Security Leftovers
-
It’s almost a year since Sysdig’s behavioral activity monitoring tool Falco entered the sandbox of the Cloud Native Computing Foundation (CNCF). We talked to the company’s new chief open source advocate Kris Nova and co-founder Loris Degioanni to check in about the project’s progress and talk about the state of Kubernetes security and open source licensing in general.
Falco was first introduced to the public back in May 2016. It’s no secret that security wasn’t exactly a top priority when Kubernetes was developed, so Falco was set up to tackle some of the challenges the orchestrator introduced to the modern infrastructure stack.
[...]
Moving the project into the CNCF in October 2018 was the logical next step for Degioanni. “In order to be cloud-native and to actually be placed as a part of the stack of the next generation of infrastructures, you want to be part of the CNCF nowadays.”
But the foundation has strict rules on what projects must do to make it to the next stage, so the first months in the sandbox were mostly spent setting up processes and work on Falco’s own infrastructure. With Nova, who spent quite some time on the Kubernetes project, now on board, this trajectory is likely to continue.
-
One of the main aspects of addressing or curing the privacy breach epidemic is to gain back control and management over personal data. Where we see the aspect of giving back consumer some control, all of the control, and the accountability for their personal data that's stored on digital space, and what we developed is a set of tools that allows an entire economy of consumers, businesses and marketers to interact in harmony and in a way move the world to a more privacy aware interaction.
-
Guardicore, a leader in internal data center and cloud security, unveiled new capabilities for its Infection Monkey that make it the industry’s first Zero Trust assessment tool.
| OSS Leftovers
-
CloudBees, the enterprise DevOps leader powering the continuous economy, highlighted recent findings in the 2019 Accelerate State of DevOps Report. The survey was conducted by DevOps Research and Assessment (DORA), a pioneer in helping organizations achieve high DevOps and organizational performance with data-driven insights, and Google Cloud, and sponsored by CloudBees and others. The results showed that a higher percentage of top performing teams in enterprise organizations are using open source software. Additionally, the proportion of Elite performers (highest performing teams) nearly tripled from last year, showing that DevOps capabilities are driving performance.
-
When you buy a product like Philips Hue’s smart lights or an iPhone, you probably assume the people who wrote their code are being paid. While that’s true for those who directly author a product’s software, virtually every tech company also relies on thousands of bits of free code, made available through “open-source” projects on sites like GitHub and GitLab.
Often these developers are happy to work for free. Writing open-source software allows them to sharpen their skills, gain perspectives from the community, or simply help the industry by making innovations available at no cost. According to Google, which maintains hundreds of open-source projects, open source “enables and encourages collaboration and the development of technology, solving real-world problems.”
-
Leading South African open source firm and provider of OS technology and services Obsidian Systems has confirmed its Diamond Sponsorship of the acclaimed and much-anticipated Open Source Week, managed by the organisers of PyConZA, LinuxConfZA and PostgresConfZA tracks.
-
npm, Inc., the open source JavaScript developer tools provider and operator of the world's largest software registry, today announced its CEO, Bryan Bogensberger , has resigned effective immediately to pursue new opportunities.
npm's Board of directors have commenced a search for a new CEO. The company's leadership will be managed collaboratively by a team comprised of senior npm executives.
-
If you've ever dealt with (in any shape or form) open source software, chances are pretty good you've heard the terms upstream and downstream. These terms are actually more important to open source development than you might think.
But what do they even mean?
I'm going to explain it to you.
-
IMS MAXIMS broke new ground in 2014 when it made the code for its big hospital IT systems open source.
-
Usually when law firms develop legal technology, either it’s to make a profit or it’s free to further the firm’s branding as a legal expert in the platform’s practice area. But Travers Smith bucked that trend when it announced last week that it was releasing its email management system MatMail as open-source software.
-
Inspur has announced the open-source release of TF2, an FPGA-based efficient AI computing framework. The inference engine of this framework employs the world's first DNN shift computing technology, combined with a number of the latest optimization techniques, to achieve FPGA-based high-performance low-latency deployment of universal deep learning models. T
-
On Thursday, software engineer Seth Vargo pulled his open source “Chef Sugar” project from Github, as well as the Ruby package library, RubyGems. Vargo made the decision to pull the code, which had millions of downloads, after learning that Chef, a company that provides an “automation platform” for infrastructure management, had a software contract with ICE.
-
Germany's ministry of the interior asked management consultancy PricewaterhouseCoopers, or PwC, to produce a "Strategic market analysis on reducing dependence on single software providers".
In the 34-page document released yesterday, researchers conclude that "at all levels" the German government is "strongly dependent" on very few software providers.
And that is particularly true for Microsoft, whose Office and Windows programs are running on 96% of public officials' computers.
This dependence results in "pressure points in the federal government, that work in opposition to the government's [stated] strategic IT goals," the report notes. Concerns about information security at Microsoft could "endanger the country's digital sovereignty".
-
DevOps darling Chef had a nightmare Thursday after it emerged the software biz had inked a deal with US immigration, which sparked protest and a baffling counter-response.
Here's how it went down. Earlier this week, Chef, an app configuration specialist, was publicly called out for selling $95,000 (£75,000) of licenses to Uncle Sam's Immigration and Customs Enforcement, the controversial agency best known for its recent hits I Separated Asylum-Seeking Families At The Border and What's A Concentration Camp. The one-year software supply deal, brokered by a reseller, kicked off in August.
Open-source programmer and DevOps guru Seth Vargo, deeply unhappy with this arrangement, yanked offline some of his Ruby Gems – software packages for Ruby devs – that made Ruby-based Chef a lot easier to use. In particular, he took down the popular and useful Chef-Sugar, which over the years has racked up more than 20 million downloads.
-
To achieve the requisite capabilities while keeping the experimental solution cost-effective for practical usage, our test system used an architecture comprised of open source Apache Kafka, Apache Cassandra, and our Anomaly Detection application. Beyond the performance, scalability, and affordably Kafka and Cassandra provide, both Open-source data technologies also offer a particularly high degree of compatibility and pair well together.
-
Computer server management software is usually pretty boring. But when that software is sold to a federal agency that separates families and detains children, even esoteric technology can become the center of controversy.
On Monday, activist Shanley Kane highlighted a contract between Seattle-based software company Chef and US Immigration and Customs Enforcement. Chef develops and sells open source software for configuring servers and cites Alaska Airlines, Google, Facebook, and Capital One as customers.
The ICE contract created a minor stir on Twitter, but by Thursday morning, Chef hadn’t made a public statement about the controversy. Discouraged by the company’s silence, former Chef employee Seth Vargo removed several Chef-related open source tools that he had hosted on two code repositories. They included Sugar, a tool designed to make it easier to work with Chef’s software that’s widely used by Chef customers, though it’s not clear if ICE uses it. "I have removed my code from the Chef ecosystem," Vargo wrote on the code hosting site GitHub. "I have a moral and ethical obligation to prevent my source [code] from being used for evil."
-
Though the Open Process Automation Forum (OPAF) continues to receive the lions share of coverage as defining “the” open system, it is, in fact, not the only approach or option for the application of open technologies for the control domain.
OPAF is somewhat constrained on how open they can be because they have backwards compatibility as a starting point, which to some extent limits them to using traditional and “less open” (consortia-sponsored) protocols such as OPC, FieldComm, Profibus, etc. to ensure compatibility and vendor support. They’re also working on how to convert all their existing applications and IP to the new virtual environment.
[...]
Building on the latent momentum for small, low-cost microcontrollers, Hilscher has introduced its Industrial Raspberry Pi 3 using Node-Red as the development/integration environment and Docker containers to design and connect with the rest of the world.
Node-RED is a Java-script programming tool for connecting hardware devices, APIs and online services by providing a browser-based flow editor that makes it easy to virtually “wire” together flows that can be then deployed to the runtime in a single click.
|
FOSS in China
-
China’s internet giant Tencent announced Wednesday that it will open-source its in-house Internet of Things (IoT) operating system TencentOS tiny, according to a company’s press release.
Tencent’s IoT team said that making TencentOS tiny an open-source product will allow developers in the world to share Tencent’s technologies and expertise in this sector, while also allowing this system to draw innovations from worldwide, and lower the development cost of IoT applications.
-
To bolster its growing software and hardware ecosystem, Chinese tech giant Huawei has announced that it will be making a huge investment to support third-party developers. The company announced on Wednesday that it will be investing around $1.5 billion aimed at cultivating more developers to help it grow its open-source computing platform.
-
Chinese technology giant Huawei unveiled its own open-source software ecosystem yesterday with the goal of attracting global developers and players to use its system.
Huawei will invest US$1.5 billion (S$2 billion) in the next five years in an upgraded version of its existing developer programme. It will provide funding to universities, individuals, start-ups and enterprises to support them in learning, product development and marketing.
| today's leftovers
-
Are friends and family constantly asking you to troubleshoot issues with their Windows or Mac device? Being the resident support technician in your home is an important job. Like any responsible technology steward, you are going to try your best to help out. However, it might be quite a challenge if it has been a while since you last used such an operating system.
How long has it been since you last used Windows? Before using Linux, were you primarily a Mac user? Or, are you using Windows or Mac now either at home or work?
Take our poll by selecting the Windows version you last remember using. If the term, "windows" only reminds you of those glass panels that let sunlight inside, you are probably a long-time Linux user.
Leave us a comment and share your story about how you started using Linux.
-
I recently detailed my attempts to install Linux as an alternative boot an SD card in a new Dell laptop. Those attempts failed. See Attempting to install Linux on a new laptop for the details.
Microsoft has continued in their usual way and notified me last week that the current feature update of Windows on that laptop would soon be unsupported and urged me to update to the latest version.
However, that proved impossible. In spite of removing most of the software installed on the machine, Windows was incapable of cleaning up enough disk space to allow the installation of Windows 10 version 1903 to proceed. The installed 32GB eMMC drive simply is no longer large enough to allow the updates to install. This was true even when I manually downloaded the update and tried to install from an external drive.
It is remotely possible wiping the hard drive and performing a clean install might have worked, but the prospect of being forced to do so every year was not appealing. So being forced to choose between running an out of date version of Windows or wiping the hard drive and installing Linux, I chose to try the latter.
-
Our first giveaway. In this episode: hidden gems, Banshee abandoned, FreeOffice issues, back to Ubuntu MATE for accessibility, and NTP and hardware clock.
-
Tools like error monitoring, crash reporting, and performance monitoring are tools to help you create a better user experience and are fast becoming crucial tools for web development and site reliability. But really what are they? And when do you need them?
You've built a cool web app or service, and you want to make sure your customers have a great experience.
You know I advocate for utilizing automated tests so you find bugs before your customers do. However, fast development lifecycles, and quickly reacting to customer needs is a good thing, and we all know that complete testing is not possible. That's why I firmly believe that site monitoring tools like logging, crash reporting, performance monitoring, etc are awesome for maintaining and improving user experience.
John-Daniel Trask, JD, the CEO of Raygun, agreed to come on the show and let me ask all my questions about this whole field.
-
We released Storm 0.21 on Friday (the release announcement seems to be stuck in moderation, but you can look at the NEWS file directly). For me, the biggest part of this release was adding Python 3 support.
Storm is a really nice and lightweight ORM (object-relational mapper) for Python, developed by Canonical. We use it for some major products (Launchpad and Landscape are the ones I know of), and it’s also free software and used by some other folks as well. Other popular ORMs for Python include SQLObject, SQLAlchemy and the Django ORM; we use those in various places too depending on the context, but personally I’ve always preferred Storm for the readability of code that uses it and for how easy it is to debug and extend it.
It’s been a problem for a while that Storm only worked with Python 2. It’s one of a handful of major blockers to getting Launchpad running on Python 3, which we definitely want to do; stoq ended up with a local fork of Storm to cope with this; and it was recently removed from Debian for this and other reasons. None of that was great. So, with significant assistance from a large patch contributed by Thiago Bellini, and with patient code review from Simon Poirier and some of my other colleagues, we finally managed to get that sorted out in this release.
|
Printer-friendly version
PDF version
.svg_.png)
Content (where original) is available under CC-BY-SA, copyrighted by original author/s.
SRPMS
Just send your srpms to contribs and after review they will be posted in the pclos repositories.
re: got space
How many downloads you anticipating? If we're talking just a few a day, then I can host them. If you're talking more then Tex has been known to host a few contrib rpms. Send me a message thru the contact me form and we'll take a look.
----
You talk the talk, but do you waddle the waddle?