devopsy.kinsta.cloud

Category: Continuous Testing

Continuous testing is the process of executing automated tests as part of the software delivery pipeline to obtain immediate feedback on the business risks associated with a software release candidate.

Kobiton Open Sources Test Script Generation Tool

Kobiton today announced it is open sourcing a script generation tool for the Appium automation framework that automates the running of test scripts.

The overall goal is to make the tool, which makes it simpler to create more testing scripts, more widely available and, ultimately, lead to higher-quality applications being deployed.

Kobiton CTO Frank Moyer said the tool makes it possible to generate tests from a test case that has been captured in a Node.js format. Rather than having to hire hundreds of testers to create those scripts manually, it’s now possible to automate those tasks using an open source tool, he added.

On average, Kobiton claims the tool it developed can write a 30-step script in 10 minutes, whereas a manual approach could take as long as four hours to construct a similar test.

Once created, those test scripts can automatically be executed using the Appium framework. The output from that tool can also be used on other testing platforms, including Sauce Labs, BrowserStack and LambdaTest or integrated with low-code testing platforms from Perfecto and Tricentis.

It’s no secret that the quality of any given application tends to vary widely, not just between organizations but also within them. Most of those issues can be traced back to a lack of testing that usually occurs because there isn’t enough time. As deadlines near, one of the first places organizations look to make up for delays is the time available for testing. The hope is that whatever issues arise will be addressed via the next update. Of course, when the update falls behind schedule, the testing process is again cut back.

Ideally, application development projects would not be allowed to go forward without adequate testing, but given business pressures, they often do. The only way to limit the impact of application development delays is to reduce the time required to create and run tests. The more automated that process becomes, the less time there will be spent on manually running routine tests. In fact, hopefully, there might even be enough time to run more complex tests to uncover issues that might adversely impact the user experience in ways no one might have otherwise considered.

One way or another, the quality of the applications being deployed needs to improve if for no other reason than end users have options. Most end users will never give a mobile application a second chance if the initial experience doesn’t meet expectations. At the same time, application security regulations are only going to become more stringent. The tolerance for known vulnerabilities discovered after an application has been deployed is falling. Many organizations will find themselves subject to fines being levied simply because there was not enough adequate testing baked into the software supply chain.

In fact, application security should, in the final analysis, be an element of a large quality assurance process that begins with adequate testing.

February 8, 2024
Survey Surfaces Raft of Ongoing Agile Development Challenges

A survey of 788 software development professionals finds 71% are using agile development methodologies within their software development life cycle (SDLC) but only 44% said it is working very well (11%) or somewhat well (33%) in the enterprise.

Conducted by Digital.ai, the survey identifies end-to-end visibility and traceability from business initiative through deployment as the top opportunity for improvement (44%), followed by an ability to measure cycle time, wait time and bottlenecks (34%), continuous testing (29%) and identification and measurement of technological risk (28%).

Nearly half (46%) identified too many systems as a primary reason Agile was not scaling, followed by siloed teams (37%), culture clash (34%), inconsistent adoption (30%) and the inability to measure business value (28%).

Despite these issues, nearly two-thirds (63%) said they have visibility into their Agile pipeline, with 55% claiming they have complete visibility. However, only 36% said DevOps teams currently work together as one team to accelerate innovation and deployment of high-quality and more reliable software. At the same time, only two-thirds (66%) claimed at least 50% of their applications were delivered on time and “with quality.”

Joyce Tompsett, general manager of the State of Agile project at Digital.ai, said the survey makes it clear many organizations are still trying to strike the right balance when it comes to developing software. For example, the survey finds the top two reasons organizations adopt Agile (tied at 41%) are to accelerate time to market and prioritize delivery and measure customer/business value. Most software development teams are being evaluated both based on velocity (33%) and the value delivered (29%), the survey finds.

The survey also identifies customer satisfaction (43%), time to delivery (39%) and competitive advantage (34%) as their top priorities for 2024.

In general, the survey finds that 33% of respondents reported business leaders and executives are actively leading and participating in company-wide agile transformation. However, more (41%) said there was not enough leadership participation. Well over a third (37%) said business teams simply don’t understand what Agile is or what it can do. More than a quarter (27%) said there is not enough training.

Not surprisingly, the most widely adopted methodology is Scrum (63%) with the Scaled Agile Framework (SAFe) being the most widely used (26%). Another 22% don’t have a mandated framework, while 12% said they have created their own.

The debate over what precisely constitutes agile development is, of course, ongoing. Each organization tends to adopt the elements of the framework that make the most sense for them, so the actual state of adoption from one organization to the next will vary widely. The one thing that is certain is the more complex the IT environment, the more challenging it can be to embrace agile development.

And there continues to be lots of room for improvement. If only two-thirds of organizations are delivering half (50%) of their applications on time with an acceptable level of quality, it means there are more projects that are failing to meet that standard than many software development teams might care to admit.

As more organizations become more dependent on software, however, tolerance for that level of failure will only continue to decline as businesses and leaders lose patience with application development practices that do not live up to expectations.

February 7, 2024
DevOps Guide to Java Profiling
Java profiling is a technique used to understand the detailed behavior of a Java application. It involves monitoring and measuring various aspects of a program’s execution, such as memory usage, CPU utilization, thread execution and garbage collection.

Java profiling can be used in various stages of the software development life cycle (SDLC). During development, it can help identify bottlenecks and performance hotspots, which can then be optimized for better performance. In the testing phase, profiling can be used to verify that the application performs as expected under load. Finally, in production, profiling can be used to monitor application performance and detect potential problems before they affect users.

Java profiling tools provide insights into the Java Virtual Machine (JVM) and the application running on it. They allow developers to monitor thread execution, object creation, garbage collection and many other aspects of JVM operation. By using a Java profiler, developers can gain a deep understanding of the application’s performance characteristics and identify potential areas for optimization.

Why is Performance Tuning Important for DevOps?

Impact on Application Efficiency and Scalability

Performance tuning plays a vital role in DevOps by enhancing the efficiency and scalability of applications. Efficient applications use fewer resources, which reduces costs and allows for more users or larger workloads. Scalability is the ability of an application to handle increased workloads without a decrease in performance. By identifying and eliminating performance bottlenecks, DevOps teams can ensure that applications scale effectively as demand increases.

Relationship Between Performance and User Experience

Performance is directly related to user experience. A slow or unresponsive application can frustrate users and lead them to abandon the application altogether. By ensuring that applications perform well, DevOps teams can improve user satisfaction and retention. Furthermore, by monitoring application performance in production, DevOps teams can proactively identify and resolve issues before they impact users.

Cost Management and Resource Optimization

Performance tuning can also help with cost management and resource optimization. By optimizing application performance, DevOps teams can reduce the amount of computing resources required to run the application. This can result in significant cost savings, especially in cloud environments where costs are directly tied to resource usage.

Moreover, by understanding the application’s resource usage patterns, DevOps teams can make more informed decisions about resource allocation and capacity planning. This can help avoid over-provisioning, which leads to wasted resources, or under-provisioning, which can result in poor application performance.

Common Java Performance Issues

Memory Leaks

Memory leaks are a common performance issue in Java applications. A memory leak occurs when an application continuously allocates memory but fails to release it when it is no longer needed. Over time, this can lead to OutOfMemoryError exceptions and can cause the application to crash.

Java profiling can help identify memory leaks by monitoring the application’s memory usage over time. If the memory usage continuously increases even when the application is idle, this could indicate a memory leak. Profiling tools can also provide insights into the objects that are consuming the most memory, which can help locate the source of the leak.

Thread Contention and Synchronization Issues

Thread contention and synchronization issues can significantly impact the performance of Java applications. Thread contention occurs when multiple threads attempt to access a shared resource simultaneously, causing them to wait and leading to reduced performance. Synchronization issues, such as deadlock and livelock, can cause threads to become stuck, preventing them from making progress.

Java profiling can help detect thread contention and synchronization issues by monitoring the state and execution of threads. Profiling tools can show which threads are running, waiting or blocked and can provide a stack trace of each thread, which can help identify the cause of contention or synchronization issues.

Garbage Collection Overhead

Garbage collection is a key aspect of Java’s memory management, but it can also be a significant source of performance overhead. During garbage collection, the JVM pauses application execution to reclaim memory from objects that are no longer in use. If garbage collection occurs too frequently or takes too long, it can lead to application pauses and reduced performance.

Java profiling can help understand and optimize garbage collection behavior. Profiling tools can provide detailed information about garbage collection events, such as their frequency, duration and the amount of memory reclaimed. This information can help developers tune the garbage collector’s configuration to minimize its impact on application performance.

Resource Starvation

Resource starvation is another common performance issue in Java applications. It occurs when a system or process is unable to gain sufficient access to resources, leading to reduced performance or failure. In Java applications, resource starvation can be caused by factors such as insufficient memory, CPU, disk space or network bandwidth.

Java profiling can help detect and resolve resource starvation issues. By monitoring resource usage, profiling tools can identify when resources are becoming scarce and provide insights into the factors contributing to resource starvation. This information can help developers optimize resource usage and ensure the application has sufficient resources to perform effectively.

Key Features of Java Profiling Tools

Java profiling tools typically provide the following features:
- Ability to detect memory leaks: Memory leaks can be a significant issue in Java applications as they can lead to an out-of-memory error, disrupting the smooth running of the application. Profiling tools can help identify these leaks, allowing developers to fix them before they cause bigger issues.
- CPU profiling: This allows developers to see how much CPU time each method in their application is consuming. By identifying methods that are consuming a disproportionately high amount of CPU time, developers can optimize their code to improve its performance.
- Detailed thread profiling: This can help developers to identify synchronization issues, deadlocks, and other potential problems in multi-threaded applications. By providing this critical insight, profiling tools can help developers to create more efficient, high-performing applications.
Best Practices for Java Profiling

Here are some best practices to make the most out of your Java profiling efforts.

Identifying Key Performance Metrics

First and foremost, it’s essential to identify the key performance metrics that are most relevant to your application. The metrics you choose will depend on the nature of your application and its performance requirements. Some common metrics include response time, CPU usage, memory usage and garbage collection activity. By identifying these key metrics, you can use your profiling tools to monitor them and identify any potential issues.

Integrating Profiling in CI/CD Pipelines

Another best practice is to integrate profiling into your Continuous Integration/Continuous Deployment (CI/CD) pipelines. This allows you to catch performance issues early in the development process, before they become more difficult to fix. By regularly profiling your application during development, you can ensure that any changes you make don’t adversely affect its performance.

Profiling in Real-World Scenarios

While it can be useful to profile your application under controlled conditions, it’s also important to do so in real-world scenarios. This means profiling your application when it’s under load, when it’s dealing with real data, and when it’s running on the same hardware and software configurations as it will in production. By doing so, you’ll get a much more accurate picture of how your application performs in the real world.

Collaboration and Knowledge Sharing

Finally, Java profiling should not be a solitary activity. It’s important to share your findings and insights with your team, and to collaborate on solutions to any performance issues you identify. By doing so, you can build a culture of performance awareness within your team, and ensure that everyone is working towards the common goal of creating efficient, high-performing Java applications.

Java profiling is a vital part of the software development process. By understanding its key features and following best practices, you can use it to create applications that are efficient, high-performing and able to meet the demands of the modern world. So don’t underestimate the power of profiling—embrace it, and watch your Java applications reach new heights of performance.
February 7, 2024
OpenText Extends Tool for Auditing Source Code Using Machine Learning

OpenText this week updated a static analysis tool it provides to audit code using machine learning algorithms to provide deeper insights into on-premises IT environments.

Announced at the OpenText Security Summit 2024 conference, the latest generation of Fortify Audit provides additional artificial intelligence (AI) models capable of learning the unique attributes of custom source code.

The latest version of Fortify Audit Assistant also adds the ability to detect drift in a model and, if necessary, automatically refresh it. OpenText is now committing to refreshing those models every quarter.

The discriminant AI model from OpenText enables machine learning algorithms to learn how humans conducted an application audit to then run similar tests on other applications. Previously, Fortify Audit relied on the same core model to audit both on-premises and software-as-a-service (SaaS) applications based on data collected by OpenText. Fortify Audit Assistant now provides support for more than 30 language-specific models to improve testing performance.

Dylan Thomas, senior director for Fortify engineering and product for OpenText Cybersecurity, said this capability ensures that any sensitive data never leaves an on-premises IT environment.

The overall goal is to streamline the number of alerts that would otherwise overwhelm a DevSecOps team trying to identify the root cause of an issue, he added. For example, Fortify Audit Assistant will identify test code that is not vulnerable because it was never deployed in an actual production environment. That approach makes it easier for DevOps teams to prioritize which vulnerabilities to fix first in their source code using a lightweight AI model that still enables them to deeply scan source code, noted Thomas.

Historically, DevSecOps teams need to make a trade-off between lightweight approaches and deep scans of source code that is no longer required, he added.

As regulations pertaining to software supply chain security become more stringent the number of development teams that will be subject to some type of audit is only going to increase. The cost of failing an audit will also inevitably increase as regulatory bodies look to make examples of organizations that are not properly securing their software supply chains.

It’s not clear how aggressively organizations are embracing best DevSecOps practices to address myriad software supply chain security issues that were highlighted in an executive order issued by the Biden administration to Federal agencies. However, with the rise of AI and other forms of automation, it should become simpler to identify more vulnerabilities before they wind up being exploited in a production environment.

There will always, of course, be a need to secure production environments because there’s always a probability mistakes will be made. However, given the lax practices many organizations have employed to build and deploy applications, it’s probable the number of vulnerabilities that exist in production environments today is beyond counting. In many cases, the better part of valor might be to replace many of those applications entirely with ones built using DevSecOps best practices.

Regardless of the path to better application security chose the one thing that is certain is cybercriminals are only going to become even more adept at discovering those vulnerabilities.

February 6, 2024
10 Key Features of AI Code Assistants

One of the most potent tools that have emerged to streamline the coding process is code assistants. Code assistants are software tools designed to assist programmers by providing suggestions and automated features that help in writing code more efficiently and accurately. They act as virtual aides, making the coding process faster, more intuitive and less prone to errors.

Code assistants can be categorized into two types: Rule-based and AI-based. Rule-based assistants follow predefined rules and perform according to set guidelines. They are mainly used for syntax highlighting, code formatting and basic error detection. AI-based code assistants can learn from past coding patterns, predict what a programmer is trying to achieve and suggest appropriate code snippets. They are capable of understanding the context of the code and providing accurate suggestions, as well as generating entire blocks of code based on natural language instructions. Read this blog post for examples of popular AI coding assistants.

Whether you are an experienced software developer handling complex projects or a beginner, coding assistants can automate the tedious aspects of coding, allowing you to focus more on problem-solving and innovation.

The Growing Importance of AI in Software Development

As software development becomes more complex and time-sensitive, the role of AI in this field has grown significantly. AI-driven code assistants represent a major shift in how software is developed. They bridge the gap between human expertise and the efficiency of automated processes.

AI in software development not only speeds up the coding process but also enhances the quality of the code. These tools can analyze vast amounts of code, learn from it and apply that learning to assist developers in real-time. They can adapt to different coding styles and requirements, making them versatile tools for a wide range of programming tasks. Furthermore, as software projects increase in size and complexity, AI code assistants become crucial in managing and navigating these complexities. They offer intelligent insights, detect potential issues before they become problematic, and assist in keeping large codebases clean and manageable.

In addition to increasing efficiency, AI code assistants are instrumental in reducing the barrier to entry in software development. They make coding more accessible to people with varying levels of expertise, including those who are new to programming. This accessibility is essential in an era where the demand for software development skills is continuously rising. By providing real-time assistance and learning resources, AI code assistants are not just tools for current developers but also learning aids for future generations of programmers.

10 Key Features to Expect from Code Assistants in 2024

With the rapid advances in large language models (LLMs), the following features are becoming standard in coding assistants as we enter 2024.

Advanced Contextual Understanding

Modern code assistants are evolving to understand the context of code more intricately. Unlike simple autocomplete tools, these AI systems can analyze the broader scope of a project, recognizing patterns and offering suggestions that align with the overall architecture and design patterns. This advanced understanding not only streamlines coding but also aids in maintaining consistency throughout the codebase.

Real-Time Code Optimization Suggestions

AI tools can proactively recommend changes to improve performance and efficiency. For instance, a code assistant might suggest a more efficient algorithm or highlight redundant code blocks that can be simplified. This feature not only enhances code quality but also serves as a learning tool for developers, exposing them to best practices and alternative approaches.

Enhanced Debugging Assistance

Debugging is often a time-consuming aspect of development. In 2024, expect code assistants to revolutionize this process by offering enhanced debugging assistance. Through deep analysis, these tools automatically detect errors and anomalies, suggesting potential fixes. They can pinpoint the exact location of a bug and provide context, significantly reducing the time developers spend in the debugging phase.

Automated Refactoring

Refactoring is crucial for maintaining clean code, and AI-driven assistants now offer sophisticated automated refactoring capabilities. They intelligently suggest changes that improve code readability and maintainability, such as restructuring code or renaming variables for clarity. These suggestions will be particularly beneficial for managing and updating legacy code, ensuring it adheres to modern coding standards.

Code Documentation Generation and Update

Keeping documentation updated is a challenge. Code assistants can now automate this task by generating and updating documentation in real-time. As code changes, the documentation will reflect these updates, ensuring that it always stays in sync with the codebase. This feature will be invaluable in large teams where keeping track of changes can be daunting.

Predictive Coding Assistance

Moving beyond reactive suggestions, code assistants will offer predictive assistance. By analyzing coding patterns and project structures, these tools will predict a developer’s next steps and offer relevant suggestions even before they are explicitly requested. This proactive approach will speed up the development process, reducing the cognitive load on developers.

Understanding and Responding to Developer Queries in Natural Language

Developers can pose queries or express coding requirements in plain English, and the assistant will interpret and execute these requests. Chat-based interfaces offered by leading AI coding assistants take this one step further. This advancement will make coding more intuitive and accessible, especially for beginners or non-expert users.

Real-Time Suggestions and Conflict Resolution in Team Projects

Collaboration in coding projects can lead to conflicts and inconsistencies. Code assistants now offer real-time suggestions and automated conflict resolution for team projects. These tools will identify potential conflicts in merge requests and suggest optimal resolutions, enhancing team collaboration and maintaining code integrity.

Personalized Coding Assistance Based on Past Interactions

Personalization is becoming a significant feature of code assistants. By learning from past interactions with a developer, these tools will tailor their suggestions and support to align with individual coding styles and preferences. This adaptive learning approach ensures that the assistance provided is most relevant and efficient for each developer.

Enhancing Accessibility of Coding for Non-Expert Users

One of the most impactful features of code assistants is their role in democratizing coding. By simplifying complex coding concepts and automating mundane tasks, these tools will make software development more accessible to non-experts. Beginners and those learning new programming languages will find these assistants particularly useful, as they provide guidance and learning aids.

Conclusion

Code assistants powered by AI are becoming an integral part of the software development process. They not only make coding faster and more efficient but also reduce the chances of errors, making the resultant software more reliable. The role of code assistants is only expected to grow, bringing in more advanced and intuitive features. Whether you are a seasoned programmer or a newbie, embracing code assistants can be a game-changer for your coding journey.

February 6, 2024
Salesforce Adds Ability to Apply Custom Security Policies to APIs

Salesforce today added the ability to customize security policies for application programming interfaces (APIs) to the Mulesoft Anypoint API management platform.

Gerry Egan, vice president of product management for Mulesoft at Salesforce, said this capability makes it possible for organizations to use an Anypoint Flex Gateway Policy Development Kit to streamline development of custom API security policies that can be implemented as code.

In addition to providing integrations with integrated development environments (IDEs), the Anypoint Flex Gateway Policy Development Kit also provides test policies that can be employed to ensure API security.

That approach makes it simpler to ensure APIs are secure as they are being built and deployed within the context of an automated DevOps workflow versus having to rely entirely on a separate API security platform, he noted.

The Mulesoft Anypoint Gateway already comes with security policies that DevSecOps teams can readily implement. Salesforce is now adding the ability to apply custom policies that DevOps teams can apply as it becomes apparent cyberattacks against APIs are becoming more sophisticated, noted Egan. Those policies can, for example, be used to remove sensitive data or replace it with a token, he added.

Responsibility for API security is often not well established in many organizations, but as more accountability for API security shifts left toward DevSecOps teams, there is growing interest in addressing the issue as code when APIs are developed and deployed. While cybersecurity teams are responsible for maintaining cybersecurity after APIs are deployed, few of them have any insight into how an API is crafted. That’s a significant issue because cybercriminals have become more adept at both exfiltrating data via external facing APIs in addition to manipulating the underlying business logic to compromise a digital process, noted Egan.

The Mulesoft Anypoint Gateway automates the process of building and applying security policies to APIs as part of the software development life cycle (SDLC) in a way that minimizes any impact on developer productivity, he added. That approach provides the added benefit of reducing the level of cognitive load developers would otherwise experience if they had to manually create software policies, said Egan.

In general, most APIs are internally facing, but it’s not uncommon for them to suddenly be exposed to the internet as application use cases evolve. The best way to ensure API security is at the point of creation. Providing developers with API security tools gives them an opportunity to address security issues at the beginning of the application development process.

There have already been several cybersecurity breaches involving APIs in the past year. It may only be a matter of time before there are additional breaches that could prove catastrophic. Regardless of the size of the API breach, the application development team that created and deployed the API in the first place is ultimately going to be held accountable for fixing it. The challenge is to find the simplest way to eliminate the issue in the first place at a time when the number of APIs being built and deployed only continues to explode.

February 6, 2024
Does Using AI Assistants Lead to Lower Code Quality?

The emergence of generative AI has permanently altered how code gets written — and due to the massive productivity boost, there’s no going back. According to GitHub, 92% of developers said they use AI tools, and developers complete tasks 55% quicker using Copilot, the popular LLM-based code generator.

Yet, new research has potentially upset the idea that AI assistants like Copilot are positively advancing software development without consequences. The report, conducted by GitClear, analyzed over 150 million lines of code over the last four years and found an upsetting uptick in code churn and a decrease in code reuse since the dawn of LLM-driven software development.

So, this begs the question: Does using AI assistants actually lead to lower code quality? Well, the answer is complicated. “I wouldn’t say that the report proves that AI assistants are reducing code quality since our data is correlational,” said Bill Harding, programmer and CEO at Amplenote & GitClear, the organization behind the aforementioned research. “But I would say that there is a confluence of indicators that show code quality decline at scale, starting around 2022 and accelerating in 2023.”

AI-Generated Code Increases Overall Volume

One potential contributor to lower code quality is the sheer amount of code produced. Since LLMs automate code generation, production is accelerated across the board. Without guardrails, generative AI will likely contribute to more technical debt.

“AI-enabled code development is going to have a major effect on coding, exponentially increasing the volume and velocity of code delivery, much of which we anticipate will be of lower quality and more bloated,” said Mehran Farimani, CEO, RapidFort.

In addition to quality concerns, there are also governance and security concerns to consider from the use of AI and surges of new code production. Some anticipate this will overwhelm security teams, which have already been struggling to keep pace. “Increased developer velocity is going to put security teams under even more pressure,” said Farimani. “The volume of scans will increase, the range of vulnerabilities that need to be addressed will increase and the patches that need to be applied will increase.”

Blindly Relying on AI Outputs

According to GitHub, developers accept code completions from Copilot 30% of the time. This percentage is likely to keep increasing as the LLM is trained on internal style and comfort with the tool increases. However, there is still the risk of developers blindly relying upon generative AI outputs without giving them the proper oversight, which could also affect code quality.

“I think there is a risk for lower quality code if a developer blindly relies on what an AI assistant generates,” said Rob Whiteley, CEO at Coder. “Generative AI tools have flaws, and if outputs are not verified, they can insert code that compiles but does not behave as a developer may have intended. It can also insert errors or bugs if not checked.”

How to Retain Code Quality in the AI Age

“I would not say that results of [the GitClear] study are conclusive,” said Dr. Eirini Kalliamvakou, staff researcher at GitHub. She believes the results are misleading since there is no way to know if an AI or a human authored the code that was analyzed for the study. That said, she acknowledged that “if we are helping people code faster, we should ask the question about code quality.” So, how do we retain the quality of all code, regardless of whether it’s human- or machine-generated?

Use Copilot Thoughtfully

The first recommendation is to use AI assistants thoughtfully. If you’re exhausted at the end of a long day, it’s a lot easier just to “hit tab” and accept an AI-generated auto-complete. But this might not be the best move. “When used thoughtfully and with oversight from the developer, I do think AI can improve the quality of a developer’s code by making suggestions and preventing human errors,” said Whiteley.

Apply the Same Code Reviews to AI-Generated Code

Additionally, development teams should be applying the same degree of rigor to AI-generated code, taking it through the same design review processes and security reviews as you would for any new application. “Just because you’re writing with Copilot doesn’t mean you should give up on code reviews, your linters, looking for security vulnerabilities and all that,” said Kalliamvakou.

Avoid Redundancy When Possible

Leaner code means efficiency boosts and cost-savings. “Much of code is redundant and AI can streamline that redundancy and offer interesting insights, but not without developers ensuring the suggestions the AI tool makes align with the code they are intending to write,” said Whiteley. “Similar to Gmail’s autocomplete sentence feature, AI can complete lines of code with accuracy, but only as long as it accurately guesses where you’re going with your sentence.”

Keep Tabs on the Impact on Quality

Multiple sources cited that around 30% of code is now AI-authored. Harding calls for more efforts to analyze the impact of AI generation on code quality. “It would benefit the greater good to get a clear and data-backed assessment of how quality fluctuates when developers hit ‘tab’ to accept an AI suggestion,” he said. This is a new field of study, and will require new metrics to fully monitor and appreciate the impact AI has on code quality.

Determine How To Measure Code Quality

Similar to the dearth of consensus on what exactly constitutes developer productivity, defining and measuring code quality is just as challenging. Therefore, Kalliamvakou recommends first defining what code quality means to your organization and what the metrics are. For instance, this could be the “number of defects.” Then, the next step would be to set up methods to alert developers about potential quality issues, she said.

The Bottom Line: AI Enhances Productivity…

AI assistants are changing the way code gets made, and much of this is for the better.

Most notably, AI can have a significant impact on enhancing productivity for up-and-coming or inexperienced developers. “If an enterprise makes technology like generative AI broadly available, then it can supplement the work and boost the productivity of the base of the talent pyramid,” said Whiteley. “Put simply, that investment massively impacts the broader organization, not just the top 1% of developers.” Even if such tools make a developer 20% more productive, they can have a truly transformative impact.

While the GitClear study doesn’t prove the culpability of AI assistants, it raises some interesting questions worth exploring, said Harding. Notably, is code becoming more repetitive? If so, that could have some negative outcomes for overall efficiency. “Code generated during 2023 more closely resembles an itinerant contributor, prone to violate the DRY-ness of the repos visited,” the GitClear report said.

… So, Assess Code Quality

“If leveraged correctly, generative AI will not lower the quality of code,” said Trisha Gee, lead developer advocate at Gradle, Inc. “However, it’s important that developers using this technology are critically evaluating AI-generated code rather than taking what AI suggests at face value. Code from generative AI may not always be ‘correct,’ be the best solution to a problem or match the code style of the codebase.”

My takeaway is that, yes, you can retain code quality while using AI assistants. However, this assessment comes with some strings attached. It will require an ongoing effort to sanitize the outputs of AI and instill the same checks we typically apply to manually-generated code.

Image source: https://vecteezy_futuristic-technology-concept-mixed-media-innovations-data_7019122_167-3.jpg

February 6, 2024
Graylog Makes Free API Security Tool Available to Developers

Graylog this week made available a free version of its platform for securing application programming interfaces (APIs), intended to encourage developers to adopt best practices to secure them.

The free version of Graylog API Security has all the capabilities of the paid version but is limited to 16GB of local rolling storage on a single node with a one-year renewable license.

Graylog CEO Andy Grolnick said the goal is to make it simple for developers to use this edition of the platform as they are building APIs. As applications are deployed in a production environment, the expectation is organizations will then need to access the version of the platform that is designed to scale, he added.

Based on technology Graylog gained with the acquisition of an API security platform originally developed by Resurface.io, this free version of Graylog’s API security platform is trying to help bridge the divide between the application development teams that create APIs and the cybersecurity teams tasked with protecting them, said Grolnick.

Capabilities of the platform include API classification, discovery, risk scoring, an ability to capture API request and response payloads and continuous monitoring of API and threat signatures in real-time. Collectively, these capabilities enable Graylog API Security to provide high-fidelity alerts using a data lake that is embedded in the platform, noted Grolnick.

That approach enables Graylog API Security to capture all API requests and response details to distinguish valid API traffic from malicious activity involving, for example, data exfiltration hiding under valid response codes.

In addition, Graylog API Security automatically surfaces remediation guidance for developers who typically lack cybersecurity expertise.

API security has become a major DevSecOps issue because cybercriminals are increasingly targeting APIs to steal data. As more externally facing APIs are deployed, the overall size of the attack surface that needs to be defended increases exponentially.

A recent survey conducted by Enterprise Strategy Group (ESG) on behalf of Graylog found more than three-quarters of respondents (76%) have an average of 26 APIs per application. Most respondents are using open APIs for public consumption (67%) or are connecting applications with partners (64%).

In general, most of those APIs are internally facing, but it’s not uncommon for those APIs to suddenly be exposed to the internet as use cases for applications evolve. The challenge is that few cybersecurity teams have visibility into APIs that, when manipulated by malicious actors, can expose code or provide a mechanism through which business processes can be compromised. This issue often exists because, in many organizations, it’s still not clear who is actually responsible for API security.

Arguably, the best way to ensure API security is at the point of creation. Providing developers with API security tools gives them a chance to do the right thing from the beginning of the application development process, said Grolnick.

There have already been several cybersecurity breaches involving APIs in the past year. It may only be a matter of time before there are additional breaches that could prove catastrophic. Regardless of the size of the API breach, the application development team that created and deployed the API in the first place is ultimately going to be held accountable for fixing it.

February 2, 2024
OX Security Optimizes DevSecOps to Improve Application Security

OX Security this week updated its application security posture management (ASPM) platform to enable DevSecOps teams to instantly identify applications running in production environments that are running code that could be potentially exploited.

The ASPM platform from OX Security leverages large language models (LLMs) to identify vulnerabilities. The latest version adds an ability to confine the number of alerts generated to instances of code that can actually be exploited.

OX Security CEO Neatsun Ziv said that approach reduces the number of alerts that would otherwise be generated by 99% to enable DevSecOps teams to focus their limited resources on the 1% of alerts that represent an actual risk to the business. OX Security achieves that goal in part because its scanners are integrated with source control, continuous integration/continuous delivery (CI/CD) platforms, registries and cloud computing environments.

The overall goal is to reduce the amount of manual effort currently required to consistently maintain DevSecOps best practices.
The primary reason many vulnerabilities are never addressed is that DevSecOps teams are simply overwhelmed by alerts. Most of the alerts generated by a cybersecurity team are not immediately relevant because either the vulnerability is not present in the application running in a production environment or the application doesn’t connect to the internet.

The OX Security platform makes it possible to identify application security issues that need to be prioritized because it has been confirmed a vulnerability exists that can be exploited, said Ziv.

No matter how precise the alert process becomes, a DevSecOps team will still need to manage it, added Ziv. However, as the alerts generated become more relevant, it should become easier to bridge the historic divide between application developers and cybersecurity teams. Too many developers routinely ignore vulnerabilities identified by cybersecurity teams simply because previous efforts to identify the actual severity they represent have ultimately been a waste of their time.

The challenge just about any organization encounters when trying to better secure their software supply chains is, not surprisingly, getting application developers to buy into the DevSecOps process. Most developers are going to actively resist any approach to remediating vulnerabilities that takes time away from building new applications. Most of them only allocate about 10% of their time or less to remediating vulnerabilities. As such, it’s incumbent on a DevSecOps team to find ways to address application security issues in ways that don’t adversely impact developer productivity.

Organizations could mandate that vulnerabilities be remediated. In fact, there is a growing body of regulations that will require organizations to do just that unless they can prove the vulnerability in question cannot be exploited. The only way to effectively make that case will be to rely more on automation to document that the code running in a production environment is actually secure.

In the meantime, developers should expect to see their code scrutinized more than ever. Of course, the better part of valor is to ensure that as many vulnerabilities as possible are never introduced.

February 1, 2024
Cycode Discloses GitHub Actions Vulnerability in Google Bazel Project

Cycode today revealed it discovered a command injection vulnerability in the way the GitHub Actions continuous integration/continuous delivery (CI/CD) platform was used to update the open source Bazel project that many organizations employ to build and test software.

The vulnerability, now remediated, could have been used to create a backdoor through which malicious code could have been inserted into a codebase that is managed by Google.

Cycode researchers shared their discovery with Google, which has since updated the way it employs GitHub Actions to manage the Bazel codebase. Specifically, Google updated the base permissions to embrace least privilege principles to resolve the vulnerability discovered by Cycode.

The vulnerability was discovered using RAVEN, an open source tool for scanning CI/CD platforms for vulnerabilities that Cycode makes available.

Elad Pticha, senior security researcher for Cycode, said the vulnerability is the latest example of an instance of an open repository for building software that has been shown to be potentially vulnerable to an attack on a software supply chain that could theoretically impact any number of downstream applications and projects, including Kubernetes, Angular and platforms and services provided by Uber and LinkedIn.

A Custom Actions capability that enables application development teams to create their own workflows presents any cybercriminal attempting to compromise of software supply chain with a tempting target, noted Pticha. A few changes to lines of code in a workflow can translate into thousands or even millions of lines of code, many of which an organization may never detect. Out of 3.4 million workflows examined by Cycode, nearly all (99%) make use of one or more Custom Action.

Cycode has previously identified dozens of vulnerabilities in open source projects by mainly focusing on vulnerabilities within workflows. This latest research shows those vulnerabilities extend to indirect dependencies, such as Custom Actions, noted Pticha.

Each DevOps team should review its own workflows for similar vulnerabilities at a time when more cybercriminals than ever are intent on compromising software supply chains. While many organizations have embraced DevSecOps workflows to improve application security, there is a natural tendency to overlook vulnerabilities that might exist in the workflows used to build and deploy software. The challenge is that DevSecOps workflows are still immature. A recent survey of 500 U.S. CISOs, AppSec directors and DevSecOps team members conducted by Cycode found 78% admitted application security attack surfaces are unmanageable, with 90% acknowledging relationships between their security and development teams need to improve.

It’s not apparent if the vulnerability discovered by Cycode was actually ever exploited, but as most cybersecurity professionals know, if it can be imagined, someone has tried it. As such, any organization that uses Bazel might be well-advised to conduct a code review.

In the meantime, it’s already apparent that regulations pertaining to securing software supply chains are only going to become more stringent in the months ahead. In the wake of the executive order from the Biden administration requiring federal agencies to lock down their software supply chains, it’s now only a matter of time before similar requirements are baked into legislation and various other regulations are implemented. The challenge and the opportunity now is to get ahead of this issue before a mandate with a hard deadline that can’t be ignored winds up disrupting the entire software development life cycle.

February 1, 2024