Category: DevOps Culture

  • Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    In a cheeky extra post this week: Everyone’s favorite single-board ARM computer, the Raspberry Pi, has a new generation coming soon. Compared to the ’4, RPi5 has double the performance, quadruple the base RAM and far more capable I/O. (more…)

  • Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx, a provider of application security testing tools, today reported that malicious actors have been able to compromise the free automated dependency management tool for software projects, known as Dependabot, that GitHub provides.

    It’s not clear how prevalent the compromise is, but the attack involves the tokens that GitHub provides to allow access to Dependabot. Once cybercriminals gain access to a repository, they then add additional emails to the account that, once authorized, are used to inject malicious code into a repository that exfiltrates defined secrets to an external server. Cybercriminals can then modify any existing JavaScript files using a password-stealer to steal the credentials of any end user submitting their password in a web form.

    Guy Nachshon, a security researcher for Checkmarx, said Checkmarx was only able to discover the threat because one of the cyberattackers made a mistake. DevOps teams are advised to confirm the identity of each user that has access to both public and private GitHub repositories to ensure their software supply chain has not been compromised, he added.

    In general, attacks against software supply chains are becoming more sophisticated, noted Nachshon. Beyond launching phishing attacks to steal the credentials of individual members of an application development team, it appears cybercriminals are employing tactics and techniques that enable them to steal the credentials of an entire team contributing to a repository.

    These attacks, of course, have become a matter of national security. Governments around the world are crafting legislation that will hold organizations more accountable for the security of the applications they build and deploy. It may be a while before those proposals become law, but it’s clear the pressure on organizations to secure their software supply chains is building. More organizations than ever are, as a result, embracing DevSecOps best practices to better protect their software supply chains.

    The challenge is that many of the components used within those supply chains are from open source projects that organizations don’t have the ability to patch should a vulnerability be discovered. More troubling still, even when a patch is available, many organizations are reluctant to upgrade for fear of breaking an application. In effect, they are betting cybercriminals are not going to discover a potential exploit that exists in their application portfolio or that the damage inflicted will be less than what might otherwise be experienced should an application break following the update of a critical component.

    Playing the equivalent of Russian Roulette with application security is, to put it mildly, inadvisable. DevSecOps teams need to not only address vulnerabilities in applications as they are being built but also address the massive amount of technical debt relating to known vulnerabilities that have been allowed to accrue for more years than most anyone cares to admit.

    Unfortunately, cybercriminals are now clearly aware of the soft underbelly that exists within application environments, so the race to address an issue that has been allowed to fester is now on. And the odds, alas, are already stacked in favor of the malicious actors that are ready and willing to wreak havoc.

  • Atlassian Strengthens Jira Navigation and Integration

    Atlassian Strengthens Jira Navigation and Integration

    Atlassian today made it simpler to navigate the Jira Software and Jira Work Management project management applications as part of an ongoing effort to make it simpler for DevOps teams to collaborate with other stakeholders of application development projects.

    Megan Cook, head of product for Atlassian, said the ability to share release dates across multiple calendars, overviews that aggregate views of and summarize multiple projects along with command palette and importer tools make it simpler for, for example, marketing teams and other individuals outside of a DevOps team to keep track of application delivery schedules.

    In addition, Atlassian has tightened integration between Jira and Confluence, a wiki-based collaboration application, and a previously launched Atlassian Intelligence capability that infuses generative artificial intelligence (AI) capabilities will also soon be added to Jira Work Management alongside existing support for Jira. There will also be connectors for Jira Work Management to integrate with Atlassian Admin, Atlassian Analytics, Access and Data Lake offerings, along with advanced security features.

    Finally, Atlassian is adding support for a design tool developed by Figma that can now be directly installed in Jira.

    Collaboration between application development teams and the rest of the business is becoming more crucial as organizations increasingly realize how much they depend on software to drive revenue. One of the primary reasons Atlassian is investing in generative AI is to make it simpler for anyone to understand the status of any given project and the downstream impact any change to a delivery schedule is likely to have.

    Generative AI, of course, has already moved from being considered advanced technology to a set of capabilities that most end users will soon expect to be embedded within every application. One of the primary benefits generative AI provides is it makes a range of applications originally designed for specialists, such as a software engineering team, more accessible to a wider range of end users.

    It’s not clear how much generative AI will change the relationship between DevOps teams and the rest of the business, but with increased visibility, there should be a greater appreciation for the challenges developers and DevOps teams face. Any member of an organization should be able to plainly see, for example, why more resources need to be allocated to a specific project to ensure that an application is delivered on time.

    At the same time, application developers will find project management processes are about to become less disruptive as it becomes simpler to automatically import relevant data from the tools and platforms they use directly into a project management application such as Jira.

    One way or another, software engineers should expect that as generative AI continues to evolve, the divide between them and the rest of the business will narrow. There may be times when that level of additional scrutiny may feel burdensome, but on the whole, it should make it easier for DevOps teams to get the resources required to achieve any given goal. After all, the root cause of any given delay to a project will soon be plain for anyone to see.

  • Tray.io Automation Framework Leverages AI to Build Integrations

    Tray.io Automation Framework Leverages AI to Build Integrations

    Tray.io today added an automation framework to an integrated platform-as-a-service (iPaaS) service that leverages an existing Merlin artificial intelligence (AI) engine to identify the most efficient way to automate a workflow.

    The Tray Universal Automation Cloud service can be invoked via three distinct application programming interfaces (APIs) to programmatically create those workflows using a Tray Code low-code or Tray Build no-code tool or via a Tray Chat natural language interface. A Connectivity API provides access to more than 600 connectors, while a Trigger API enables developers to drive event-driven processes. An Authentication API provides a method for managing authorizations. The platform also provides access to testing, error handling and debugging tools.

    Tray.io CEO Richard Waldron said that approach provides IT teams with a composable framework for building integrations that leverages a set of large language models (LLMs) that the company has embedded within its Merlin AI engine to enable IT teams to optimize workflows.

    In addition, the underlying platform takes advantage of Kubernetes, Docker containers and serverless computing frameworks to dynamically scale as required, he added. In contrast, rival legacy iPaaS environments are not as elastic, which enables Tray.io to base its pricing on actual usage of a modern IT platform, noted Waldron.

    The overall goal is to provide a single platform that any type of developer, including business professionals, can invoke to automate workflows, said Waldron.

    As the overall codebase that DevOps teams manage continues to increase, the number of required integrations between applications and processes continues to increase exponentially. Rather than relying on lower-level code to create those integrations, an iPaaS provides the means to automate and simplify building integrations and enable developers to spend more time writing the business logic that will drive a new application. Historically, most of the integrations required to drive, for example, a digital business transformation initiative required a significant amount of low-level code to be developed and maintained.

    Tray.io is now making a case for an iPaaS that takes advantage of AI to more easily invoke generative AI capabilities to optimally create those integrations based on workflow attributes.

    Each organization will need to determine how heavily to rely on AI platforms to build integrations, but these advances—alongside generative AI tools that developers have already embraced to build software—are making developers more productive than ever. That accelerated pace of application development will require DevOps teams to automate as many processes as possible. One option for achieving that goal is for organizations to rely more on an iPaaS to enable developers to build integrations in a way that doesn’t necessarily always have to flow through a DevOps pipeline.

    One way or another, thanks to the rise of AI, the way software is built is about to change drastically. The challenge and the opportunity now is to determine how best to reengineer workflows in a way that best aligns with the goals of the organization.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Dice.com

    R&T Deposit Solutions
    New York, New York
    DevOps Engineer
    $145,000 to $175,000

    Indeed.com

    Caterpillar
    Chicago, Illinois
    DevOps Engineering Manager
    $141,000 to $178,000

    SimplyHired.com

    Takeda Pharmaceutical
    Boston
    Machine Learning Infrastructure/Platform Engineer
    $130,000 to $186,000

    LinkedIn

    M&T Bank
    Wilmington, Delaware
    DevOps Manager
    $123,000 to $206,000

    CareerBuilder.com

    Fidelity Investments
    Westlake, Texas
    DevOps Engineer
    $120,000 to $160,000