Category: DevOps and Open Technologies

Editorial Calendar for February 2016

  • Git for Mainframe: Back to the Future 

    Git for Mainframe: Back to the Future 

    Software delivery modernization should be done with care, especially with mission-critical mainframe apps. But for some, modernization will feel like a trip back to the future.

    Mainframe applications are typically systems of record with high-value transactions, significant compliance risk and an essential need for stability and security. They’ve been running reliably, often for decades, with code changes made by teams of dedicated developers using time-tested interfaces like ISPF (green screens) and Eclipse integrated with mainframe-based source management tools—Endevor is the most widely used example.

    So Why Modernize?

    Three primary drivers of change are present:

    • Business Agility: Digital disruption is generating an increased volume and velocity of business demands often resulting in cross-platform application architectures. It’s increasingly common to have cloud/mobile customer-facing apps calling back-end mainframe services for seamless experiences.
    • Staffing: A talent crunch resulting from career mainframers retiring while traditional mainframe practices and tools lack appeal for the next generation. Backfilling is a challenge as next-gens would rather be using popular, cloud-native tools that offer broader career potential.
    • Performance: DevOps adoption has raised the bar in terms of productivity, delivery velocity, quality, lead times, etc. The opportunity to achieve comparable performance levels with mainframe development is entirely possible but requires modernization.

    The confluence of these drivers leads to an obvious conclusion—the time for modernizing mainframe application development is now. Version control is the foundation of software development, acting as the focal point with IDEs/code editors, Agile tools, DevOps automation tools (like code scanners and CI/CD orchestrators) and service management tools. This article focuses specifically on the adoption of Git as a critical enabler of modernization.

    The Role of Git

    The next generation of talent, typically millenials and Gen Zs, know and love Git. With 94% of professional developers viewing Git as a fundamental development tool per Stack Overflow, it has become the de facto standard for enterprise IT, eclipsing all alternatives. Built initially for open source development of Linux, it offers a decentralized model where devs can work independently in branches yet collaborate closely through pull requests, issue management, etc.

    It has become so dominant that popular editors like VS Code have built-in Git capabilities. With the introduction of the free Code4z extension pack by Broadcom, VS Code and compatible tools (e.g., cloud-hosted GitHub Codespaces) are now viable options for mainframe developers, making Git adoption a natural, ‘parallel’ modernization opportunity. The Developer Cockpit Simulator illustrates the Git-ready experience using VS Code for mainframe application development.

    Back to the Future

    Beyond version control, leading Git platforms like GitHub and GitLab have expanded to become comprehensive DevOps platforms (e.g., GitHub Issues, Actions, Codespaces, Projects, etc.).  Yet the precedent for this evolution was set decades ago when Endevor was envisioned as an environment for development and operations with SCM at its core. Yes, DevOps before ‘DevOps’ ever existed. For many mainframers, seeing the Git version control tools evolve into comprehensive platforms comes with a distinct feeling of déja vu.

    With automation that has stood the test of time, Endevor delivers code changes reliably and, with workflows optimized for the platform, does so very efficiently and securely. And while Endevor is continuously updated with new DevOps capabilities—including the recently introduced Dynamic Environments to facilitate developer self-service—there is no denying that Git is valuable from an enterprise perspective. In addition to attracting next-gens and facilitating onboarding, a Git experience empowers any developer, if authorized, to easily update mainframe apps. All they need is a few mainframe basics and experience with the relevant languages (e.g., COBOL, PL/I).

    Back when the mainframe was the sole enterprise platform, a single, common experience was the norm, but IT evolved along many dimensions resulting in a sometimes disparate and siloed environment. Today, however, most developers are comfortable using multiple languages in a hybrid environment, so normalizing around a modern developer experience makes sense and brings things full circle.

    Git-Native Approach

    One option to take advantage of Git is to move source code to a Git enterprise server, but the inherent costs and risks associated with this approach should be carefully considered. Career mainframers are some of the most productive developers around and moving to a new paradigm will naturally be disruptive. In addition to changing workflows, this approach reestablishes build and deployment automation that has been working reliably for decades, which is both time-consuming and risky. Mainframe applications are often monolithic and complex with career mainframers’ expertise often filling gaps in documentation, so preserving this institutional knowledge should be a priority.

    Career mainframers can, of course, learn Git, but training takes time. And as many are nearing the end of their careers, will they be motivated to embrace the change? Repo migration may have the unintended consequence of accelerating the retirement of a critical knowledge base. As Deloitte forewarns in their Modernization and the Aging Workforce paper, “Don’t underestimate the value of legacy coders.”

    There are also costs associated with the migration—testing, documentation, training, project management—so the opportunity cost of porting code rather than investing in other high-priority business initiatives further qualifies this option.

    With these factors taken into consideration, migration should start with applications that are both stable (e.g., infrequent change requests) and pose a low risk to the business (e.g., lower dependence on career mainframers).

    A Git-native approach would require a specific tool such as Team Build, for example; a lightweight processor-based build engine that enables teams to collaborate natively using enterprise Git repositories while building on the z/OS platform. It is independent of Endevor and can be used for any build-and-ship needs for z/OS. It converts build logic in JCL and makes it maintainable off-platform with JavaScript.

    Hybrid Git Experience

    This ‘risk-managed’ option offers the benefits of Git—easier recruiting and onboarding, increased collaboration, etc.—while eliminating many of the costs and risks outlined above. With it, career mainframers continue working as they always have with existing tools and practices, without disruption, while next-gens use the tool they prefer, Git.

    Endevor Bridge for Git enables the Git experience with Endevor continuing to serve as the main repository. It accomplishes this by synchronizing a ‘source control mirror’ on the Git enterprise server. With this option, those who prefer to use Git can do so while colleagues using native Endevor can work on the same codebase at the same time. They can use Eclipse, VS Code or VS Code-compatible cloud-based IDEs, which offer the added benefit of working in Git without a local copy of the code.

    And with enablers like the Zowe CLI, modernizing-in-place offers the best of both worlds: Mainframe and off-platform tooling. For example, run Jenkins CI/CD pipelines for code scanning, testing and other functions off-host following a code change while allowing developers to continue to use the ISPF interface. To summarize, this option offers the advantages of the Git-native model without repo migration.

    Recommendations

    Due to the nature of mainframe applications, risk management is usually paramount so a thoughtful, pragmatic approach to the adoption of Git is recommended. Provide those career mainframers that are open to adoption with the time they need to embrace the technology by introducing Bridge for Git, for example. As organizations become more comfortable with the hybrid model and are satisfied they have enough Git-based developers with institutional knowledge of their codebase, they can identify apps to port to their Git enterprise servers.

    At the other end of the spectrum, for companies with a Git-only imperative, one option is migrating an initial set of applications quickly using, for example, Team Build. However, a cold cut-over at the portfolio level could be excessively disruptive and it’s not recommended. Accelerated retirements and/or increased retention costs are a real risk, so a phased approach over time is the best approach. The key to success with Git adoption is recognizing it is a journey for the organization that requires a well-thought-out plan.

    For a third-party perspective on the adoption of Git for mainframe apps, IDC has published an Infobrief, Git for Mainframe: Considerations for Enterprises, highlighting the opportunities and the challenges.

    There are many paths to modernization, so take advantage of others who have blazed the trail.  But whatever the approach to Git adoption, younger team members should be prepared for a “We were doing that way back when” story or two.

  • Libbpf Vs. BCC for BPF Development

    Libbpf Vs. BCC for BPF Development

    If you’re into Linux development, you’ve probably heard BPF mentioned over the last few years. BPF stands for Berkeley Packet Filter, and the technology has a large number of use cases. BPF apps can get deep access into an operating system and enable you to perform tasks such as high-performance load balancing, DDoS mitigation and more simply and easily.

    Libbpf and BCC-Tools are both sets of tools to help with BPF development. However, both of these have their own strengths and weaknesses. In this guide, you will learn in detail about the two tool collections and understand when to use them.

    What is BCC?

    BCC stands for BPF Compiler Collection and is one of the oldest ways to develop BPF applications. It helps you embed your BPF code into your user-space program in the form of a plain string. When the user-space program is executed by the kernel, BCC invokes its embedded Clang/LLVM, pulls in system-wide kernel headers and compiles the program on the spot. 

    Since BCC compiles BPF programs on the host machine, it ensures that the memory layout your BPF program expects is precisely the same as that of the target host.

    BPF programs are designed to be injected directly into a kernel, so BCC tools seem to be the perfect solution for developing BPF applications. However, they have proven to be bulky in the modern context due to their heavy reliance on the Clang/LLVM combination, which is resource-intensive. This has led to the need for a better, more modern solution to developing BPF apps.

    What is Libbpf?

    Libbpf is one of the hottest new BPF tools on the market. It is usually coupled with BPF CO-RE (which stands for compile once, run everywhere). BPF CO-RE enables you to generate binaries that run on multiple kernel versions.

    The idea behind Libbpf is to make BPF development as similar to other forms of development as possible. With BPF CO-RE, Libbpf does this by compiling BPF programs into small binaries that can be deployed to multiple deployment hosts. Libbpf does the setup work like loading and verifying programs, creating maps, attaching to hooks, etc., which enables developers to focus on more critical tasks at hand, such as program performance and correctness.

    Libbpf aims to eliminate the overheads associated with BPF app development and deployment by reducing the dependency on system-wide kernel headers as well as Clang/LLVM libraries for compilation on runtime.

    Libbpf Vs. BCC: Key Takeaways

    Now that you understand how each of these tools works, let’s compare some key benchmarks to learn when to use them.

    Dependency Management

    BCC relies on kernel header packages that need to be installed on the target host machines. While it is not a problem in most cases, it can get difficult to set up and maintain if you are working on multiple machines. 

    Libbpf, on the other hand, eliminates this issue by relying on a vmheader file. This file includes multiple kernel types which helps you to remove dependency from system-wide kernel headers.

    Compilation Style

    For programs written with BCC, compilation occurs at runtime. To facilitate this, such programs require Clang/LLVM be present on the host machine. This adds to the code footprint of your programs.

    Furthermore, the Clang/LLVM libraries are resource-intensive. Complete libraries need to be available and run at compile time, even for small programs. This can upset a perfectly balanced BPF workload on the host machine.

    On the other hand, Libbpf enables you to generate binaries that are compiled once and can be run anywhere. You do not need any system-wide dependencies to be present on the target machine for running such apps. Hence, it reduces the overall application size as well as resource consumption on runtime.

    Error Detection

    For apps developed with BCC tools, errors are detected only at runtime since that is when the programs are compiled. This leads to a rather sluggish development experience compared to apps developed using Libbpf. Since Libbpf enables compilation while developing, finding and fixing bugs is easier.

    Final Thoughts

    In this guide, we walked you through what Libbpf and BCC tools are and compared them based on some important aspects of application development and delivery. 

    All in all, Libbpf appears to best BCC tools in most aspects. BCC tools offer fast prototyping and experimentation possibilities, but when it comes to production deployments, BCC tools turn out to be a rather expensive choice compared to Libbpf. 

    You can learn more about why BCC became the popular alternative and how it was eventually replaced by Libbpf here. Even if you currently use BCC tools for your apps, you can easily migrate to Libbpf by following a few simple steps. And, in most cases, it is better to opt for Libbpf than BCC tools for a better development experience and application performance.

  • Game Developers Shouldn’t Overlook Python’s Potential 

    Game Developers Shouldn’t Overlook Python’s Potential 

    Python is an object-oriented, general-purpose and high-level programming language developed in 1991 by Guido van Rossum. Since its development, Python has become one of the most popular programming languages in the world. It often ranks high in popularity surveys—for instance, it claimed the top spot in the Popularity of Programming Language index and came in second in the TIOBE index.

    Python earned its acclaim as a widely used tool because of its suitability for multiple purposes and for various projects—from data analytics and visualization to artificial intelligence, language development, design and web development.

    That said, Python isn’t exactly renowned for its use in video game development. But should this mean game developers should just disregard Python completely? Not at all.

    Familiarity Breeds Productivity

    Thanks to the language’s simplicity and coding speed, Python is an excellent choice for prototyping. The work product is visible immediately and it’s possible to quickly deliver a playable project to potential investors.

    Therefore, Python is also an ideal language to begin a developer’s adventure with creating games, regardless of whether the user is already fluent in it or just starting out.

    Due to the newcomer-friendly syntax of Python, developers can focus on the basics of game programming, not the complexity of the language itself.

    The effects, which are quickly visible, allow beginners to get actively involved in the process of creating a project. Advanced developers, on the other hand, will appreciate the fact that they can create something playable using their familiar, everyday work tool and that the process of coding will be, as always, very enjoyable and satisfying.

    Preexisting Python Tools and Libraries

    Python programmers can also take advantage of tools that were written specifically for them.

    The most popular library that supports Python game development is PyGame. This engine, available under the LGPL, allows users to build fully commercial projects. Additionally, the library is designed in a way that lets users easily use multiple processor cores. The main functions were written in C and Assembler, thanks to which the user’s project will be 10 to 20 times faster than if it were written in Python alone. This tool is incredibly easy to learn. Its creators also have prepared extensive documentation to help guide users through the process. 

    There are also available tools for 3D rendering, such as Ursina or Panda3D. Of course, these aren’t the only technologies designed for Python users. In fact, there’s a really large selection of available tools and engines such as PyOgre, PyKyra and Ren’Py that are worth checking out.

    Lastly, the Kiva library should also be mentioned. It may not have been created with gaming in mind, but it’s perfectly suited for it. Kiva is a multi-platform tool for creating window applications quickly.

    Python for Game Development 

    If you Google, “Which language should I use for game development?” the first results you see will likely be recommendations to avoid Python. However, that shouldn’t be a deterrent; it can be done! 

    Python has received criticism in the past regarding its use in game development, mostly centering around the fact that Python is not designed for computational performance but, rather, coding performance. This is justified. 

    But if a user, programmer or game developer is already familiar with the programming tools and takes advantage of the preexisting tools and libraries at their disposal, then Python for game development has clear promise, both now and also in the future. 

    If you want proof that a game written in Python can be an international success, I recommend EVE Online—a title that attracts over 20,000 players each day!

  • Hasura Adds Join Capability to GraphQL Engine

    Hasura Adds Join Capability to GraphQL Engine

    Hasura today announced it has extended its GraphQL engine to make it possible to join data generated by multiple sources.

    Hasura CEO Tanmai Gopal said GraphQL Joins makes it possible to join data from across different GraphQL services that can then be accessed via a single GraphQL application programming interface (API). The extension of the federation capabilities enabled by the Hasura GraphQL engine eliminates the need for custom code that would otherwise be required to join that data, he added.

    The Hasura engine automatically generates a GraphQL schema from a data source that can then be used to accelerate the development of APIs. GraphQL Joins extends that federation capability to now include multiple GraphQL and, eventually, other data sources accessed via, for example, legacy REST APIs, said Gopal. That capability will make it easier for a wider range of developers to build applications that aggregate data across multiple sources, he added.

    The core Hasura Engine is based on open source software that the company claims has now been downloaded more than 500 million times. Hasura makes available a cloud service based on that core engine. That approach eliminates the backend complexity that IT teams encounter when adding GraphQL APIs to an application environment that already has a range of APIs that internal IT teams need to support, noted Gopal.

    GraphQL was originally created by Facebook, and it’s still not clear to what degree GraphQL APIs will supplant REST APIs. Developers tend to prefer GraphQL APIs because they provide more granular control over what data is accessed. The challenge is the number of backend services that expose GraphQL APIs is still comparatively limited. Most IT teams will not be replacing REST APIs with GraphQL-based APIs overnight, but the percentage of new applications that rely on GraphQL APIs will steadily increase. DevOps teams looking for easier ways to provide developers with access to backend services via a GraphQL API can employ the Hasura Engine to automate that process.

    Overall, the number of APIs employed within IT environments is rapidly expanding as more microservices-based applications are deployed. Each microservice generates its own API. Over time, IT teams will find themselves managing a range of types of APIs to support multiple digital business transformation initiatives that an organization may have simultaneously launched. In addition to building APIs, many of those organizations are now consuming data via APIs exposed by another organization. Over time, the level of interdependency between APIs and applications will serve to make application environments much more complex. The good news is that APIs make it easier to upgrade—and even replace—backend services without disrupting application services.

    It’s not always clear, though, who within IT organizations will manage those APIs. They are often created by developers that then look to IT operations teams to maintain them. Before too long, it’s not uncommon for IT teams to find themselves managing hundreds, perhaps thousands, of REST and web services APIs—and soon, that may include many built using GraphQL.

  • What Should Elon Musk Do? | Passwordless Future: Tense | WebKit iOS Monopoly Ends?

    What Should Elon Musk Do? | Passwordless Future: Tense | WebKit iOS Monopoly Ends?

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Everyone has Twitter advice for Elon, passwordless vision is vacuous, and Apple prevented from forcing Safari. (more…)

  • Report Finds Most Log4Shell Vulnerabilities Unpatched

    Report Finds Most Log4Shell Vulnerabilities Unpatched

    A report published today by Rezilion, a provider of a platform for tracking and analyzing software vulnerabilities, found that despite all the attention the Java zero-day Log4Shell vulnerability attracted, it appears that nearly 60% of the affected software packages remain unpatched.

    Rezilion used Google’s Open Source Insights tool to scan open source software packages, including dependencies, and found that out of a total of 17,840 affected Java software packages, only 7,140 have been patched.

    In addition, the Rezilion report cited a Log4j vulnerability resource center maintained by Sonatype indicated that 36% of the vulnerable versions of the Log4j Java log management tool that were actively downloaded from Maven Central are still vulnerable to Log4Shell.

    Rezilion also made use of dive, an open source tool for exploring Docker container images, to verify what version of Log4j might be present in containers, and Shodan.io, a search engine for discovering internet-connected devices.

    Yotam Perkal, director of vulnerability research for Rezelion, said that the results suggested that many organizations that have deployed a Java application have no way of knowing whether it includes the widely used open source Log4j tool for tracking logs within Java application. Many of the instances of that tool are subject to a recently discovered zero-day vulnerability that can be easily used to execute malicious code within a Java application.

    The challenge is that many organizations are using Java software components provided to them by a third party, and they assume that software is secure. However, that third party is often not aware of how that software may have been deployed, noted Perkal.

    More troubling still, many organizations that deploy software today don’t actively manage anything that might be considered a software supply chain, he added. Software is deployed as needed with little to no regard for provenance, said Perkal.

    Even when organizations can track software components, patching Log4j is a challenge. Java files can be nested layers deep into other files. Java applications can also be packaged in ways that make searching for vulnerabilities more difficult.

    Naturally, much of the responsibility for discovering instances of vulnerable Java applications falls to DevOps teams. As organizations embrace DevSecOps best practices that revolve around a software bill of materials (SBOM), it becomes easier to track vulnerable software packages. The issue is that most organizations either don’t have an SBOM or fail to update it as applications are upgraded. In the absence of an SBOM, many DevOps teams are still looking for instances of Log4jShell four months after the initial vulnerability was disclosed.

    Unfortunately, this latest vulnerability crisis doesn’t appear to be the wake-up call that drives more organizations to implement DevSecOps workflows, said Perkal. While some organizations are proactively patching applications, many others are still waiting on updates from a third party they hope will address the issue. Those updates, however, may not arrive in time to prevent cybercriminals that know about the Log4jShell vulnerability from wreaking havoc.

  • Wi-Fi 7 Chips Ahoy | Google ‘Gone Downhill Fast’ | Real-World ‘Severance’

    Wi-Fi 7 Chips Ahoy | Google ‘Gone Downhill Fast’ | Real-World ‘Severance’

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The first silicon for Wi-Fi 7, Google’s search quality “is” failing, and what Severance tells us about The Great Resignation. (more…)

  • Not Totally Buying Web3? You’re Not Alone

    Not Totally Buying Web3? You’re Not Alone

    The interest in Web3 is heating up. We’ve seen major excitement around blockchain and new Web3 protocols that are poised to reinvent the web as we know it. But it’s hard to hide the skepticism and the suspicion that there are ulterior motives behind large cryptocurrency coin fundraisers. There’s no doubt that there are benefits to the Web3 movement — the decentralized nature of Web3 brings innovative forms of shared ownership. Yet, both the marketing hype and investment fervor could get in the way of actual progress in the industry.

    I recently met with Netlify CEO Matt Biilmann to discuss the missing piece of Web3. For those who don’t know, Netlify has been a big proponent of the JAMstack movement, a design style incorporating JavaScript, APIs and Markdown (hence, JAM). The headless approach decouples the frontend and backend, enabling easier multi-platform support and other benefits.

    According to Biilmann, the theory behind Web3 is exciting and sound and it fits into the headless movement quite well. Yet, in practice, Web3 will require more emphasis on interoperability and open standards, said Biilmann. Without inter-chain portability and better data control, the trend will likely fall victim to the same walled gardens and centralization that underpins the current web. There are some other concerns to keep in mind about Web3 and blockchain, which we’ll explore below.

    Back to The Open Web

    First off, what exactly is Web3? Well, Web3 is a broad term with loosely-related phenomena, but it can be summed up as a new web designed with decentralized technology and built on blockchains with distributed ownership. “There’s a general sense behind the Web3 movement that goes back to roots of the web as a non-centralized entity,” explained Biilmann.

    Whereas in Web2 users were participating in someone else’s walled garden, the concept behind Web3 is that it’s fundamentally open. But how do we make more pieces of the stack a collaborative standard with no single owner? According to Biilmann, this is the aspect that the industry should expand upon.

    Issues With Web3

    There’s a lot of speculation. One big issue Biilmann foresees with Web3 is the rampant speculation. The long-term success of new Web3 projects founded on a blockchain is muddled by the fact that the creators wanted people to buy in so tokens rise in value. “How much of the underpinnings of Web3 are actually solving real problems and how much is pure speculative investment?” he asks. It’s not always apparent whether, behind their flashy, chic facades, blockchain solutions solve real problems.

    A lack of inter-chain interoperability. A lack of interoperability between the many emerging flavors of blockchain could also pose a risk to this fledgling space. “To what degree are they actually building things around standards with the possibility to move from one player to the other?” asked Biilmann. “We need open standards where you can migrate from one to the other.”

    Centralization still exists. No matter what the copy around decentralization said, there will still be players who hold more control and power in a capitalist economy. According to Biilmann, it will be important to make platforms fundamentally open and extendable to avoid creating more walled gardens. He admitted that having strong central providers is not a huge problem as long as these open platforms provided interoperability.

    A lack of identity portability. When a person owns a web domain, they can move content around freely from server to server. In a similar vein, Biilmam believes that comparable freedom is necessary for identity within Web3. The ideal is to increase ownership and portability of one’s digital identity. Yet, Biilmann questioned whether blockchain is the best vehicle for that goal, especially as competing blockchain protocols could interfere with portability.

    Blockchain will still hinge on the authority of an external source. Another issue is how blockchain will interface with reality. Often, a smart contract will point to a URL for an off-chain context without a strict guarantee of what’s happening outside of the chain. If blockchain must depend on the authority of an external source, this is somewhat counter to the ideals of an interdependent network. “Most of the time, you have to trust a provider between what happens in blockchain and what happens in the outside world,” explained Biilmann. In this scenario, the integrity of the blockchain could end up revolving around a single entity.

    Connecting blockchain to the outside world is hard. On that note, the exact process for interfacing with off-chain constructs is still being developed. This usually relies on a third-party oracle model, although some headway has been made to eliminate the oracle concept in favor of a more modern standard for integrating off-chain computations.

    Every operation incurs high processing costs. Blockchain requires excessive processing power to accomplish simple tasks, which can be wasteful at scale both in monetary and resource terms.

    The benefits of NFTs are greatly exaggerated. NFTs won’t likely help the majority of creators. As Kimberly Parker explained, NFT platform sales data showed “an acutely minuscule number of artists making a vast amount of wealth off a small number of sales while the majority of artists are being sold a dream of immense profit that is horrifically exaggerated.”

    NFT scams are common, and since minting an NFT requires exorbitant platform fees, the likelihood of an artist recouping their upfront investment is minimal. “I think that people who stand to gain the most are people like the Winklevoss twins, who are already mega-rich and own an NFT platform,” Cat Graffam said on Time.com. “The biggest losers are the vast majority of unestablished artists that are attempting to break into NFT sales.”

    Keeping Alternative Options On The Table

    “Let’s not jump to the conclusion that cryptocurrencies and blockchain are the solutions,” said Biilmann. As he noted, people have been tinkering with ways to open up identity and data for decades now. These thinkers may also have relevant insights and alternative solutions that shouldn’t be dismissed or ignored.

    For example, Tim Berners-Lee, inventor of the World Wide Web and the HTML programming language, has been spearheading a new initiative called Solid. Solid is a “proposed set of conventions and tools for building decentralized social applications based on linked data.” The project’s goal is to enable true data ownership and better privacy. “If we’re after the goal of an open web, we should be just as curious to know what they’ve been studying for years,” said Biilmann.

    We may be seeing Web3 projects excel simply due to the underlying speculative interest in cryptocurrency, Biilmann said, not that they’re technically the best solution or have the best open ownership model. Other solutions include IPFS for high-volume distributed storage. Or, take DNS, the decentralized naming system at the core of the web—”that part of the existing web is already very open and user-owned,” said Biilmann.

    Goal: Plant Gardens Without Walls

    “I’m excited about this—personally, I hold no grudge about the tech,” Biillmann clarified. “Making identity and underlying data fundamentally more open is awesome.”

    But, at the same time, the space is too speculative and too far removed from building useful things for users, said Biilmann. There is also a pressing need for interoperability and portability in the blockchain industry. And with so much noise driven by the interest in tokens, it could be more beneficial for society to trust a more neutral party in architecting the fabric of our digital lives.

    “It’d be a shame if people forget what we can build already,” said Biilmann, pointing to pre-existing technologies like IPFS and DNS. Although these open standards won’t make early stakeholders rich in the short term, they could help get us to that open state even faster.

    Web3 is still in an early space. And if we separate currency from this ambition, it could deliver tremendous outcomes. “Let’s figure out how we make identity and data open and not tied to specific walled gardens,” said Biilmann. “That’s something we, as an industry, should work toward.”

  • ForAllSecure Adds Free Testing Tools for OSS

    ForAllSecure Adds Free Testing Tools for OSS

    ForAllSecure is investing to make open source software (OSS) more secure and is making available free, personal-use versions of its Mayhem application security testing tools infused with artificial intelligence (AI) capabilities to anyone using GitHub repositories.

    Company CEO David Brumley said anyone who integrates Mayhem into a qualified GitHub repository being used to build open source software will receive $1,000 as part of the company’s Mayhem Heroes program.

    There are now two free, personal-use editions of Mayhem that can be used to analyze code or application programming interfaces (APIs). Those tools are based on fuzz testing technology, which randomly injects data into applications to detect vulnerabilities as part of an effort to automate DevSecOps processes.

    In the wake of the discovery of zero-day vulnerabilities in open source software that have impacted enterprise IT organizations, more attention is being paid to how open source software is created, maintained and secured. Many of the developers who build and maintain open source software don’t typically have a lot of cybersecurity expertise, and don’t have the time and resources required to continually remediate vulnerabilities as they are discovered. The Mayhem application security testing tools are designed to make it faster to discover vulnerabilities using AI technologies to reduce the number of false-positive alerts.

    It’s too early to say how quickly open source software might be made more secure, but tons of resources are being made available. The Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, has raised more than $10 million to build tools and define best practices for securing open source software projects. Google has pledged to spend $10 billion to improve open source security. The Biden administration has also made improving the security of open source software used inside (and outside) government agencies by expanding compliance mandates. The White House is also trying to encourage IT vendors and larger enterprises to contribute more to the effort to secure open source software.

    The pressure is rising on both developers and consumers of open source software to make sure open source software is secure. However, many open source projects are maintained by a small number of programmers who contribute their time and effort to build components that others are free to use. Many of them argue it is the responsibility of the organizations that deploy that software to ensure the software is secure  Many IT vendors and large enterprise IT organizations that rely on that code aren’t contributing anything meaningful back to the project, in terms of either financing or just helping open source maintainers find and remediate vulnerabilities. The irony is many of those same organizations are now assessing whether the open source software they employ is, from a security perspective, actually sustainable in the absence of those contributions.

  • Russian Dev Exodus | Puppet IPO FAIL | Intel 18A Ahead of Sched.

    Russian Dev Exodus | Puppet IPO FAIL | Intel 18A Ahead of Sched.

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: More than 100,000 tech workers leave Russia, Perforce buys Puppet, and Intel moves faster than planned. (more…)