>> I think most people involved in security get
attracted to it because there's
a bit of them that likes breaking things.
I think that this is even the science developers, like developers,
probably as children pulled their toys apart to
see how they worked. My name is Troy Hunt.
I develop security software
and I built a little website, called Have I Been Pwned.
A launch, urbane pined in December 2013.
Within weeks, it just took on a life of it's own.
One of the things I did very early on,
is just optimize as far as I possibly could.
Say everything from caching as much content as I possibly
could through obviously reducing the overhead on all the requests.
I had things like Autoscale configured on the app service.
If my CPU goes beyond
the certain amount for a certain amount of time,
then I'll get another instance.
I'll keep adding these logical units
of service so it would scale, which is great.
Then I had cases like there was
a TV show in the UK ran at prime-time.
Have I Been Pwned on it,
and my traffic just
increased hundreds and hundreds of times over in
the space of seconds and I got smashed and I lost requests.
I just couldn't deal with it.
The thing I couldn't escape is that whilst I
was constrained by Autoscale and an app service,
and whilst I needed to see
resources utilized to a certain amount
before I added a lot more resources,
I was always going to have this problem.
Ultimately the solution came via functions,
so I've been moving a huge amount of stuff from
APIs running the app service through into functions.
By running serverless,
suddenly you have a scale which is not bound by
any logical infrastructure over the top of it.
Here's the secret behind Have I Been Pwned.
The objective wasn't just to build
a data breach notification service.
The objective was to build
a data breach notification service and to play with Azure.
There's a few key things that I look for in the dashboard.
I want to say things like,
how's my infrastructure performing a lot less
important on functions because they
just scale and perform beautifully regardless.
But particularly on like my app service,
how much of my CPU am I using?
Am I going to need to scale into a new instance.
On my SQL geodatabase I want to know how many DTUs I'm using,
because if I start maxing out those DTUs,
I might need to go in and scale it up myself.
Even for things like functions which
scale almost endlessly, I still want to see traffic,
so I want to see at a glance,
is there something going on with
Have I Been Pwned that's just driven
a massive amount of traffic to the site
and I can see that immediately on the graph.
The single best decision I made in some of the services to
use at the beginning of
Have I Been Pwned was to use table storage.
This is where the bulk of the guts of the data is.
There's 5.5 billion records sitting here in table storage.
It's not the only storage constructor there is,
I use SQL Azure as well.
In SQL Azure what I've got is things
like data loads and notification users.
The app service is a website and then
increasingly what I'm doing is I'm
shifting stuff down into functions.
Then when these functions are executed,
functions are talking to a combination of SQL Azure.
Plus of course, when you actually search for
someone that needs to get a table storage and
then the Redis cache is
storing a bunch of things like a list of the breaches.
One of the things I'm trying to do without at optimizing Azure
for just massive amounts of API consumption is move
as much traffic as I can from the origin site in Azure and
push it back towards
the customer because that keeps a lot of traffic off my origin.
Let's me scale more,
it also means people get requests returned in a super fast way.
Cloudflare sits in front of all my Azure things between
the consumers of the service and
the actual service running in Azure.
When someone loads the homepage,
Cloudflare normally doesn't have to
go to the app servers and pull it back.
Cloudflare it turns from cache,
rather than having to go to the origin,
the users then go down and they say,
I would now like to do a search for my e-mail address.
It's going to go through the Cloudflare.
It's going to get down into functions.
Functions is going to pull a combination
of data from Table Storage,
which is where the e-mail address exists and
it's also probably going to pull it from Redis
in order to get a list of which breaches that the individual
has appeared in and all the metadata around it as well.
It's amazing to look at how much open source have changed
and particularly Microsoft's attitude towards open source as well.
Open source all might seems to be
this very empowering movement that's
given everyone the ability to participate in software,
either it's consumers or contributors.
All of the work I do with Have I Been Pwned is in Visual Studio.
It's in there as ISP.Net projects and Azure Function projects.
There, a whole bunch of supporting projects for
console apps and things like that
for discrete little tasks that I run.
I do all of that in Visual Studio,
but I've also been using Visual Studio code
for things like managing the template for my blog.
That's also what I'm using to teach my son
to learn how to build web pages because it's
a great way for kids to learn as well.
One of the things that had always driven me since
the mid '90s when I started building software for the web,
is it's always this dream of I can go and build something myself.
It's just on my spare time and it can be something massive.
It can reach millions of people.
It can be up there on the web and fundamentally change the way
people work or the way they check their exposure,
data breaches or whatever it my be,
but you can do it with just about nothing.
Still to this day, this totally amazes me.