Blog
Engineering, product, and public-sector notes on the DevOps execution layer.
Security comparisons of Git and SVN mix two separate questions: where the repository runs and what gets replicated to developers. Using official documentation, this post compares five items in a table (internal hosting, local copy scope, per-path read separation, egress, access revocation) and ends with a checklist for a source control security review.
John Baek
Asked whether Git can run in a closed network at all, I checked the official docs, government announcements, and procurement records. The answer is yes, internal-network Git can be operated safely. Here are the evidence, the two design decisions that make it so, and a question list for security reviews.
John Baek
There's a question we get in almost every public-sector meeting. We lock a file before we touch it — so how does your solution work? On the difference between lock-based and branch-merge models, how control survives without locks, and a migration path that doesn't throw away history.
John Baek
The answer we give institutions that want a PoC but have no GPUs. Only the agent needs GPU; everything else on the platform runs on CPU servers. How the 30-day PoC actually proceeds, how much of document generation is really automatic, and why "we should validate fit before adopting" is exactly right.
John Baek
In the meeting, my answer was "it has more collaboration built in." Not wrong, but empty. Here's the honest version — where SVN and TortoiseSVN are genuinely good, what exactly differs in version-control terms, and why what we sell is a property, not a feature list.
John Baek
A division head at a public agency told us. Why do we run SVN? Even when our own people complain, we keep it because it's stable. Stability comes first. That is the reference. On how public-sector adoption decisions actually work, and what a vendor should do about it.
John Baek
Treat ISO 27001 as a *paperwork project* and you'll quit at month six. The certification reshapes *how the org operates*. A realistic guide for small teams.
John Baek
Zero Trust assumes *no perimeter*. Air-gapped networks assume *strong perimeter*. They're not in conflict — *zero trust within the perimeter* is the answer.
John Baek
Customers may have *no Kubernetes, no infra expertise, no matter what existing systems they run* — we still need to deploy. The five environment classes from 17 PoCs and the path into each.
John Baek
Six months of rebuilding our system to use *only FIPS 140-3 validated cryptography* for one US federal customer. Time, money, and political cost.
John Baek
Implement the financial *four-eyes* control by the book and *the deploy pipeline stops*. Four patterns that actually work, observed across six banks.
John Baek
GitOps stands on the proposition that *git is the single source of truth*. Some K-ISMS controls collide with that proposition directly. Six points and the workarounds.
John Baek
I've been close to 19 cloud migrations in public sector and finance. Six finished on time, five never finished, eight in between. The eight had the same five things break in the same order.
John Baek
