking. After that, all we need to do is fill in the images, words, and contents written by the company.

Goals can change: Initially, we set deadlines. But we had to have the flexibility to change goals. Sometimes things will not work out right. For instance, client’s slow response, the mistakes we make along the way. The flexibility will give you ability not to judge yourself, and also the efficiency to move forward.

In the end, with lots of learning, we got the $200 check and would give ourselves a happy dinner.

First failed investment

Khoi Nguyen — Tue, 25 Jan 2022 00:00:00 +0000

First of all, I want to say that I am not a financial advisor or an expert and this blog is basically my opinion about the stock market. Now, here is my story!

I am from Vietnam. I came to USA to study abroad. One of the things that I really want to do when I come here is to buy stocks. After the first semester studying here, finally, I found myself a part-time job. It was great news! I got my SSN and opened an account on Robinhood. I was so excited, but, to be honest, I had little knowledge about investing at that time. My knowledge was what stocks were, and I “taught” myself by watching some stock trading videos on YouTube, which was totally useless! I did not know finance or accounting or any kind of fundamental analysis. I had with me 2 books about stocks at that time, which were “Market Wizards” by Jack D. Schwager and “How to Make Money in Stocks” by William J. O’Neil, and I did not finish reading any of those 2 books.

So the time I started was in the beginning February, which was prior to the moment COVID-19 hit the whole world. I deposited $100 to Robinhood. The first stock I bought was Softbank, which I bought based on my belief for its CEO Masayoshi Son. I also bought Virgin Galactic stock after it had crashed from its high $42. Basically, after that I was frustrated and sold everything. Then, I read some article on Investopedia about inverse ETFs. I bought one and recovered my small losses.

After these unfortunate events, I pushed myself to do more research. I tried to learn the CANSLIM strategy from the book “How to Make Money in Stocks”. Then, I bought $DELL and $YUMC. I made some profits. I became more confident and deposited more to my account. During that time, I made about $300 when the market hit all-time high. I got $AMD in my portfolio at that time, and it also rose to all-time high. I was a genius, I thought.

Then, things started to turn around. I started to try stock options. I got lucky when I bought puts on $INO. I made a great sum from it. After that, the market stopped going up and started correcting itself, which was around beginning of September. I thought it was temporary and bought more shares on $XLK. It continued to go down. CNBC said it was the tech sell-off! Then, I sold all $XLK, which was basically erasing all my profit since I bought it during the summer. Not only that, I started to be aggressive on my account. I bought puts that were following no rules or disciplines. Since, I washed all my profits that I gained from the market recovery. Here’s the picture of my portfolio for you guys to see.

Lessons from developing an app for my university

Khoi Nguyen — Mon, 24 Jan 2022 00:00:00 +0000

TL;DR

I build an app for my university. Here are some things I learn:

Focus on minimal UI.
Utilize UI library.
To maximize speed, prioritize usability over scalability.
Pick a tech stack that you are comfortable with to build the product faster.

Building an app for my university is my first attempt to make a product for more than 200 users. Not a lot since the app is only used by a small group of international students on campus.

The app is a student engagement tracking app. However, it is still simpler than that. The purpose of the app is for students to upload their selfies taken at events, and in return, they will have a signature or a proof of participation which is given by the navigators - the ones who help manage international students.

Anyway, before building an app, you should ask yourself why. How can it improve the experience for the targeted users? In this case, I know this app will save a lot of time. Before this app, most of the things were done on paper. Students took their photos, brought them to the office, and showed them to the navigators. Navigators will then give them a signature on paper which they had to keep and tried not to lose it. With this app, students do not have to carry their signature sheets around. And, navigators do not have to deal with students coming to the office and give them the signatures. Additionally, the number of international students coming to the university was expected to rise.

When making this app, there are 2 sides I have to focus on: the navigators and the students. I have to design a simple user experience for navigators to easily approve or reject students’ submissions. And for the students, a single page where they can submit their photos without logging in so they do not have to deal with the hassle of creating an account and forgetting their passwords.

It was winter. And new students were supposed to arrive during the spring around January. I started developing the app around November. However, I wanted to build fast, get feedback from navigators, and iterate.

My initial step was planning:

Sketching the user interface to get the basic components of the app.
Think of what kind of data the app will display.
Design the databases and relationships.

My second step was coding the app’s UI:

Focus on minimal UI. Don’t spend time trying to add a hover effect on a button.
Utilize UI library (I used Material UI) to avoid writing CSS code.

The third step was building the prototype to show it to the navigators. I did not even use any database for this:

I coded a little bit of Express and Socket.IO for the backend.
The uploaded image was encoded to base64 and would be sent through the socket.
On the admin page, I received data sent through the socket and stored it in the browser’s local storage.

A prototype was made with not much coding!

After getting feedback and iterating the MVP, it is time to move to the next step: code the complete product! Here are some things I notice:

To maximize speed, prioritize usability over scalability. In this case, I know my users are a small group of international students and the information I am collecting is not sensitive so there are no reasons to implement a bunch of security measures.
Pick a tech stack that you are comfortable with to build the product faster.

After the launch, it was thrilling to see people start using what you had built. But problems would arise. For instance:

Students use different phones. And the app won’t work on some phones or browsers. One thing I remembered was that my website was blocked by WeChat’s in-app browser saying that “This is an insecure website”.
Some students want to see their submissions even though they are yet to be approved. So I put a text after they submit to tell them to wait for the approval. However, it was not read or ignored by some students probably because the text was green.

So the lesson here is there will always be incompatibility somewhere along the road. And there will be ways to get around with it. Design is important, in this case, text placement, and color.

In the end, the great thing after all of this is that I gain more experience as a developer, also as a designer. Another thing is, not trying to show off but, I was offered a $500 scholarship for the service.

Resources

GitHub | Global Lions Community Super App for University of North Alabama