Tag: github

  • ZenHub Brings More Science to Sprint Planning

    ZenHub Brings More Science to Sprint Planning

    ZenHub today revealed it has added a Planning Poker capability to its platform for managing software development projects that is designed to make it possible to prioritize sprints based on feedback collected from members of the application development team.

    That capability extends a sprint planning capability the company added this year to a project management application designed specifically for software development teams that employ the GitHub software repository. That sprint planning tool also automates routine tasks, such as automatically carrying over unfinished work to the next sprint.

    Aaron Upright, head of strategic accounts for ZenHub, said collectively, those capabilities will make it possible for development teams to prioritize their efforts in a way that is less biased using points that weight the opinions of team members based on how accurately they have made previous forecasts. For example, Planning Poker will assign a different weight to a developer that is consistently either overly optimistic or pessimistic about the length of time required to complete previous projects.

    Planning Poker is built right into GitHub, which Upright noted allows developers to make estimates without having to exit an environment where they already spend a good portion of their day.

    Thanks mainly to both an increase in and acceleration of the digital business transformation initiatives organizations have launched, DevOps teams are under increased time constraints.

    Many organizations’ entire business strategies now revolve around the rate at which software development projects can be completed. Many elements of those projects can’t go forward until a specific component upon which it depends is completed. Investors are holding business leaders more accountable for software delivery timetables that have direct implications on revenue generation.

    Not surprisingly, the type of end users that are now accessing project management applications to keep tabs on development progress has increased. Everyone from the sales team to the board of directors now wants more visibility into the rate at which software development projects are being completed. The challenge DevOps teams face is software development is an inexact science. Developers, based on individual personalities, exacting standards and willingness to work extra hours, are going to have widely divergent opinions on how long it may take to complete any given sprint.

    Nevertheless, Planning Poker presents organizations with an opportunity to rely on a more scientific approach than traditional guesswork, said Upright. The simple fact of the matter is that all estimates are wrong. The goal is to narrow the margin of error, he added.

    Regardless of how application development projects are managed, the relationship between DevOps teams and the rest of the organization has fundamentally changed. The entirety of some organizations is wholly dependent on the speed at which high-quality software is developed. In many cases, expectations are not realistically aligned with available development resources. A project management application that is widely employed across an organization should make that apparent to all interested stakeholders, which, in theory, at least, should result in either the hiring of additional developers or reassessment of the business strategy before the existing development team simply decides to abandon ship altogether.

  • Make GitHub Backups Part of Your Development Process

    Make GitHub Backups Part of Your Development Process

    GitHub’s platform is the largest host of source code in the world, hosting over 190 Million repositories. So much of the code we rely on every day is hosted there. You are, in all likelihood, using it. But what would you do if, one day, all of the project code GitHub stored for you disappeared?

    Just like all other cloud services, GitHub follows a cloud computing principle called “shared responsibility” for data protection and security. It essentially means that users of a cloud platform and providers of said platform split the responsibility for safeguarding data. In other words, users are just as responsible for mitigating risks on their side of the equation as GitHub is on theirs. It’s all laid out in GitHub’s terms and conditions:

    Taking this into account, there are a handful of things that can impact your ability to access to data in GitHub. Here are a few:

    Account Compromises

    In July of 2019, Ubuntu Security reported that the credentials for a company-owned GitHub account were compromised. These compromised credentials were used to create repositories, issues and more.

    In this case, critical infrastructure was decoupled from GitHub, and the breach wasn’t allowed to spread. However, Ubuntu had to restore various repositories and issue trackers to their previous state. When rolling back from an account compromise like this, backups are infinitely helpful, as they give you a previously good state to compare with the current state.

    Additionally, attackers often leave backdoors in compromised codebases. This can allow them to gain deeper access once the initial discovery and remediation process is completed. If you only have your infected codebase, it can be challenging to uncover all the infected files or identify possible vectors for future attacks. Restoring to a previous version of your code eliminates that threat.

    Ransomware Attacks

    Ransomware is the act of taking control of data and encrypting it so that only the attacker can unlock it. The attacker will usually ask for a ransom to unlock the files; otherwise, they may delete the data.

    In May 2019, ZDNet reported on a ransomware attack in which a hacker held various repositories hostage for a fee. The hackers modified the git histories to the point where the repositories were unusable, and they demanded payment within 10 days to reverse the changes.

    These attacks can create a severe disruption in operations. Developers will be unable to commit code, creating a complete stoppage in new feature development. Bug fixes and even support tickets (if managed through GitHub) could also be affected. However, restoring from a backup would allow a business to continue working.

    Service Downtime

    Depending on a third party always carries some risk, and GitHub is no exception. No service can deliver 100 percent uptime, but when your entire business (or codebase) depends on GitHub’s availability, you might want to mitigate that risk by having your own backups.

    For example, in June 2020, GitHub experienced a major, hours-long outage before stability returned. So, if all your work was stored in GitHub, you would have had to wait for access to be restored. This downtime can be devastating if it occurs during a crucial launch window.

    These are just three examples, and they happen more often than you think. A recent report by Oracle and KPMG found that 49 percent of IT professionals could attribute recent data loss to their failure to safeguard data. That’s essentially the same odds as a coin flip. Having continual access to all your work shouldn’t be left to chance. That’s why you need a backup strategy.

    Strategies for Backing Up Data in GitHub

    1. Managing Your Own Backups: This means you are responsible for all the infrastructure, business processes and ongoing repair costs to create the backups. You might think this will be a more cost-effective option, but the ongoing labor and maintenance expenses tend to add up quickly. It also means your team may use up cycles on something that is not part of the core business. What you make up for in control, you lose in time and spent resources.
    2. Using a Third Party to Manage Your Backups: Sometimes referred to as Backup-as-a-Service (BaaS), this involves outsourcing backup management responsibilities to a separate company. It removes the responsibility from your business, but it might seem more expensive upfront. In most cases, there is nothing to do after choosing a provider. They manage the entire process, from cradle to grave. This includes any API updates (which can happen often), implementation and ongoing maintenance. The drawback is that you lose control. Terms of service can change, or the data that’s backed up could change. And, not all BaaS solutions are transparent in what they do and how they access data.

    So, What’s the “Right” Choice?

    For most businesses, the sheer amount of work required to build and maintain backup software is a non-starter. Development cycles are too valuable to tie up with work not directly supporting the business’s product roadmap. You may get to a size where you think adding this competence makes sense; however, even some massive multinational corporations use some form of BaaS.

    Just make sure you do your research. Read reviews, speak to their sales or development team and confirm that they know what they are talking about. You need to determine if they have built a credible product. For many PaaS and SaaS tools, third-party backup applications are built by faceless companies with no track record. Considering the level of access they will have to your data, you want to ensure they are reputable with a proven history of successfully building backup software.

    Regardless of the method you choose, having a backup strategy in place is vital. Due to the nature of how GitHub works and how important your code repositories are to your business, the sooner you get something in place, the better.

  • GitGuardian Reports Careless Handling of Application Secrets

    GitGuardian Reports Careless Handling of Application Secrets

    A new report, the 2021 State of Secrets Sprawl on GitHub, published today by GitGuardian, a provider of a tool for monitoring usage of application secrets, suggests developers are not especially good at keeping those secrets safe.

    Based on an analysis of every single commit made to GitHub, the report finds there has been a 20% year-over-year increase in the number of secrets – such as application programming interface (API) keys, private keys, certificates, usernames and passwords –  discovered on a public repository.

    Developers, as they build an application, make secrets easily accessible as plain text for the sake of convenience. However, when those applications are deployed in a production environment, developers often forget to delete the secrets they stored in GitHub.

    GitGuardian CEO Jeremey Thomas noted that cybercriminals are now actively scanning repositories looking for secrets that would enable them to compromise applications.

    As the number of application development projects being launched increased, so too did the number of application secrets being stored in repositories like GitHub. The GitGuardian report notes 60 million repositories were created in the last year, representing a 35% increase over the previous year. GitGuardian claims it detected more than 5,000 application secrets per day. Most of those secrets have been detected in repositories that belong to developers (85%), while the other 15% belonged to organizations. The top four countries where secrets were disclosed were India, Brazil, the United States and Nigeria.

    GitGuardian also notes it sent out 937,539 pro bono alerts to 558,086 developers last year that informed developers that application secrets were exposed. The mean time for GitGuardian’s algorithm to detect a leak is four seconds. The average mean time to response of a developer when informed of the issues is about 25 minutes, the report noted.

    As a best practice, GitGuardian recommends not storing unencrypted secrets in git repositories, and that unencrypted secrets should never be shared via messaging systems like Slack. DevOps teams should also restrict API access and permissions.

    As more attention is paid to how software supply chains are managed in the wake of some recent, high-profile breaches, there is no doubt the number of audits conducted will increase. Many of those auditors will specifically be trying to ascertain how application secrets are being managed. Developers may have to get used to a new, higher level of scrutiny, especially as DevSecOps practices become more widely adopted.

    In the meantime, DevOps teams may want to review their dependency on public repositories. There are plenty of private repository options that provide most of the same source code sharing capabilities as a public repository. That may mean someone on the DevOps team is required to manage the private repository, but, given the fact that many regulatory bodies will soon be looking to make an example of organizations that don’t secure application secrets, chances are good those costs will be trivial compared to a fine that would be levied.

  • Amex, Adobe Join GitHub Intern Program

    Amex, Adobe Join GitHub Intern Program

    GitHub revealed today that Adobe and American Express have joined its Summer 2021 Fellowship program, a 12-week, hands-on curriculum where interns work alongside developers to contribute to open source projects hosted on the GitHub repository.

    Vanessa Gennarelli, senior director of education at GitHub, said the overall goal of the program is increase the pool of developer talent with experience working remotely on an open source project that requires a fair amount of collaboration with other developers.

    The program was developed in collaboration with Major League Hacking (MLH), which organizes hackathons for students. Each intern participates in a series of short hackathon sprints involving multiple open source projects over the 12-week period. GitHub originally created the fellowship program as a way to address the demand for online internships during the COVID-19 pandemic.

    Those internships have provided open source maintainers with access to a pool of talent that can reside anywhere versus, for example, always trying to recruit individuals located in a specific geographic area, Gennarelli said. GitHub is also trying to increase diversity within the open source community, Gennarelli added.

    Three quarters of open source maintainers (76%) that have worked with MLH interns reported their open source project was in a better state after working with MLH Fellows. Of eligible fellows who were matched for jobs with an MLH Fellowship partner company, more than 20% ended up receiving full-time offers at that company.

    Mike Swift, MLH CEO, said the internships provide a way to partially close a gap in developer expertise that only continues to widen. Organizations are especially keen to find developers that have open source expertise, Swift added.

    A survey of 3,400 developers and technology managers conducted O’Reilly Media on behalf of IBM finds 65% of respondents preferred skills related to the underlying open source technologies. The same percentage agreed that contributions to open source projects impress potential employers and result in better professional opportunities. In many cases, open source projects are among some of the most innovative development initiatives in the IT industry, Swift noted.

    Of course, as open source becomes a primary driver for building software, more contributors are looking to get paid for their efforts. Much of that compensation comes in the form of organizations that hire developers for the express purpose of contributing to open source projects that they deem critical to their operations.

    Regardless of how developers are compensated for their time and effort, it is apparent open source projects are the fountainhead from which many opportunities spring. Future success in any endeavor has as much to do with who someone knows as it does actual talent. The best place for any developer to expand their base of industry contact is to collaborate on an open source project. The more projects they contribute to, the greater the reach of their personal network and, by extension, their net worth, will become.

  • Rewind Acquires BackHub to Protect GitHub Repositories

    Rewind Acquires BackHub to Protect GitHub Repositories

    Rewind, a provider of a software-as-a-service (SaaS) platform for backing up cloud services, today announced it has acquired BackHub to gain control of a platform for backing up GitHub repositories.

    Based in Germany, BackHub adds a data protection platform to a Rewind portfolio that includes offerings for backing up everything from QuickBooks to Shopify. Fresh from raising an additional $15 million in funding, Rewind CEO Mike Potter said BackHub addresses a critical issue involving the protection of some of the most valuable intellectual property any organization has in a cloud service. GitHub, a subsidiary of Microsoft, is the largest host of source code in the world, with over 40 million users and 190 million repositories. BackHub claims it protects data in those repositories for more than 1,000 organizations.

    Rewind GitHub backup

    While GitHub itself is a reliable cloud service, the code residing in GitHub is subject to the same potential threats as it would be in any other cloud service. It’s not uncommon for a malicious actor to gain access to credentials that they exploit, for one reason or another, to delete or alter data – or, in the case of GitHub, code. BackHub makes it possible to back up code stored in GitHub to another cloud service where it can be easily recovered.

    Potter said the ultimate goal for Rewind is to make it possible to back up the entire cloud. Achieving that goal will require both additional acquisitions and internal product development, said Potter.

    In the meantime, the company is focused on providing data protection for specialized cloud services usually overlooked by other backup and recovery tool providers. For now, it leaves the backup and recovery of data stored on widely used cloud services, such as Microsoft 365, to other vendors. Rewind claims more than 80,000 organizations are using its platform to protect data, stored in a wide range of cloud services, that address a specific niche use case.

    Given the prominent role GitHub plays in software supply chains, it is not surprising that the code stored in Git repositories becomes a target for cybercriminals. Much of the intellectual property stored in those repositories is a high-value target for organizations looking to reduce the amount of time required to re-engineer a rival company’s functionality.

    Nation-states around the world have cyber-espionage programs aimed at gathering any type of digital asset that might benefit their military or economy. Naturally, copying code isn’t always enough when, in one fell swoop, add code that might derail that project long enough for them to catch up.

    Unfortunately, there have been some high-profile breaches involving software supply chains. The best way to determine if a project has been compromised is to compare code bases. Repositories, by definition, provide application development teams with version control capabilities. However, backing up a GitHub repository provides one extra layer of security that can make it easier to recover from a breach.

  • Buildkite Tightens CI/CD Integration With GitHub

    Buildkite Tightens CI/CD Integration With GitHub

    Buildkite has tightened the integration between its namesake continuous integration/continuous delivery platform and the GitHub source code repository.

    Fred Showell, a senior product manager for Buildkite, said the integration will accelerate application development efforts using the Buildkite application in GitHub. Any connected GitHub account can be selected as a source when creating Buildkite pipelines, he noted.

    Repository webhooks can also be created automatically, making it faster to kick off builds on a Buildkite pipeline from pull requests and then feed build information back into GitHub using the Status application programming interface (API).

    The bulk of organizations that employ Buildkite are software vendors that are continuously updating software-as-a-service (SaaS) applications. Most of those organizations routinely employ software artifacts that are stored in the GitHub repository.

    While GitHub continues to expand its DevOps capabilities in lockstep with its parent company Microsoft, Showell said there’s plenty of opportunity to extend capabilities of frameworks such as GitHub Actions, a set of APIs that DevOps tools can invoke to automate workflows.

    In general, Showell noted the number of SaaS-based platforms continues to expand as organizations embrace cloud applications to drive digital business transformation initiatives. Some of those efforts are now also expanding to include use cases involving edge computing initiatives, which is expanding the reach and scope of the Buildkite platform, he said.

    Of course, many enterprise IT organizations are now applying many of the same best DevOps practices employed by SaaS platform providers to their own application development efforts. Many of those organizations are realizing they are essentially software companies that also manufacture something or provide a service within the context of a specific vertical industry. As such, the number of organizations embracing best DevOps practices should substantially increase in the months ahead.

    Most of those organizations are already trying to manage a large portfolio of applications. Digital business transformation initiatives may allow them to in time retire some of those applications, but chances are good legacy applications will need to be maintained for some time until the digital process that has been put in place proves effective. It’s likely then that sound software development lifecycle management practices will be more relevant than ever.

    Competition among providers of CI/CD platforms to provide those capabilities is already fierce. Fueled by massive amounts of capital, providers of these platforms are expanding the scope of their offering to address a market that is expected to be valued in the tens of billions. Buildkite itself raised $28 million in additional funding last summer.

    It’s too early to say how the next phase of the DevOps platform wars might play out. However, it’s apparent that when it comes to DevOps platforms the level of investment required just to keep pace is substantial.

  • Help Developers Thrive by Finding the Right Platform

    Help Developers Thrive by Finding the Right Platform

    If our developers have what they need to create the best possible applications, they—and our customers—benefit

    Goji Investments was founded on the principle of democratizing access to real estate, business lending, renewables and other alternative investments. The idea is to allow financial service organizations to provide traditionally unavailable investment opportunities to private investors on a global scale. A critical component of the Goji plan for success is the investment platform. Not only do we make the application available as a white-label solution, it can easily integrate into other platforms via APIs. We wanted to create a modular platform that we could update in pieces when needed and easily scale up as clients came online.

    High-Performance Development Teams

    A major reason for Goji Investments‘ success in these first few years is our high-performance development organization, which is instrumental in building and delivering the vision of the investment products needed to generate new business. As we’ve moved from simply building our applications into making them more scalable, we’ve focused on getting the right tools in place for Ops and Dev. Of course, bonus—it makes developers happier if they have cool tools to use.

    One of the things we try to do is keep our application/platform deployment process as agile as the applications themselves—constantly looking to improve and making updates whenever necessary, whether needed to deploy new technologies and applications or based on feedback from the team. The idea is to keep our DevOps pipeline operating smoothly and efficiently.

    One of our key operational strategies is that if we make our developers happy at work, they will deliver better quality applications, which results in happier end users. Of course, developers like to create to come up with innovative ways to deliver great features. One roadblock to coding innovation is performing repetitive low-level tasks, so we’ve actually gone out of our way to automate whatever we can and free up Dev resources for more value-specific application development.

    Automating Deployments is a Start, but Just a Start

    We automate the deployment process through GitHub. Each developer pushes their own services into GitHub themselves, where it goes through a quick review process. After review (if it passes), it’s merged into the master. Any master merge triggers build pipeline execution (which is using ThoughtWorks GoCD), and this automation includes several rounds of testing: unit test and integration test followed by an automated acceptance test. Developers have the option of executing additional tests themselves when desired.

    Any new master is promoted into pre-prod, which mirrors production. When changes are finally rolled into production, we use HashiCorp Nomad’s blue-green deployment capabilities—if a problem were to occur (which means it was missed in official testing), Nomad takes care of any rollback needs.

    The stack is fairly straightforward: The applications are written in Java and run on a DropWizard framework in containers. Nomad is our orchestration platform. One of our foundational principles when selecting application and infrastructure technologies is the ability to automate our deployment processes. We’ve done a fairly good job of automating anything we possibly could, but automating monitoring was more difficult. Our traditional APM tool was fine for alerting us to issues such as an EC2 crash or a resource availability issue for a reboot, but if we wanted to actually troubleshoot the issue we essentially just had to examine logs and hope we could see something out of the ordinary.

    As much as everyone is excited about writing data into logs, combing through those logs to troubleshoot application issues is a waste of time and valuable developer resources. After all, operating 20 different microservices that cover everything from taxes and payments to customer notification required optimization of each element of the DevOps pipelines. The last piece we added was performance monitoring.

    The Value of End-to-End Distributed Tracing

    There’s a great line from Jurassic Park: “T-Rex doesn’t want to be fed. T-Rex wants to hunt.” Well, developers don’t want to be analyzing log files; they want to code. In fact, they want to be creating the next great feature. To get our dev team out of the weeds, we began thinking about a different way to get—and analyze—application performance data.

    We wanted a system that added observability, monitored performance, managed service levels and included visibility from our end user requests all the way into our back-end systems. Oh yeah, we also wanted all of that to happen automatically so that our developers never had to worry about anything other than their own features. Installation, agent setup, discovery, mapping, alert configuration and reporting—as much as possible without requiring human setup.

    We knew tracing was critical—so much so that we avoided missing any problems by specifying a 100% solution, wanting a complete trace of every request to the application.

    Troubleshooting Application Performance Problems

    The real reason you buy application monitoring software is to solve problems, so optimizing our ability to find bottlenecks and eliminate them is a key component of our monitoring solution. First, like the other aspects of monitoring, we didn’t want to have to spend time configuring thresholds for warning and danger alerts. Our need was for automatic anomaly detection with event analysis. Every little bit helps keep our dev team focused on dev, not analyzing data—especially in logs.

    Of course, sometimes, you can’t help it; you have to look at log data, but we wanted to be smarter about that, too. We wanted our application monitoring tool to automatically integrate log analysis tools so that all data could be analyzed at the appropriate level whenever needed.

    Don’t Forget Testing

    Sometimes, testing gets lost in the value of a good monitoring solution. While we weren’t necessarily looking for a testing tool, we knew if a monitoring solution could also operate effectively in test (that’s not just the ability to run in test; rather, I mean the ability to add value in the testing process), well, so much the better.

    It turns out that our applications are quite complex, and that complexity can create lengthier test cycles—commonly in this scenario:

    We recently released a new feature for distributing dividends. As you can imagine, this is a fairly important feature, so we wanted to ensure that it operated as desired and expected. We were especially concerned with being able to scale the feature appropriately. We set up a stress scalability test that took 20+ hours to run (essentially processing hundreds of thousands of payments).

    What we didn’t count on was having to stop some way into the test for someone to either submit an optimization update or actually fix a bottleneck—getting 10-12 hours into the test, then having to halt it and restart it—over and over and over again. We started thinking we might never finish.

    This is one of the pain points we hoped to solve with an automated way of monitoring. By pointing the automatic APM solution at our test environment, not only did we not have to configure anything (or even set up a special start command) but we also got almost immediate feedback on any change (both positive and negative). It also pinpointed the exact location in the code where the problem occurred, so the developer could almost immediately update their code and initiate a restart of the test. Finally, we could pick any two runs and compare their execution and performance to identify the real problem.

    Two things happened:

    • We were able to iterate different runs ~5 times faster.
    • We got such great bottleneck and debugging data from our solution that we cut the runtime of the test from 20 hours to less than one hour.

    Give Developers the Tools to Shine

    While all employees like to succeed, developers especially love when they can rise above their challenges and deliver high-performance code. We like to give our dev team the best possible tools to help them achieve this excellence. Approaching the decision process for selecting a tool for them should be handled no differently than thinking about your end users:

    • Identify pain points.
    • Find a resolution.
    • Execute the solution.

    For our development team, that meant relieving them of low-thought repetitive tasks that we could automate and stop making them spend their time culling through performance logs.

    Making the Right Choice??

    The long and short of it is that we replaced our legacy APM tool with a solution that delivers the automation we crave and eliminates the need for log deep-dive analysis to solve any problem. It also supports log analysis with various integrations, which was important to us.

    We get a trace of every single call, which is important to the Ops and customer support teams—and they profile every production process automatically, which gives our developers more than enough information to take action.

    Ultimately, we’ve accelerated our application delivery and update processes, streamlined testing and monitoring. And our developers are super happy that we give them the tools they need and then challenge them to make the best possible applications using those tools.

  • Lightstep Announces New GitHub Action, Bringing Observability Data Directly to GitHub to Avoid Problematic Code Deploys

    • GitHub Actions is modernizing the developer workflow by automating tasks in the same place developers code and collaborate on pull requests
    • Lightstep will surface relevant Observability data within the existing GitHub workflow to ensure developers are shipping high-quality software

    cdCON — October 7, 2020 — Lightstep, the cutting-edge distributed tracing tool founded by former Google engineers, today announced their new GitHub Action called the Lightstep Pre-Deploy Check. By automatically bringing relevant Observability data directly into the development workflow on GitHub, software developers can ensure the quality and performance of their software, before it’s actually deployed.

    “This is a big shift left for how developers think about Observability,” said Daniel Spoonhower, Co-Founder and CTO of Lightstep. “DevOps is about acknowledging that it’s not good enough to ship code without worrying about how it performs in the real world. I very much believe in ‘you build it you own it’ — but I also believe that we need to make this easier by baking solutions into existing development workflows as much as possible, by automating as much as possible.”

    According to the State of Software Quality 2020 report produced by OverOps, two out of three developers spend at least a day per week troubleshooting issues in their code, and are frustrated by the unknowns that come with deploying new code into cloud-based, distributed architectures. Despite the 87M+ merged pull requests per GitHub’s annual Octoverse report, to date there has been zero visibility into the health status of a system within a pull request.

    “Automatically confirming production systems and services are healthy before deploying code that can impact them is a great step towards ensuring reliability, without compromising developer velocity,” said Chris Patterson, Product Manager for GitHub Actions at GitHub. “By bringing Observability data directly into the pull request process on GitHub, developers can avoid context switching, gain more ownership of how their code performs in production, and better support DevOps within their organization.”

    The Lightstep Pre-Deploy Check leverages publicly-available APIs from Lightstep to provide a deployment risk summary ahead of a code change going to a production environment. The information from the risk assessment is then automatically pulled directly into the GitHub pull request through a GitHub Action.

    Lightstep has also partnered with Rollbar and PagerDuty to bring even more information directly into GitHub. For example, if Lightstep completes a risk assessment and determines that the system is unhealthy, it can automatically take a snapshot of the production behavior in real-time and send it to PagerDuty, so the full details of the issue can be examined even if the developer was not there at the moment the issue started.

    “We see direct value to developer effectiveness with the Lightstep Pre-Deploy Check,” said Steve Gross, Sr. Director, Strategic Ecosystem Development at Pagerduty. “Now developers automatically have PagerDuty on-call details inside of a pull request, alongside system health details, at their fingertips in one screen.”

    About Lightstep

    Lightstep’s mission is to deliver confidence at scale for those who develop, operate and rely on today’s powerful software applications. Its products leverage distributed tracing technology – initially developed by a Lightstep co-founder at Google – to offer best-of-breed observability to organizations adopting microservices or serverless at scale. Lightstep is backed by Redpoint, Sequoia, Altimeter Capital, Cowboy Ventures, and Harrison Metal and is headquartered in San

    Francisco, CA. For more information, visit https://lightstep.com or follow @LightstepHQ

  • GitHub Delivers on Code Scanning Promise

    GitHub Delivers on Code Scanning Promise

    GitHub today announced it is now making available at no cost the open source CodeQL code scanning tool it gained by acquiring Semmle.

    Justin Hutchings, a product manager at GitHub, said the goal is to further adoption of best DevSecOps practices by making it easy for developers to scan for vulnerabilities as they check code in and out of the GitHub repository. It is also designed to be integrated with either GitHub Actions or an existing continuous integration/continuous delivery (CI/CD) platform to enable DevOps teams to create workflows that include code scans, he said.

    For private repositories, code scanning is part of the GitHub Advanced Security suite of tools GitHub makes available via GitHub Enterprise.

    Code scanning also makes it possible to integrate third-party scanning engines via support for the Static Analysis Results Interchange Format (SARIF), which provides a standard for sharing data between SAST tools via a common application programming interface (API). GitHub has thus far partnered with more than a dozen open source and commercial security vendors to allow developers to run code scanning within their offerings, noted Hutchings.

    GitHub claims since it made CodeQL available in beta last May, it has scanned more than 12,000 repositories more than 1.4 million times and found more than 20,000 security issues involving everything from remote code execution (RCE) and SQL injection to cross-site scripting (XSS) vulnerabilities.

    Developers and maintainers fixed 72% of reported security errors identified in their pull requests before merging in the last 30 days alone, reported GitHub. Hutchings noted those efforts represent a major step forward for DevSecOps, given the fact that industry data shows that less than 30% of all flaws are fixed one month after discovery.

    GitHub, along with the open source CodeQL community, has also created more than 2,000 CodeQL queries that DevSecOps teams can employ to scan code for specific types of vulnerabilities. GitHub also noted there already have been 132 community contributions to the CodeQL open source query set.

    Given how nascent best DevSecOps practices are in most organizations, simply making SAST tools available to developers is often a major step forward for many organizations. The challenge has been finding SAST tools that developers want to employ, said Hutchings. Most SAST tools were designed for security teams rather than developers. CodeQL is designed to surface vulnerabilities in a way that makes it clear where developers need to prioritize their remediation efforts, he noted.

    It’s not clear yet to what degree responsibility for security will shift left toward developers. There will always be a need for cybersecurity teams to verify that the proper controls are in place. However, as DevOps teams assume responsibility for security it’s almost certain they will do so on their own terms. The days when cybersecurity teams select the security tools that developers are expected to employ are now all but over.

  • Microsoft Advances DevOps Agenda

    Microsoft Advances DevOps Agenda

    Microsoft, at its online Ignite 2020 conference, has launched a bevy of updates that collectively further adoption of best DevOps practices on the Microsoft cloud platform, including for the first time a preview of an ability to store artifacts created using low-code Power Apps tools on GitHub.

    In addition, Microsoft announced a preview of an update to Visual Studio 2019 16.8 that will add support for GitHub Codespaces, a previously announced capability that automatically creates repositories on GitHub. GitHub Codespaces is currently available in beta and soon will be accessible directly from within Visual Studio.

    Microsoft also revealed it has enhanced the Git tooling experience in Visual Studio to enable more asynchronous collaborations. A GitHub extension for Visual Studio Code enables developers to work with GitHub Issues and Pull Requests directly in the editor. Development teams that need to work in real-time alternatively can employ Visual Studio Live Share.

    A publish experience in Visual Studio also now has the option to generate a GitHub Actions workflow for continuous integration/continuous delivery (CI/CD) environments in Azure resources using the deployment secrets configured in a GitHub repository. GitHub Actions for Azure can now also scan Azure resources for policy violations and vulnerabilities in container images and issues involving Azure Resource Management (ARM) templates.

    Microsoft CEO Satya Nadella told conference attendees the velocity at which applications are developed and deployed has become even more critical as organizations embrace digital business transformation in the wake of the economic downturn brought on by the COVID-19 pandemic.

    GitHub support for Power Apps is especially significant because it will make it easier for so-called citizen developers to collaborate with professionals developers as they jointly develop applications, he said.

    Other notable updates to the Microsoft tools portfolio include a preview of an instance of the Azure Logic Apps workflow platform that can be deployed as a containerized runtime.

    A .NET 5 Release Candidate is also now available, with general availability expected next month. This update adds support to smaller, faster single-file applications that use less memory when employed within microservices and containerized applications. It also includes significant performance improvements, support for Windows ARM64 and new releases of C# 9.0 and F# 5.0 languages.

    Microsoft also announced several updates to App Service to make it easier and more cost-effective to migrate and modernize .NET web apps on the Azure cloud. A new Premium v3 (Pv3) App Service Plan can handle large-scale web apps, supporting more apps per instance and larger, memory-intensive apps with up to 32GB per instance. Microsoft is also making Windows Containers support in App Service generally available and will soon make Reserved Instance (RI) Pricing for App Service available to reduce costs.

    Finally, Microsoft made several Kubernetes enhancements, including a preview of a start/stop cluster feature that will be added to Azure Kubernetes Service (AKS), and announced general availability of an Azure Policy add-on for AKS, which makes it possible to audit and enforce policies across Kubernetes clusters. Microsoft also made generally available Bridge to Kubernetes extensions for Visual Studio and Visual Studio Code that allow teams to develop against microservices within a running AKS cluster to enable debugging existing services without having to reconfigure or deploy a new cluster.

    Nadella said keeping track of developer velocity and overall “tech intensity” within an organization is critical to success. It’s not yet clear how many organizations have put the metrics in place to measure either. However, it is clear that organizations that have yet to fully embrace best DevOps practices are already being left behind.