Le 1er mai est un moment fort de solidarité entre les travailleuses et travailleurs. Je me demande si les nouvelles formes de travail qui mettent à distance vont ébranler cette solidarité qui a permis d'importants gains par le passé. Aussi, la capacité de mobilisation risque-t-elle d'en pâtir?

#MainDOeuvre #Travail #RelationsDuTravail #Syndicalisme #Syndicats #Travail

Contrairement à ce que l'on croyait du côté patronal, le travail à distance ne nuit pas à la productivité. Ce serait même le contraire, selon cette étude. Rassurées, les entreprises et les administrations publiques seront possiblement plus ouvertes qu'elles ne l'étaient avant la pandémie.

Quoiqu'une autre étude soulève un effet négatif du travail à distance. Selon cette étude qui portait sur la collaboration entre scientifiques, la collaboration en personne a réellement produit plus de percées que celle à distance. Le travail à distance entraverait l'innovation.

Au-delà de ces considérations patronales, l'augmentation du travail à distance pose des défis aux syndicats.

D'abord , peut-être une bonne nouvelle. Ce n'est pas parce que tu travailles à distance que tu peux enfreindre les règles anti-briseurs de grève. La décision a toutefois été portée en appel. Aussi, un jugement contradictoire dans une autre cause fait en sorte que la jurisprudence est encore à établir.

Là où ça se complique, c'est de savoir si une employée travaillant à distance depuis le Québec pour une entreprise américaine est protégée ou non par les normes du travail du Québec.

Cette cause et même la précédente posent la question de savoir si le domicile d'un·e employé·e peut ou non constitué un établissement de l’entreprise.

L'Alliance de la Fonction publique du Canada qui représente de nombreux travailleurs et travailleuses en télétravail se sent particulièrement interpellée par cette question.

L’actualisation de la notion d’établissement est essentielle pour empêcher l’employeur de contourner les dispositions anti-briseurs de grève et protéger le plein exercice de la liberté d’association et du droit constitutionnel de grève. Notion d’établissement en télétravail : l’AFPC-Québec se tourne vers la Cour d’appel

Le 16 mars dernier, je faisais par de trois défis pour nos syndicats, mentionnant celui de revitaliser les stratégies et les pratiques syndicales.

En 2022, c'est plus de 35% de la main-d’œuvre (syndiquée ou non) qui a fait du télétravail selon une analyse de Statistique Québec (pdf), qui ajoute dans la conclusion de cette analyse constater «un engouement marqué pour le télétravail chez les personnes qui occupent un emploi qu’elles croient pouvoir exercer en télétravail».

Je n'ai pas trouvé d'étude québécoise sur le défi de mobiliser les troupes dans un contexte où il se fait du travail à distance. En France, une étude récente s'est intéressée aux effets du télétravail sur les collectifs syndicaux, du côté des élu·e·s, des militant·e·s et des adhérent·e·s et de leurs relations aux salarié·e·s et aux directions.

L'étude n'a pas pu conclure dans un sens ou dans l'autre, sur la capacité du syndicalisme de créer et faire vivre des collectifs syndicaux, et de faire perdurer ou approfondir des liens forts dans un tel contexte.

Ce qui est certain cependant en ce qui concerne le Québec, c'est que les jeunes sont moins syndiqué·e·s et attachent moins d'importance à la fidélité envers leur employeur.

À cela s'ajoute la difficulté de syndiquer les personnes qui occupent un emploi atypique dont la part dans l’emploi total a considérablement augmenté dans les dernières décennies pour s’établir à 32,5 % en 2022, selon l'Observatoire québécois des inégalités.

Non seulement mobiliser les troupes, mais aussi syndiquer les personnes qui ne le sont pas est affecté par les changements dans le marché du travail.

Bon 1er mai!

Late afternoon Wednesday and I'm enjoying a peaceful day.

Last night's full sleep was the best I've had in I don't know how long. Slept solidly from the moment head hit pillow until the 1st alarm sounded this morning.

Tempted to start cross-posting these micro-blog posts to my Telegram Channel where comments are allowed. Wonder if that will generate any kind of a response.

posted Wednesday, May 1, 2024 at ~3:47 PM #QNMAY2024

Good evening ! This type of week with a day off in the middle is exemplary. A red day; the labour day: the very reddest of red days, suits me just fine.

Blood red.

I am feeling confidence now. I will dance to my own tune. I do not need to seek validation for my feelings from outside sources. I am not fazed so easily.

Feeling like a colossus both physically and mentally bodes well for the future.

I hope these feelings aren’t just from the bubble wine I had for dinner.

Anyhow I shall relish it now. Some days are good and others are bad.

It’s the yin yang.

I had a somewhat special experience today. The bus was crowded and people kept pushing into us when I noticed that you were crying because you were feeling unsafe and overwhelmed.

I tried to hold some space for you and make sure that you and our baby are safe, and more clearly than I remember from any other time I felt as if you are a part of me.

It's good to be home again. Settling back in was a blur of grocery runs, laundry, and oddly timed naps as my body slowly came into sync with Pacific Time. Seattle is still Seattle. Yesterday we went to the waterfront park and after picking around the slippery rocks at low tide I spotted some tiny crabs and a long-abandoned limpet shell. On our way home, a guy on a double-height unicycle pedaled up the gravel incline toward the sculpture park before hopping over onto a thin concrete rail, arms out, calves churning madly like he might die if he slowed for a single second. This morning, during our morning walk a not-quite-all-there fellow stood on a street corner, jamming to music and wearing a three-foot orange traffic cone on his head. Seattle is still Seattle, and this cheers me up. The trees along Second Ave are leafy and getting greener by the day.

Getting Settled

Work is so much more comfortable with a desk and a proper chair! As much as I love our long 'snowbird' trips overseas, my writing definitely came in fits and starts these last few months. I had some mega-productive days, but plenty of zero days too. At home, it's easier to slide into a groove, and that groove exists with my butt in the same chair, and with a computer monitor I don't have to squint down at. My spirit may be seventeen but my eyeballs are every second of forty-five and getting fussier by the day.

Analog Dreams

This morning, I took my battered travelers journal and treated the leather. I pulled the shaggy, well-used pages out and replaced them with empty inserts, ready to be filled. I emptied out my sticker pouch, sharpened my pencils, and refilled my fountain pen. After two years of dithering, weighing the pros and cons, I ordered myself a dumb phone, taking one more step away from distraction in my daily routine. A smartphone is pretty much compulsory during overseas travel, but now that my world is getting small again, I have the freedom to be my weird self. Give me a paper journal, and a flip phone, and a wristwatch, and I'll be the happiest of campers.

Well, I'll see how it goes.

At risk of sounding hipster, I think it's important for artistic people to disconnect from the zeitgeist and develop a unique perspective and inner world. We need to cultivate our own minds, not live within a set of reactions to whatever happens to be trending today. Boredom is so frigging helpful, and I need to get in the habit of being bored more often. Hence, the dumb phone.

Oh, I'll still be an internet user, watching movies, reserving books from the library, and hopping online for chit-chat and buffoonery with my IRL friends and buddies on Mastodon. But at the same time, I want to shift the bulk of my day into the pre-internet, offline world, if that makes any sense. When I'm home, I like to use my physical dictionary and and offline copy of Wikipedia while I work. There's something oddly satisfying about unplugging. I can't quite put my finger on it, for in a way, it feels like a very silly idea. Yet if it works for me, why not?

Okay. It's time to slap this puppy on the blog and get back to work. Have a good one!

Into the book, I go.

💬 on Mastodon

#today

Background

Over the past year, I have been supporting a client with a multi-tenant application focused around data analytics. This article outlines some of the hurdles that were faced around Azure SQL Server when applying Defense in Depth security principles.

Note: The architectural decisions around the multi-tenancy aspect of the application was not designed by me, nor is is not under my control. My remit was to secure the application without significant design changes.

Architecture

This is a simplified architecture diagram of the product, with only the relevant elements included.

Data is pulled from the customer environment and stored within Azure SQL Server in the provider's tenancy. A PowerBI report is published to the customer's PowerBI App Service, which reads and visualizes data from the Azure SQL Server.

Problem

As part of regular security screening using the CIS Microsoft Azure Foundations benchmarking, it was identified that the Azure SQL Server had the following tick box enabled:

The documentation from Microsoft explains further:

When looking at this rule within PowerShell, it shows as 0.0.0.0/0!

Although the Microsoft Learn documentation says this is ONLY Azure IP Addresses, as a network guy, this screams to me says “everything”. Because we are applying defense in depth techniques (thus we cannot rely just on authentication alone), and this database contains customer data (with potentially PII within it), this checkbox needs to be disabled. Easy! ... well.... is it?

Options

Keeping in mind the requirement to have it as a multi-tenancy application, there were a number of options available (in order of least effort):

1. Programmatically get the PowerBI IP Address Ranges, and populate into ASQL Firewall Rules. Then disable “Allow Azure services and resources to access this server”.

2. Migrate the Azure SQL Server (ASQL) to Azure SQL Managed Instance(MI) or a Virtual Machine (VM). Apply a PowerBI Service Tag to the associated Network Security Group(NSG).

3. Implement Azure Firewall, connecting to a Private Endpoint on ASQL. Include an NSG on the Virtual Network to only allow IP's from PowerBI using it's Service Tag and\or put the Service Tag within the Azure Firewall rule.

4. Install Data Gateway in the Customers tenancy on Virtual Machine with a static Public IP address. Whitelist this IP Address in the ASQL Firewall Rules.

5. Use Virtual Network Gateway between customer tenancy and the service providers tenancy.

Let's run through these:

Option 1: Programmatically get PowerBI IP Address Ranges

This option involved getting all PowerBI Address ranges, and programmatically putting them into the ASQL firewall. This felt like a good solution – although not perfect, we are dramatically reducing the attack surface to just PowerBI App Service.

Firstly, before we write a script – let's get the JSON file from here, and then see how many address ranges there are for PowerBI to see if it's viable:

Well, this won't work, as there is a maximum of 256 rules for Server-level IP firewall rules.

Result: ❌ Rejected

Option 2: Use Virtual Network Gateway

This was a wildcard option – it would require work on the customer's tenancy side, and thus it was rejected quite early on, for the reasons that we should solve this project and secure the database with as little effort on the customer's tenancy as possible.

This involved using the Virtual Network Gateway and creating the relevant rules in the ASQL firewall to allow access from the customer's tenancy.

This article outlines more about how to achieve this, however for our requirements, it would be slightly different to their first diagram.

Result: ❌ Rejected

Option 3: Data Gateway in Customer Tenancy

Although this would technically work, it's additional resource that would require maintenance and additional resources at the customer's tenancy. For this reason alone, in a similar vein to Option 2, it was not a viable option for this issue.

Result: ❌ Rejected

Option 4: Migrate to Azure SQL MI / VM

There was feeling that this would work, however we were keen to move to PaaS services where possible. It was felt that running SQL Server on a VM would be a backwards step, as all the maintenance elements of running an VM would be required. The Managed Instance option was also possible to reduce these maintenance aspects, however it did come at quite a high cost. At this stage this option was rejected, how it was noted that this maybe revisited at a later time in the project.

Result: ❌ Rejected

Option 5: Implement Azure Firewall with Private Endpoints

This looked the most promising and following discussions with Microsoft, this was a strong contender, despite it not being their recommended solution. A Proof of Concept was set up in the following design:

This enabled us to access the database through a new hostname – customer.saasprovider.tld. When using SQL Authentication, it was important to pass the username including the server name:

sysadmin@customerdatabase.database.windows.net

To ensure only PowerBI endpoints could access the database, we added the Service Tag for PowerBI to a rule within the NSG.

It did not work! 😱 We had a suspicion that this was because the traffic was originating not from one of the IP addresses contained within the Service Tag. We were close.... When checking the documentation it stated that “Note: does not include frontend endpoints at the moment (e.g., app.powerbi.com).”. When raising this with Microsoft, they did not confirm or deny this, however they did outline the main cause of the issue. As the traffic was traversing Azure Firewall, it was being NAT'ed, therefore the source IP address accessing the ASQL private endpoint was not that of PowerBI, it was the internal IP address of the Azure Firewall! 🤯

Microsoft's suggestion was to add all the PowerBI IP address ranges into an Azure IP Group, and bind that to the relevant rule in the Azure firewall. We dutifully created an Azure Automation job to get the latest IP Addresses from the JSON file in #1, and populate an IP Groups object with said IP address. This worked a treat, however it was noted that Azure Firewall and IP Groups (to date) does not support IPv6 Addresses.

This finally looked like it was going to work! We started to plug in our PowerBI test report into the PoC and started configuration. Authentication was failing during the publishing phase from PowerBI to the PowerBI App Service. It appeared that when passing in username@customer.provider.tld failed, as ASQL had no understanding of that username. ASQL was expecting to see username@customerdatabase.database.windows.net, however we couldn't pass that username through as the ASQL Server was not available on the public internet!

At this point, we also discovered that even if we did run SQL on an Azure SQL Managed Instance, we would have exactly the same problem around authentication, thus option 4 was rejected again (and with confidence it would not work, even if the budget was appoved).

Result: ❌ Rejected

Next Steps

During the conversations with Microsoft, they suggested two more options:

• Use Semantic Model Sharing
• Power BI Embedded

Semantic Model Sharing although appeared to be a viable option, the lack of automation options around our DevOps deployment processes along with increased support administration also made this not a viable option. This is because we would have to share the semantic model with specific users, and thus they would need to be created as Guest Users within our EntraID.

Conclusion

This investigation took approximately six months, and included multiple scripts, proof of concepts and conversations with Solution Architects from Microsoft to help us meet the requirements of allowing access to Azure SQL Server in a multi-tenancy environment.

After discussions with senior management, the final result and conclusion was that the product should be re-architected so the report is published to the provider's tenancy, with a strong possibility of using PowerBI Embedded to surface this data via a web portal. This re-architecting is currently underway and being designed appropriately. In the meanwhile, we've learnt a huge amount of knowledge around how to secure Azure SQL Servers, which will do us in good stead moving forwards as other services and products are migrated from SQL Server on virtual machines or on premise. Hope you have learnt something too!

I was nervous about coming home, but things feel right. The weather is warm… People are out. Seeing friends has filled me up. Something to hold on to when I return to work next week.

It’s May. My birthday is at the end of the month and I have celebration plans for the first time in a very long time.

Thanks M for this

Someone mentioned that the highs are higher and the lows are lower when you do things alone, so I’m intentionally trying to break out of “independent woman” persona. Softness is in. And you know what else is in? Having two boyfriends (I’m seeing Challengers tonight).

Proud of myself for making this meme

---

Apartment nooks are coming together

The kids are alright.

I was really touched by this person who made their own sign for the rally. Solidarity doesn’t take much.

D’s bees

Day trip to the beach with the boys

#nahzhluhlog

There is an interesting flavor to being alone again. My attention is completely free and I notice more things, I also don't have to worry about more than my own safety. If I need to cross a busy road on my route that's fine as long as I'm safe.

But soon, after not more than three hours, I begin to miss the affection between us and it dawns on me that I'll miss this for more than three weeks and there's no real replacement for that.

The first part, being completely free and only responsible for myself, is familiar from my past.

The second part, missing the affection and intimacy, is rather new and exists only since I've known you.

# BIG HUG

Chris telah tiba dirumah dengan tangan kanannya membawa kantung plastik putih yang berisi banyak camilan untuk sang kekasih

klek

“Selamat malam sayangg...”

Shamora yang sedang fokus dengan ponselnya pun mengalihkan konsentrasi nya kepada seseorang yang batu saja datang, dan langsung memeluk pujaan hatinya dan mengecup tipis bibir sang suami pertamanya

“Mana jajanku??”

“Ini, tapi sebentar mas bikin eskrim toastnya dulu ya” Chris sambil berjalan kedapur, dan Shamora hanya membuntutinya

“Mas kamu mandi dulu aja deh, aku mau nungguin kok, kamu bau keringat tauukk, sana sana mandi, aku gamau hug kalo ga mandi dulu” pinta Shamora dengan tatapan khas memohonnya

“Yaudah mas mandi dulu ya, es kirimnya masukin freezer dulu, keburu leleh” Chris memerintah sambil berjalan dan tersenyum kepada istri cantiknya dan menuju kamar mandi.

---

Setelah lama menghabiskan camilan tadi, Chris langsung memeluk Shamora dengan erat, dengan penuh kehangatan di atas sofa ruang tamu, aroma Shamora yang manis pun tercium, Chris menyukai aroma khas Shmora yang manis.

Dengan senang hati Chris mengusap usap surai hitam panjang milik si cantik dan mengecup pipi hingga tengkuk Shamora sekilas, karena ia benar benar kecanduan dengan aroma khas si cantiknya itu

Shamora hanya bisa bahagia menikmati kemesraan yang diberikan oleh sang kasih

“Mas Hyun kemana ya, ini udah jam 12 kok belum pulang, ga ngabarin apa apa juga, apa aku telfon aja ya?” tanya Shamora di tengah kemesraannya dengan suami pertamanya

“Coba telfon, mungkin masih di perjalanan”

tut

tut

tut

“Nomor yang anda tuju sedang diluar jangkauan....”

“nomernya ga aktif, dia keman ya kira kira” Shamora tampak khawatir dengan suami keduanya karena tidak kunjung memberi kabar

“mungkin lowbat, ga ada sinyal” Chris menanggapi agar sang istri tidak terlalu panik

Chris mematikan lampu utama dan kembali merebahkan badan di sofa dengan posisi memeluk sang istri dengan lembut dan dikecupnya dahi si cantik dengan tangannya yang sedang mengelus punggungnya agar sang istri tertidur di pelukannya.

-jiby

I love Hamlet. This is not a controversial statement, really. “I have a fondness for one of the greatest works of literature in the English language.” is not a hot take. The reason this is noteworthy is because in general I hate drama in my media. I watch movies or TV shows as a form of escapism, not catharsis. When there is conflict on screen I feel it and I don't like it. So why do I like Hamlet? Tom Stoppard answered the question for me, in Rosencrantz and Guildenstern are Dead. There is a character in that play who is aware of the narrative structure, who is seemingly aware that he is in a play, and that it will all repeat. It will all happen again because it's not real, it's drama. And I realized the other day that this disconnection is why I can enjoy Hamlet. I'm watching David Tennant and Patrick Stewart play roles, I'm not watching an actual person named Hamlet kill another actual person named Claudius. I separate the actors from the roles in my mind.¹ When I watch Hamlet I'm watching for the artistry of the performances, I'm reveling anew in the beauty of the writing. My sadness over Ophelia being driven to madness and suicide is still there, but tempered by the fact that I'm observing how Mariah Gale is choosing to convey “Ophelia” (This whole production is sublime, every single person in it is amazing).

The title of this article is based on the implied contract between creators and consumers of fiction. When you partake in a fictive world you are expected to participate in a state of “Willing suspension of disbelief”. We know that sitcoms aren't reality, we know that novels aren't histories. Things will happen in fiction that don't quite work in the real world, and our contract with the creators is that we will gloss over those things so that we can be immersed in the fictive world that is being created. We ignore logic so that emotion can take over.

But when the emotions are “stress” or “awkwardness” I don't want that emotion to take over. I've never been able to watch The Office (US or UK) because I've worked in offices my whole adult life and it's too real, man. I feel the stress, not the humor.

So I'm trying something: I'm seeking a willing retention of disbelief. I'm choosing to engage with all fiction the way I engage with Hamlet. I'm choosing to watch the actors and their choices in addition to watching the story they are portraying. This level of abstraction helps me. An example:

In the third season of Brooklyn 99 a new captain is brought into the precinct and is terrible to our cadre of detectives. Engaging with the story is, for me, not fun. He's a mean, abrasive, over-promoted idiot, and if I am identifying with Amy Santiago and Jake Peralta I'm uncomfortable watching this story. Amy and Jake are in a bad spot, and they are my “friends” in this universe, so I'm feeling empathy for them! I feel like I'm in a bad spot as well!

But if I choose to watch Bill Hader play a role alongside his SNL buddy Andy Samburg, the whole thing is funny. Now I'm watching Melissa, Bill, and Andy do this silly scene where “Jake” and “Amy” kissing is enough to literally kill “Captain Dozerman”. The scene is freed of the weight of believing that an actual death occurred. I can enjoy it as a farce.

So maybe this is just me. Maybe everyone else has always engaged with media this way. Maybe I'm a little weird in the brain (well, I know I'm a little weird in the brain) but it's just possible that someone else out there also has a hard time with cringe comedy because they feel the cringe more than the comedy. And maybe they too will find things funnier if they retain just a little bit of disbelief.

---

⤴️: Although in this specific case it's kinda fun to imagine that the Tenth Doctor and Captain Picard are doing a crossover episode where they put on Hamlet together for timey-wimey reasons.

If you ever feel like you’re about to lose yourself, you can talk to me again. I should be able to at least listen to you. That’s if you’re okay with me.

International Workers' Day marks the release of Workbench 46.1

This new release comes with

Save/restore window state and dimensions for each session/project. I couldn't use the method defined in Saving and restoring state into GSettings because resizing manually with the mouse triggers a lot of blocking disk writes and cause the user action to appear sluggish. So I debounce the events and write to gsettings manually.

Find text in the current editor. The keyboard shortcut is Ctrl+F. This is a feature started by Sriyansh Shivam during their GSoC 2023 internship and finished by UrtsiSantsi. Thanks!

SVG Library entry. Gtk (via gdk-pixbuf) draws SVGs at their intrisic sizes (what is defined in the svg document). If you use different dimensions for example using GtkImage.pixel-size then it is the pixmap that gets upscaled resulting in pixelated / blurry images. This new Library entry showcases how to render an SVG at arbitrary dimensions using librsvg. We may need a better primitive in the future, if you need an SVG Paintable; GTK Demo contains an example. See also this conversation.

Reveal In Files. This is a new option available in the menu that will reveal the session/project in Files. You can use it to add assets to your project and load them using workbench.resolve or as icons.

Import icons into your projects. Using the “Reveal In Files” option you can now add custom icons to your projects. It's just a matter of dropping the files in the right folder. See the “Using Icons” Library entry.

Workbench included an Icon Library and icon-development-kit for a while but in an effort to simplify Workbench and since we already have an Icon Library app, I decided to remove both in favor of per project icons.

I'm quite happy with the developer experience there and I hope we can provide something similar in the future to move beyond GtkIconTheme. We probably need to keep icon-name as suggested in Updates from inside GTK but I'd be very interested supporting relative paths in GTK Builder. Thankefully we already have GResource to allow for something like

Gtk.Image {
  src: "./smile-symbolic.svg";
}

7 new Library entries ported to Vala

• Radio Buttons
• Switch
• Revealer
• Styling with CSS
• Separator
• Level Bars
• Link Button

Also

• “Animation” Library entry ported to Python
• Split “List View Widget” Library entry into “List View” and “Grid View”
• Fix Vala and Rust extensions detection on “Run”
• List editor shortcuts in Shortcuts

Thank you contributors and GSoC applicants.