devopsy.kinsta.cloud

Category: DevOps and Open Technologies

Editorial Calendar for February 2016

  • CD Foundation Embraces Ortelius to Manage Microservices Deployments

    CD Foundation Embraces Ortelius to Manage Microservices Deployments

    The Continuous Delivery (CD) Foundation has added the open source Ortelius platform for managing the deployment of microservices as an incubation level project.

    Originally developed by DeployHub, Ortelius was created to provide a means to automate configuration at the application level. It also provides a central catalog of services that makes it easier to consume and deploy services across clusters that also tracks application versions and dependencies as updates to services are made.

    DeployHub CEO Tracy Ragan said Ortelius is now being donated to the CD Foundation, an arm of the Linux Foundation, which is working to create de facto continuous delivery standards. As such, Ortelius will benefit from contributions from other members of the consortium that includes Google, CloudBees, CircleCI, JFrog, IBM, GitLab, Netflix and DeployHub.

    The core CF Foundation projects are the open source Jenkins continuous integration/continuous delivery (CI/CD) platform; Jenkins X, an open source CI/CD solution on Kubernetes; Spinnaker, an open source CD platform; and the Tekton specification for building CI/CD components.

    Ortelius already integrates with CD orchestration tools and deployment tools such as Helm, Ansible and Spinnaker. The opportunity now is to address the entire application development life cycle of cloud-native applications using a GitOps methodology, said Ragan.

    While in theory the rise of Kubernetes should make it easier to automate CD processes across multiple platforms, Ragan noted that in practice there are still substantial differences between instances of Kubernetes that will require tools to automate the rollout of microservices across multiple clusters. Ortelius allows IT teams to logically manage groups for microservices as a single entity in much the same way IT teams manage monolithic applications as a single entity, she said.

    Ragan also noted that not all microservices are of equal value, so different approaches to managing them are required based on the number of dependencies they have and the value of the microservices to the business. As it becomes apparent IT teams will soon be managing perhaps thousands of microservices, the need for a standard approach that integrates with multiple CD platforms becomes more acute. In fact, she said, IT teams are approaching a new era when chaos engineering principles will need to be applied to the management of microservices.

    Longer-term, Ragan said Ortelius will also make it feasible to employ machine learning algorithms to provide predictive analytics that can be used to optimize the microservices environment. That capability eventually will provide a critical capability for managing microservices at scale. It may also serve to further the adoption of best CD practices that thus far have proven elusive to achieve in IT environments where each platform has unique attributes that make automating application delivery challenging regardless of what type of application is involved.

    In the meantime, IT organizations are being invited to contribute to the Ortelius project, now that it’s part of the CD Foundation. The more contributions that are made, the sooner the Ortelius platform graduates, which can’t come soon enough for many organizations that have already invested in microservices.

  • Linux Foundation Exam for Certified IT Associates Available

    Linux Foundation Exam for Certified IT Associates Available

    A while back I wrote about an upcoming certification people receive from passing the Linux Foundation Exam. Now that it is available, I’m circling back as promised with more information.

    For those unfamiliar, this certification is specifically targeted at people who are newer to their IT career or just launching it. The goal is to offer an onramp for people to show their basic skills and demonstrate to potential employers their ability to get the job done or learn what is needed. It fits in well with their other offerings, giving Linux admins a path to use the foundation’s certifications to reflect progress in their career.

    I have information about the beta test, more information about what is stressed in the testing, and availability information, so let’s dive right in.

    First off, for those like me who have a friend that might benefit from using this test, it is available for purchase now and can be scheduled in January 2021.

    Who is the Linux Foundation Exam for?

    This exam is aimed at entry-level IT folks or those who are contemplating a move to DevOps. Though it is not targeted at help desk people aiming at systems admin jobs, it is suitable for them also. Its goal is to provide employers with proof of a minimum set of skills in IT basics, with (unsurprisingly) a strong emphasis on Linux. An interesting application that Lee Marer of Outcert, one of the Linux Foundation’s partners, pointed out to us was interest from K-12 and colleges—it could be a benefit to people who are recently out of school to already have something that shows they know their way around.

    Specifically, Lee thought the following groups would benefit from the test, and sees interest from these groups:

    • K-12/College: Already mentioned. A good way to offer practical benefit to coursework and offer prospective employers a hint at an inexperienced student’s capability.
    • Those moving to DevOps: Because a lot of DevOps is open source, a lot of DevOps depends upon Linux. This test shows those looking to move have the background required.
    • Those who are intimidated by the more advanced tests available from the Linux Foundation and others. My friend fits into this category. The amount of prep required to pass some tests is not on par with the practical knowledge they test for. This test offers a stepping stone that allows users to study the basics before being asked to advanced tasks such as (for an extreme example) parsing packets.
    • Employers: This exam proves a basic understanding of the topics covered, allowing employers to say “Must have passed this exam” in place of “Must have Doctorate and 15 years of experience.” (I joke, but it does offer employers a bar for help desk or entry-level DevOps.)

    What’s in the Linux Foundation Exam?

    Specifically, Dan Brown, senior manager, content and social media at the Linux Foundation, told us that the test would cover the following topics:

    • Linux Fundamentals (20%)
    • System Administration Fundamentals (20%)
    • Cloud Computing Fundamentals (20%)
    • Security Fundamentals (16%)
    • DevOps Fundamentals (16%)
    • Supporting Applications and Developers (8%)

    We had hoped to have a couple of sample questions for you, as an example of what to expect from the test and from those who took it. As of this writing, answers to those questions are not available. We’ll keep you posted.

    How Can I Take the Linux Foundation Exam?

    As mentioned above, it is available for purchase now (at a good price for an exam), and the scheduling of exams opens in January 2021.

    Tests are delivered remotely, with a live proctor and monitoring used to ensure it is an evaluation of the test taker’s knowledge, as opposed to the test taker’s ability to look up answers.

    This will be a point of contention, as it is in interviews and other exams. Simply put, the ability to look up what you don’t know and apply what you find to answer your questions/fix your problems is a critical skill at this point in IT. But for an entry-level test, I think that proving you have the basis to even understand what you are looking up is more important. So while I believe that unfettered internet access should be available during higher-level tests, for this test it makes perfect sense to me that monitoring will detect searches for answers.

    So Why Cover it Here?

    I think that this industry has developed a kind of psychosis. We talk about skills being more important than formal education and for entry-level positions, ability being at least as important as experience. Yet, job postings read like wish-lists. No, I don’t have five years’ experience in that three-year-old tech, thanks. The Linux Foundation Exam offers an avenue for organizations to demand basic competence without going crazy on a laundry list of items. For help-desk, for admin, for DevOps, this test would prove basic competency in a swath of Linux applications and utilities that would simplify the hiring process. I think we need that. I think we need that across the board, but starting with entry-level is good for me. Priced to be available to entry-level people, gauged to judge their basic knowledge, and from an authority on Linux, this might just be the answer at the bottom end of the scale.

    In fact, combining this test with a demonstrated ability to look up and comprehend answers would be all that is needed for most entry-level positions. Employers get assurance that they’re making the right hire, applicants don’t have to try and figure out which of those “requirements” is actually a requirement. Everyone wins. But only if we’re talking about it. So I’m talking about it, to people who’ve laughed at job postings before and know something like this could help: You. Keep kicking it, and consider this another tool to get co-workers who can kick it, too.

  • Gravitational Becomes Teleport to Streamline Access Management

    Gravitational Becomes Teleport to Streamline Access Management

    Gravitational today announced it has changed its name to Teleport and launched the Teleport Unified Access Plane, an open source security gateway that comes in the form of a single binary that acts as a proxy for remotely accessing Linux servers and Kubernetes clusters.

    Teleport Unified Access Plane (UAP) for managing those gateways can be either deployed by an IT team or accessed via a cloud service managed by Teleport.

    Offerings included in Teleport UAP are Teleport Server Access, Teleport Kubernetes Access and Teleport Application Access, which combined enable IT organizations to lock down access to an IT environment.

    Company CEO Ev Kontsevoy said Teleport UAP gives engineers via a single login access to just the IT resources they have permission to access. That approach reduces the myriad credentials that IT organizations currently need to manage across multiple networks.

    Teleport automatically discovers all the resources in an IT environment along with the protocols needed to access them. It provides a unified audit log in a JSON format that enables IT teams to track what resources are being accessed when and by whom.

    Access control is becoming a bigger issue because the overall IT environment is becoming more complex as the infrastructure stack required to run applications grows. Teleport provides a way to streamline access management across servers, clusters and databases.

    That issue is also becoming a bigger challenge with IT personnel now working from home to help combat the spread of the COVID-19 pandemic, added Kontsevoy.

    That fine-grained approach to access will ultimately eliminate the need to rely on virtual private networks (VPNs) at a time when the network perimeter continues to dissolve. In effect, Teleport enables IT teams to move toward a more identity-centric approach to unifying the management of access, he said.

    In general, he noted, Teleport enables organizations to manage security as code rather than having to rely on separate overlays. As such, they can shift responsibility further left toward DevOps teams.

    It may take some time for IT teams to aggregate all the access control protocols they currently employ under a single proxy. However, Kontevoy said, the massive amount of time and effort spent managing access control today will drive organizations that have embraced best DevOps practices to look for ways to automate what today is a very manual process.

    The challenge, of course, is finding the time to achieve that goal. Teleport is betting a single binary in combination with a control plane accessed primarily as a managed service will make it too simple for DevOps teams to ignore. Regardless of approach, however, it’s clear there needs to be a better way to manage access within the sea of servers, databases and applications that now make up the typical IT environment.

  • Dynatrace Adds to Observability Capabilities

    Dynatrace Adds to Observability Capabilities

    Dynatrace today announced it has extended its observability capabilities via the launch of its PurePath 4 platform that adds support for the open source OpenTelemetry framework and W3C Trace Context specification for distributed tracing.

    In addition, the company is adding support for service meshes and serverless computing frameworks running on Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform.

    Alois Reitbauer, chief technology strategist for Dynatrace, said by adding support for open source tools to gather metrics, the total cost of achieving observability is being driven lower at a time when a transition to microservices-based applications is making the need to observe applications more crucial than ever.

    Dynatrace is adding support for OpenTelemetry and W3C Trace Context to a platform that has already supported distributed tracing since 2006 via its OneAgent software. Dynatrace is now becoming the latest provider of observability tools to embrace open source software to instrument applications as part of an effort to focus engineering efforts on advancing analytics capabilities.

    In the case of Dynatrace, those capabilities are driven by a Davis artificial intelligence (AI) engine embedded within the Dynatrace platform and SmartScape continuous topology mapping technology. The combination of those technologies makes it possible for Dynatrace to automatically discover changes to IT environments and surface the root cause of any issue that might arise, noted Reitbauer.

    Despite being widely available via application performance monitoring (APM) tools, distributed tracing is now coming into vogue. As application environments become more complex, there is a need to more deeply analyze events to discover the root cause of an outage or performance issue.

    The challenge has been that applying that level of instrumentation to applications has been costly. Many IT organizations have historically limited the use of APM tools to their most mission-critical monolithic applications. It’s also worth remembering that three-tier applications are easier to troubleshoot because the potential source of any issue is probably already well-known to the IT team, he added.

    Given all the dependencies that exist between microservices, however, Reitbauer said the need to understand what’s occurring within an application environment more deeply is becoming a bigger requirement.

    Observability, of course, has always been a core tenet of best DevOps practices. The level of observability depth required by DevOps teams has tended to vary widely. Increased adoption of microservices-based applications invariably will push more IT organizations toward embracing DevOps at increasing levels of sophistication and maturity.

    In the meantime, the observability wars among platform providers are intensifying. There’s no shortage of options to achieve that observability, so it will be up to each IT team to decide which platform might best suit their DevOps workflow. Dynatrace is betting that as more applications become instrumented, deciding which platform to employ will shift closer to the AI capabilities that enable issues to be resolved issue faster regardless of what type of application is deployed rather than the capabilities of the agent software employed to instrument applications.

  • Open Source Software and the Tragedy of the Commons

    Open Source Software and the Tragedy of the Commons

    With many eyes looking at code, “All bugs become shallow,” as software developer and author Eric Raymond called Linus’s Law in action. This is one of the reasons behind the popularity of open source: the volunteer communities working to improve and update the code.

    And according to a Purdue University study, Linus’s Law does, in fact, work. Open source communities regularly issue patches faster than their proprietary software counterparts. However, Linus’s Law only works when there are enough eyes on the code. And there’s no guarantee that the community behind any given open source project will continue maintaining the code.

    Of the 1,200+ codebases examined for “2020 Open Source Security and Risk Analysis” (OSSRA) report, 88% contained open source components that had had no development activity in the last two years.

    Now let’s take a trip back in time to glean a few lessons that history has offered. You see, in the early 19th century, “free lunches” were a popular saloon promotion. Patrons had to buy a beer (or drink or alcoholic drink of their choosing) to wash down whatever food the barkeep offered. And there’s the catch.

    Profits on whiskey and beer sales more than compensated the saloon for putting out the free lunch spread, which often was little more than soup, crackers and problematic pickled eggs. There’s a price for everything—whether evident or not.

    With popular open source code, this price of a free lunch has increased the pressure on those maintaining it—those who handle bug reports, feature requests, code reviews, code commits, etc., for their so-called “free” software. Increasingly, as open source grows in popularity, the price of free lunch has been developer burnout and the abandonment of their open source projects.

    It’s the tragedy of the commons in action—a resource growing so much in popularity that it can’t remain viable unless the community shifts to sustenance rather than exploitation. Witness the Twitter thread started by James M. South, creator of several popular open source solutions, who bemoaned the fact that, “#ImageSharp passed 6 million downloads this weekend and I’m a lot less happy about it than I probably should be.”

    South goes on in several follow-up tweets, “Over 5 years of development there have only been 98 collaborators, 23 of which have made more than 10 commits. … It’s not about money, it never was and never will be, it’s about sustainability.”

    Too few people—and their organizations—who rely on open source software are contributing to the projects they use. If you’re a developer and have a favorite open source component, you can contribute to its development through development, sharing your modifications, bug reporting, crowd-funding, letting the developers know how you are using it and helping others get started. That last may be the most important thing you can do for any open source project—helping build a user community large enough to sustain the project.

  • Logz.io Embraces Jaeger for Distributed Tracing

    Logz.io Embraces Jaeger for Distributed Tracing

    Logz.io announced at its online ScaleUp! 2020 conference announced today it has added support for open source Jaeger distributed tracing software to its observability platform based on a curated instance of open source Elasticsearch, Logstash and Kibana (ELK) software.

    Logz.io CTO Jonah Kowall said support for Jaeger extends the reach of the open source platform by enabling the platform to consume data generated by Jaeger agent software, which is now being deployed more widely to instrument complex distributed computing applications.

    Jaeger, which is being developed under the auspices of the Cloud Native Computing Foundation (CNCF), is finding traction among DevOps teams who are deploying microservices-based applications based on containers, which tend to have a lot of dependencies that are challenging to monitor and troubleshoot.

    A survey of more than 1,000 DevOps and software development engineers conducted by Logz.io finds 50% of respondents have half their applications or more running in containers, with 38% using service meshes and 33% employing serverless computing frameworks. The survey also finds 87% of respondents view their main observability challenges to be Kubernetes, microservices and serverless frameworks. The most common Kubernetes difficulties cited are monitoring and troubleshooting (44%), followed by security (35%), networking (34%) and cluster management (30%).

    More than a quarter of respondents (26%) said they already make use of distributed tracing, with 68% reporting they expect distributed tracing to play an important role in their observability strategy. Nearly two-thirds said they expect to implement distributed tracing in the next two years, with 91% of respondents reporting they already employ two or more observability tools. The most commonly used tools are log management and analysis (90%) and infrastructure monitoring (78%).

    Just over half of respondents (56%) also noted that more than half their infrastructure now resides in the cloud, with 42% noting that cloud now accounts for more than 75% of their infrastructure. Amazon Web Services (AWS) is the most widely used cloud (66%), followed by Microsoft Azure (12%) and Google Cloud Platform (11%).

    Kowall said that while interest in employing ELK along with visualization tools such as Grafana is rising to reduce the overall cost of observability, IT organizations are also making it clear they don’t want to integrate an ELK stack themselves. Most IT organizations would prefer to focus their efforts on building and deploying applications rather than maintaining an observability platform.

    The rise of microservices clearly is forcing the observability hand of more organizations. Most application performance management (APM) tools use has been limited to mission-critical monolithic applications because of the cost of deploying proprietary agents and platforms. Open source platforms now present an opportunity to observe both microservice and monolithic applications at a time when the overall IT environment has become much more difficult to manage.

    There is, of course, no shortage of options when it comes to achieving the observability of IT environments. The challenge now is determining how much observability is actually required and at what level of acceptable cost.

  • The Value of OpenTelemetry in Observability

    The Value of OpenTelemetry in Observability

    As infrastructure becomes more complex, the quest for better observability continues. With increased containerization, third-party applications and generally increased network complexity, it becomes difficult for organizations to track issues of stability and performance. But OpenTelemetry can be used to improve upon observability throughout a network by enhancing and consolidating reporting throughout all applications and services.

    So, what is OpenTelemetry and how can it help your organization’s processes? Here’s what you need to know.

    What is OpenTelemetry?

    OpenTelemetry is a Cloud-Native Computing Foundation (CNCF)-curated open source set of libraries, agents and components designed to increase the visibility of services. Through OpenTelemetry, organizations are able to better collect telemetric data for the purposes of debugging and management. A scalable, flexible solution, OpenTelemetry is able to adjust to organizations as they continue to grow.

    With OpenTelemetry, data is collected through:

    • Metrics
    • Distributed Traces
    • Resource Metadata
    • Logs

    The data is then sent to back-end platforms such as Jaeger or Prometheus for processing. All of this together enhances observability for the organization, making it easier for an organization to collect the data it needs to observe and mitigate issues appropriately.

    Greater levels of observability improve an organization’s reliability and reduce downtime. With better reliability, organizations are able to track down and resolve incidents much faster. Before the OpenTelemetry solution, developers might have used OpenCensus, OpenTracing or other similar products. While these products are excellent on their own, they don’t necessarily meet all the needs of modern networks.

    How Does it Work?

    OpenTelemetry works on three major observability systems: tracing, metrics and logging. For tracing, OpenTelemetry makes it easier to identify failures and performance issues by tracking requests within the system. For metrics, processes running within the system are closely tracked and reported on, with histograms, gauges and other easy-to-read graphical reporting. For logging, application-specific messages can be analyzed.

    Observability throughout a system has always relied upon tracing, metrics and logging. But it’s more difficult to complete tracing today because each action needs to go through so many layers of application and resources. When paired with vague log data, the process of tracking down a single incident can take hours, because the information isn’t always consistently siloed. OpenTelemetry (and other similar products) work to correct this by creating a consolidated system by which metrics, tracing and logging can be brought together.

    As an open source project, OpenTelemetry is available on GitHub for those who want to be a part of the community to influence and improve it. Of course, OpenCensus and OpenTracing are also open source solutions.

    So what’s the difference between OpenTelemetry, OpenCensus and OpenTracing? When should one be used over the other? And can they be used together?

    OpenTelemetry vs. OpenCensus

    Let’s take a look at OpenTelemetry versus OpenCensus. Both are used to boost observability, but they are generally mutually exclusive platforms because they each tackle the issue of observability from different angles. OpenCensus provides distributed tracing and time-series metrics from applications via a collection of libraries. Applications need to download a metrics exporter, and which one is used depends on the application microservices involved. OpenCensus will collect trace data, but OpenCensus will also collect time-series metrics. OpenTelemetry is used to connect OpenCensus and OpenTracing, providing the benefits of both. This creates a far more robust observability solution.

    OpenTelemetry vs. OpenTracing

    OpenTelemetry versus OpenTracing is similar to OpenTelemetry versus OpenCensus. OpenTracing also solves the same problems as OpenCensus but is usually mutually exclusive. OpenTracing is a specification for tracing APIs rather than library. Developers are able to either create their own tracer or use the OpenTracing version. OpenTracing is often faster and easier to deploy and use, but may not provide as robust analytics or metrics as OpenCensus. But again, OpenTelemetry makes it possible to use both OpenTracing and OpenCensus at the same time, through its consolidated libraries and support.

    OpenTelemetry is an ideal technology for organizations that want to increase their observability. Through OpenTracing, developers are able to achieve greater levels of visibility throughout the network; track metrics and performance; and react to issues within the organization swiftly and more accurately.

    While in the past developers may have been limited to either OpenTracing or OpenCensus, today developers are able to use OpenTelemetry for both function sets. Even better, since it remains an open source solution, developers are able to contribute to the OpenTelemetry community.

  • Survey Sees Faster Shift to Open Source Software

    Survey Sees Faster Shift to Open Source Software

    A survey of 638 IT professionals finds the economic downturn brought on by the COVID-19 pandemic is, like other slumps, driving increased adoption of open source software.

    Conducted by Tidelift, a provider of commercial support and maintenance for open source projects, the survey finds 44% of respondents reporting their organizations are now more likely to use more open source. The survey also finds 42% of organizations have cut their application development budgets this year, with only 10% seeing an increase.

    More than two-thirds said saving time and money is the top reason to use more open source for application development during the downturn (68%) while increasing efficiency of application development and maintenance was cited by almost half of respondents (48%).

    However, reliance on open source software comes at a cost. The top two open source challenges cited are making good decisions about which components and versions to employ and making good decisions about when to upgrade components and frameworks, at 62% each. The third top challenge is identifying security vulnerabilities (49%).

    Only a small fraction (18%) of organizations are extremely confident that their open source components are secure, up-to-date and well-maintained, and slightly fewer (17%) have a formal process for managing open source.

    Tidelift CEO Donald Fischer said the current downturn is not all that much from previous economic slumps that lead to many organizations adopting an “open source first” approach to software. The challenge is many of those organizations don’t always appreciate the total cost of employing open source software. With each new open source project that gets added to the enterprise IT portfolio, the need to rely on external support services becomes more pressing, he said.

    One thing that has changed over the years is more end user organizations are contributing to open source projects, with 83% of respondents reporting their organization contributes to open source projects. Almost half (49%) of organizations now have policies governing employee contributions to open source.

    While many organizations initially view open source software as a way to reduce costs the days when the open source community was primarily focused on providing free alternatives to commercial operating systems and databases are long over. Innovations today are most often driven by open source consortiums such as the Linux Foundation, the Eclipse Foundation, the Apache Software Foundation and the Open Infrastructure Foundation, formerly known as the OpenStack Foundation. The rate at which software can be developed by teams of contributors working on an open source project makes it difficult for an IT vendor working on a single project to keep pace.

    There will, of course, always be some form of commercial software consumed by enterprise IT organizations. However, the percentage of open source software continues to rise with each passing year. The latest economic downturn is only accelerating a trend that was occurring long before the COVID-19 pandemic arrived. The challenge now is finding the best way to manage all that open source software at a time when IT environments are also becoming more complex.

  • OpenSSF Makes Free Security Training Available

    OpenSSF Makes Free Security Training Available

    The Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, is providing free security training for developers building and employing open source software starting later this week as part of an overall effort to advance best DevSecOps practices.

    Linux Foundation CTO Chris Aniszczyk said the Secure Software Development Fundamentals professional certificate program along with additional programs and technical initiatives soon will be required for every maintainer working on open source projects overseen by the Linux Foundation. As the number of applications that incorporate open source software has increased, the potential harm that can be inflicted by vulnerabilities introduced via code continues to increase, he noted.

    A larger percentage of those common vulnerabilities could be eliminated simply by providing developers with free access to training, Aniszczyk noted. Far too many developers and software engineers have not had access to security training beyond a few rudimentary courses in college, while many other developers are self-taught, he said.

    Accessed online via the edX learning platform, the courses are designed to teach developers and software engineers how to develop secure software while reducing the potential for damage and increasing the speed of the response when a vulnerability is found.

    The OpenSSF has also revealed existing projects from the Core Infrastructure Initiative (CII). The CII Census, quantitative analysis to identify critical open source projects, and CII FOSS Contributor Survey, a quantitative survey of developers, have become part of the OpenSSF Securing Critical Projects working group. These two efforts will continue to be implemented by the Laboratory for Innovation Science at Harvard (LISH). The CII Best Practices badge project is being transitioned into the OpenSSF.

    OpenSSF also announced new contributors, including Arduino, AuriStor, Canonical, Debricked, Facebook, Huawei Technologies, iExec Blockchain Tech, Laboratory for Innovation Science at Harvard (LISH), Open Source Technology Improvement Fund, Polyverse Corp., Renesas, Samsung, Spectral, SUSE, Tencent, Uber and WhiteSource.

    It has also elected an advisory council and governing board members with Kay Williams from Microsoft becoming Governing Board Chair. Other newly elected board members include Jeffrey Eric Altman from AuriStor Inc., Lech Sandecki from Canonical, Anand Pashupathy from Intel and Dan Lorenc from Google as the Technical Advisory Committee (TAC) representative.

    Ryan Haning from Microsoft has been elected Chair of the Technical Advisory Council (TAC) and an election for a Security Community Individual Representative to the Governing Board is currently underway. An OpenSSF Town Hall will be held online Nov. 9.

    Open source software obviously plays a critical role in boosting productivity because it means developers don’t have to constantly duplicate the same functions across multiple projects. However, if a vulnerability is discovered in one open source library the implications across multiple projects that have reused that same library can be profound. As part of an effort to ensure continued reliance on open source code, it’s incumbent on the open source community to make sure that code being shared is secure. In effect, responsibility for open source security needs to shift left at a massive level of scale. The challenge now is making sure that now open source developers have access to training the best DevSecOps practices that training enables are actually implemented.

  • Azul Adds OpenJDK Migration Services

    Azul Adds OpenJDK Migration Services

    Azul today announced today it will provide migration services for IT organizations looking to transition from the proprietary Oracle Java Standard Edition (SE) developer platform to the Zulu edition of an open source OpenJDK equivalent.

    OpenJDK is based on the HotpSpot edition of the Java virtual machine, the Java Class Library and the Java compiler. The Zulu edition was originally developed by Azul and Microsoft and has since been supported by Oracle, IBM, Apple, Amazon, SAP and Red Hat.

    Azul CEO Scott Sellars said that while OpenJDK is compatible with Oracle Java SE there are some minor differences that enterprise IT organizations need help with to make the transition. While distributions of OpenJDK have been around for years now, Sellars said the fees for support that Oracle has been charging for Oracle Java SE have reached a point where more organizations are now ready to make the jump to OpenJDK.

    In the wake of the economic downturn brought on by the COVID-19 pandemic organizations of all sizes are looking to reduce costs by transitioning to open source software whenever possible, he added. Rather than reduce the size of their IT staff most organizations would prefer to rein in their IT budgets by reducing their dependency on proprietary software, Sellars noted. The United States Transportation Command (USTRANSCOM), for example, earlier this month revealed it is replacing Oracle Java SE with Azul Zulu builds of OpenJDK to in part lower Java support costs. Taboola, an online advertising platform, also made a similar switch.

    Azul is now offering two classes of migration services. A Level 1 offering helps organizations migrate directly from Oracle Java to Azul Zulu builds of OpenJDK and includes creating an inventory of the Java estate by vendor, by Java version, by Java security patch level and by which Java runtimes are currently being employed. A Level 2 service brings in a third-party IT services firm to enable organizations to migrate older implementation of Java Virtual Machines (JVMs) to either the Java 8 or Java 11 platform.

    A recent Forrester Consulting study commissioned by Azul finds the Azul Zing Java Virtual Machine pays for itself in less than three months by reducing development and infrastructure costs, with a three-year 224% return on investment (ROI).

    Regardless of the open source instance of a Java platform, it’s clear that going forward most of the ongoing innovation is shifting to platforms that multiple vendors are now contributing to more frequently. OpenJDK, for example, is now on a release cadence of every six months. Each distribution of an open source Java platform serves to reduce costs in a way that enables IT organizations to achieve backward compatibility.

    Despite first being employed in the enterprise more than two decades ago, reliance on Java platforms remains high. There has been widespread adoption of multiple programming languages but most back-end systems in the enterprise are still based on Java. Many developers that have mastered Java have also been reluctant to abandon it no matter how many other programming languages they may learn.