Tag: open source

  • Critical Vulnerability Discovered in Open Source Backstage Platform

    Critical Vulnerability Discovered in Open Source Backstage Platform

    Oxeye today disclosed that it has discovered a critical vulnerability in the open source Backstage software used to build developer portals. Backstage was originally created by Spotify.

    A 1.5.1 update to the Backstage platform remediated a sandbox escape vulnerability that can occur via a third-party Scaffolder plug-in that could be used to conduct unauthenticated remote code execution (RCE).

    Oxeye CTO Ron Vider said Oxeye worked with Spotify to responsibly disclose the issue and enabled a patch to be created prior to the disclosure of the vulnerability, which Spotify gave a 9.8 out of 10 severity rating.

    Backstage is now being advanced under the auspices of the Cloud Native Computing Foundation (CNCF), but is already widely used by organizations such as American Airlines, Netflix, Splunk, Fidelity Investments, Epic Games and Palo Alto Networks, as well as by Spotify.

    The vulnerability is another example of a potential template-based attack through which run shell commands can be manipulated to inject malware into an application development environment.

    In general, separating the logic from the presentation layer as much as possible can greatly reduce exposure to the most dangerous template-based attacks.

    Vider said Oxyeye is focusing its vulnerability research on cloud-native platforms such as Backstage that are generally being used to build modern applications based on a microservices architecture. It’s not clear to what degree organizations have transitioned away from more monolithic approaches to building applications, but it’s clear that a much larger percentage of applications are now being constructed using microservices.

    Cybercriminals, of course, are targeting these platforms as part of a sustained effort to compromise software supply chains in the hope that the malware they inject will find its way into multiple downstream applications. Those attacks, in turn, are convincing more organizations to embrace DevSecOps best practices to better ensure the integrity of their software supply chains. The challenge is many of those attacks are being aimed at open source software projects that don’t always have enough resources to quickly develop a patch in the event a zero-day vulnerability is disclosed.

    While it’s impossible to know the extent to which cybercriminals are already exploiting vulnerabilities in DevOps platforms, the level of cybersecurity scrutiny being applied has dramatically increased in the wake of a series of high-profile breaches. The Biden administration has even gone so far as to issue an executive order requiring federal agencies to better secure their software supply chains. As a result, DevOps teams should expect there to be a lot more DevOps platform vulnerability disclosures in the months ahead, and that those vulnerabilities will require immediate patching.

    Like it or not, software supply chains are going to become more secure. The only thing left to be determined is the level of pain that will be experienced as more vulnerabilities are discovered in the DevOps platforms that were used to construct them.

  • Building Higher-Quality Software With Open Source CD

    Building Higher-Quality Software With Open Source CD

    Business is accelerating, and experience– for customers, partners and employees–is everything. This means nearly all applications need to be enhanced with new features, security updates and bug fixes on ever-shorter cycles. But isn’t rushing new code into production, especially in cloud environments, a recipe for mistakes, security vulnerabilities and user frustration? Not if the right approach is taken.

    Continuous delivery (CD) enables development teams to rapidly and regularly deploy software updates into production systems without jeopardizing user experience or creating security risks. Battle-tested open source CD orchestration solutions, including Spinnaker and Argo, provide a cost-effective way to deliver secure, high-quality software at massive scale to multi-cloud and Kubernetes environments.

    What is Continuous Delivery (CD)?

    Most software development teams suffer from quality issues related to outages, tracking down bugs and security vulnerabilities, complex upgrades, release rollbacks and more. According to a 2020 report by the Consortium for Information & Software Quality™ (CISQ™), software quality suffers as companies rush to add more value at greater speeds. In 2020, the cost to companies was $2.08 trillion in the U.S. alone.

    CD relies on a framework of stakeholder collaboration, process automation and continual and rigorous risk assessment and feedback to ensure a smooth, high-volume flow of high-quality code is deployed to production systems. When done right, CD reduces software development risks by enabling development teams to deploy changes such as new features, configurations, bug fixes and even experiments into production safely, quickly and sustainably. It also reduces costs associated with software deployments, failed releases and customer frustration and attrition.

    With effective CD workflows in place, development teams gain confidence and are more productive, delivering better products faster while eliminating the frustration of missed release dates, management wrath and the blame game associated with software bugs and vulnerabilities making it into production.

    Open Source CD Solutions

    Prior to the rise of open source CD solutions, companies often relied on point automation using scripts. These could improve efficiency a bit, but when companies moved from the monolithic architecture of a mainframe or on-premises servers to a microservices-based production environment, the scripts could not be easily adapted or scaled to cope with the more complex environment. This led to the formulation of continuous delivery orchestration solutions that could ensure code updates would flow to their destination in a repeatable, orderly manner.

    Two highly popular open source CD solutions have emerged, Spinnaker and Argo. Spinnaker was developed by Netflix and extended by Google, Microsoft and Pivotal. It was made available on GitHub in 2015. Spinnaker creates a “paved road” for application delivery, with guardrails to ensure only valid infrastructure and configurations reach production. It facilitates the creation of pipelines that represent a software delivery process. These pipelines can be triggered in a variety of ways, including manually, via a cron expression, at the completion of a Jenkins Job or other pipeline and other methods. Spinnaker also provides cluster management, as well as visibility into an application’s cloud footprint, letting users resize, delete, disable and even manually deploy new server groups using strategies like blue-green deployments.

    Argo CD, a container-native deployment engine for Kubernetes, supports CD pipelines, enabling the automated deployment of applications within Kubernetes. Introduced in 2018, Argo CD utilizes the Argo GitOps Engine, an open source library that implements core GitOps features. It allows users to manage, automate and audit the software deployment with Git as the source of truth. Features of Argo CD include drift detection, the analysis of the health of application resources and a real-time view of application activity.

    As open source software, both solutions offer all the benefits that the open source model offers, including low start-up costs, rapid and continual innovation and paid support when it becomes necessary.

    A CD Automation Success Story

    Symphony provides a cloud-based collaboration platform for financial institutions that are highly regulated and render services to millions of customers, so the solution must meet rigorous standards for security and regulatory compliance. The company wanted to enable a multi-tenant system to improve performance and reduce the cost of operations for each client. However, the existing software delivery system created bottlenecks in integration testing, long triage times and manual handovers of releases to site reliability engineering (SRE). The ever-growing number of delivery pipelines and software delivery environments also increased infrastructure costs and the burden on human resources, making it difficult to deliver features faster and ensure compliance at scale.

    Symphony determined it needed a completely new CD solution supporting infrastructure and software delivery workflows that they could retrofit into their existing platform. The solution needed to support infrastructure-as-code, pipeline-as-code and configuration-as-code, while providing visibility, auditability and faster approval processes. Symphony opted for a CD solution that harnessed the power of both Spinnaker and Argo to automate the entire end-to-end CD process, including pipelines for infrastructure, deployment, testing and promotion to production deployments. With the solution, Symphony was able to slash the time required to onboard new environments by 98%–just 10 minutes to get the infrastructure and platform ready for the client. This also allowed for fast and frequent changes.

    With automated CD in place, the company enjoyed significant cost optimization through automation. It was also able to increase security and compliance through automatic policy checks that continually enforced compliance across the stages of each pipeline–without compromising delivery speed.

    Getting Started

    As you review potential CD solutions, ensure they can deliver the required level of:

    • Ease of setup and configuration
    • Visibility and collaboration
    • DevOps tools integration and extensibility
    • Built-in deployment environment support
    • Security and governance
    • Workflow flexibility
    • Performance, uptime and scalability

    Get an Expert Assessment

    While the benefits of a CD solution are enormous, deploying one is not trivial. It pays to make good choices to get it right the first time. A professional assessment of your existing environment and processes can help you in several ways, including:

    • Exposing your current silos
    • Identifying the bottlenecks in your software delivery process that can be automated
    • Identifying productivity improvement opportunities for everyone involved in the delivery journey
    • Giving you the insights you need to make an informed decision about your CD solution.
    • Providing advice on best practices that can transcend the deployment process to the next level of efficiency and quality

    If your company requires the rapid delivery of secure, high-quality software releases, the time to deploy a continuous delivery solution is now.

  • Cisco Adds Open Source Tool to Validate Serverless Functions

    Cisco Adds Open Source Tool to Validate Serverless Functions

    Cisco has launched an open source project, dubbed FunctionClarity, that makes it possible to verify signatures before code is deployed in a serverless computing environment.

    Vijoy Pandey, vice president of emerging technologies and incubation at Cisco, said that one of the application security issues that has emerged in serverless computing environments is the lack of validation capability to verify code signatures prior to deployment. As more organizations employ serverless computing frameworks, the overall software supply chain becomes less secure, he noted.

    FunctionClarity includes a command line interface (CLI) tool to invoke a verification function that can be deployed on the Amazon Lambda serverless platform to address that issue; support for Microsoft Azure and Google Cloud serverless platforms is planned, he added.

    The FunctionClarity project aims to close that gap by employing either a keyless approach using open source sigstore tools or a traditional encryption key, noted Pandey.

    The FunctionClarity project is the latest extension of a Cisco OpenClarity initiative that includes an existing project for securing application programming interfaces (APIs) using a service mesh, dubbed APIClarity, and a tool for detecting and managing software bills of materials (SBOMs) and vulnerabilities in container images and filesystems dubbed KubeClarity. All three projects are part of an ongoing Cisco effort to contribute code to the open source community that, while essential, does not provide a lot of differentiated value for any one vendor, said Pandey.

    The FunctionClarity project arrives at a time when concerns over the security of software supply chains is on the rise. Many of the software security issues that organizations are encountering stem from the simple fact that developers can provision cloud infrastructure without any kind of meaningful cybersecurity review. Code signing, within the context of a larger set of DevSecOps workflows, is now starting to gain traction to better ensure secure software supply chains. The challenge is that as more code winds up running on serverless computing platforms, a need to extend the reach of whatever approach to code signing an organization adopts becomes more evident.

    In general, the open source community is collectively trying to respond to an executive order issued by the Biden administration that required federal agencies to implement a series of steps to better secure their software supply chains. One of those measures includes wider adoption of code signatures to ensure the authenticity of code being incorporated into applications. The challenge is that incorporating code signatures into DevOps workflows has historically not been a trivial process to implement. Most recently, a free sigstore cloud service launched that promised to make it easier to achieve that goal.

    It’s not clear how widely or even how rapidly code signing will be adopted, but enterprise IT organizations are paying close attention to how federal agencies are responding to the executive order. Many of the tools and processes defined by those agencies will inevitably be copied by enterprise IT organizations that have thus far made limited use of code signing to verify the authenticity of software components. The challenge now is finding a way to achieve that goal without slowing down the rate at which modern software is developed.

  • Sonatype Report Surfaces Scope of Known Vulnerability Challenge

    Sonatype Report Surfaces Scope of Known Vulnerability Challenge

    Sonatype this week published a State of the Software Supply Chain Report that found a 633% year-over-year increase in malicious attacks aimed at open source software residing in public repositories.

    In addition, Sonatype launched a Sonatype Safety Rating system that employs machine learning algorithms and other metrics to identify the most secure open source components stored in those repositories.

    The report found 96% of open source Java downloads have known vulnerabilities that could have been avoided if an available, more secure version had been used. Collectively, the report estimated there were 1.2 billion known-vulnerable dependencies that could be avoided if developers had only been aware that a later version of a software component was available.

    According to the report, the average Java application contains 148 dependencies. Updates to Java applications are, on average, made 10 times a year, so development teams are being asked to track 1,500 dependency changes per year.

    Sonatype CTO Brian Fox said the report makes it clear that organizations are not assuming enough responsibility for using open source software that has known vulnerabilities. In effect, organizations are blindly and recklessly using software components without any real appreciation of the associated risks, he said.

    Rather than a knee-jerk reaction to each new zero-day vulnerability that is discovered, Fox said, IT teams need to focus on putting processes in place to make sure the latest, most secure edition of any given software module is being used. A survey of 662 engineering professionals included with the report, however, found 68% of respondents were confident that their applications were not using known vulnerable libraries. Nevertheless, a random sample of enterprise applications conducted by Sonatype found 68% contained known vulnerabilities.

    Overall, the report surmised that consumption of open source software will soon surge past an estimated 3.1 trillion total requests, with six out of every seven vulnerabilities being the result of a transitive dependency created by indirect relationships between software components. At the current rate of consumption, it’s fairly clear that the processes used to build and deploy applications today are insane given how dependent organizations are on applications, said Fox.

    In the wake of a series of high-profile security breaches, there is, fortunately, a lot more focus on securing software supply chains today than there was this time last year. The scope of the challenge, however, is mind-boggling when you consider the totality of applications already deployed in application environments that have known vulnerabilities. Organizations need to first make sure they are remediating vulnerabilities in their most critical applications while at the same time implementing DevSecOps best practices. This will ensure as few vulnerabilities as possible find their way into the next generation of applications.

    Obviously, these application security issues are not going to be resolved overnight. DevOps teams will be spending the next several years addressing a level of technical security debt that has been allowed to accrue for more years than anyone in IT really cares to admit.

  • Linux 6.0 is Faster, Cooler | Debian Goes Proprietary | Google Africa Region

    Linux 6.0 is Faster, Cooler | Debian Goes Proprietary | Google Africa Region

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Linux 6.0 promoted to Stable, Debian 12 will include closed-source binaries, and Google Cloud opens its first Africa region. (more…)

  • Optimizing Prometheus Implementations With Managed Services

    Optimizing Prometheus Implementations With Managed Services

    Prometheus is a leading metrics-based open source monitoring solution and time series database used across the IT community to collect metrics from systems, applications and services. According to the 2021 Cloud Native Survey from the Cloud Native Computing Foundation (CNCF), the use of Prometheus in production has reached 65%, an increase of 43% year-over-year.

    “As cloud-native stacks have grown and matured, observability has become crucial for visibility into application metrics, performance, alerting, and insights,” said Chris Aniszczyk, CTO of CNCF. “Prometheus is a key element of this, enabling organizations to build a foundation of observability.”

    If you are using Prometheus, it is probably because of its many advantages including reliability, easy initial implementation and its open source nature. However, in addition to these benefits, Prometheus also brings several challenges if you are deploying and maintaining the solution on your own.

    Facing the Four Main Prometheus Challenges

    Prometheus users face four primary challenges that can be alleviated by the right service provider:

    Challenge One: Support

    Prometheus users face the dilemma posed by any open source tool: There is no vendor behind the solution to deliver technical support. It is easy to take tech support for granted, but when you are working with a technology that is not supported, even a small issue can become a substantial problem. A commercially-backed product can provide a critical level of expertise you do not have in-house, and take on responsibility for keeping the system up and running.

    Challenge Two: Maintenance

    The greatest challenge you’ll likely face with Prometheus is the amount of time your team must spend configuring and maintaining the system. 

    Just one example of how Prometheus drains your resources is the use of third-party exporters to expose metrics in the Prometheus format. These integrations are designed by members of the open source community an do not come with any support; upgrades are hit-or-miss.

    Exporters are difficult to maintain. First, there are often multiple exporter options and choosing the right one for each of your services is time-consuming. Second, you can easily have hundreds of different services running in your environment and your team can spend hours every day making sure the exporters are working properly.  

    Another maintenance issue involves PromQL, the Prometheus query language. PromQL is a custom query language, and it is very complex and difficult to learn. Having to rely on your one PromQL expert for all Prometheus queries across the organization is simply not practical or sustainable.

    With all these maintenance requirements, you will have some team members spending all their time managing and maintaining a Prometheus environment, eating away at resources that could be used to focus on business needs and innovate new applications.

    Challenge Three: Scalability

    Users tend to deploy Prometheus in silos, with a separate server for each cluster. Over time, you may have tens or even hundreds of Prometheus servers in your environment that you are not aware of. This leads to scalability issues regarding consistency, maintainability and a global view of your metrics.

    In addition, storage is a major hindrance to scaling Prometheus, because the system typically stores metrics for about two weeks. If you need to analyze metrics older than a couple of weeks, you run into a serious problem. 

    Challenge Four: Correlating Data

    Data does not have much value if you cannot correlate it and, unfortunately, Prometheus does not provide correlation for metrics to other elements in your environment like processes or cloud regions. This makes it difficult to pinpoint the source or impact of a problem. 

    Options for Solving Prometheus Challenges

    Options are available to help you with Prometheus but most do not solve the four major issues outlined above. The following are your options:

    APM: APM vendors all have some level of support for Prometheus, but this is an add-on to their platform. They offer an ingest tool that can transform Prometheus data into a format you can query natively within the APM platform. In reality, they are not helping you utilize Prometheus but instead are forcing you to work within the constraints of their system.

    Cloud tools: Some cloud hyperscalers offer solutions to support Prometheus. These tools can help with deployment and infrastructure maintenance, but you are still stuck doing all the other configuration and maintenance work. 

    Managed service: The preferred option is a Prometheus managed service, which can alleviate all four of the main challenges posed by open source Prometheus. The right optimized managed service provider delivers support, maintenance, long-term storage and data correlation.

    Must-Have Capabilities for Your Prometheus Managed Service Provider

    The following are essential capabilities you should look for when choosing a Prometheus managed service provider:

    Prometheus compatibility: You need an optimized managed service provider whose platform is designed to be natively compatible with Prometheus, consuming data in the Prometheus format and allowing you to run PromQL queries on the data.

    Simplified PromQL: To eliminate the reliance on PromQL experts for every query, a managed service provider should simplify the use of PromQL, without breaking compatibility.

    Exporter management: The right optimized managed service provider will be able to streamline the selection, deployment and management of exporters, saving you a significant amount of time and effort.

    Automated discovery: Tracking and optimizing all your services can be challenging. For this reason, a Prometheus-managed service should be able to automatically discover the services running in your environment and help guide you with configuration.

    Metric Storage: One of the shortcomings of Prometheus is the lack of long-term storage. Consequently, a Prometheus managed service provider should provide a database for long-term storage of metrics, so you can perform comparative analyses of the data, from month to month and even year-to-year.

    Prometheus compatibility: If you already use open source Prometheus, your teams are used to using things like PromQL and Grafana dashboards. You should select a managed service provider that is Prometheus-compatible so your team can use the same dashboards and queries they have always used to view the data.  

    Conclusion: Optimized Valuable Tool

    Prometheus is not a standalone solution. But it is an optimized valuable tool to collect metrics for performance analysis and it is appreciated by your architects, developers and IT Ops pros. While Prometheus may have some limitations, it is worth finding a solution to these issues; that solution is a managed Prometheus service. The right managed service provider can give you the best of both worlds—all the benefits of Prometheus without the time, resources and expense needed to run it effectively.

  • Linus Torvalds Signals Support for Memory-Safe Rust Language

    Linus Torvalds Signals Support for Memory-Safe Rust Language

    Linus Torvalds told attendees of the Open Source Summit Europe conference today that he is hopeful the foundational work needed to add support for the Rust programming language will be laid in a forthcoming version 6.1 of the Linux operating system.

    It would take several additional releases of Linux to add full support for Rust, but the ability to more easily build and deploy applications written in Rust will go a long way toward improving the overall state of application security on Linux platforms.

    The Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, has called for replacing programming languages like Java that are not memory-safe as part of a larger plan to secure open source software supply chains. Rust is a memory-safe language that employs a compiler to track the ownership of values that can be used once and a borrow checker that manages how data is used without relying on traditional garbage collection techniques.

    Earlier this week, the Rust Foundation allied with OpenSSF and JFrog to address other security issues that might arise as applications are developed in Rust.

    It’s not clear just how many developers are adopting Rust, but Torvalds said he personally was looking forward to learning the Rust syntax—using a recently-acquired laptop based on an Arm processor—should the maintainers of Linux approve the effort. However, Torvalds also left open the possibility that adding support for Rust might not be as successful as initially hoped.

    Torvalds also bemoaned the overall state of cybersecurity transparency at the operating system level. Many of the bugs that are encountered at the hardware level cannot be shared with the entire open source community, so any fix to those efforts is not subject to the same level of peer review as the rest of the operating system. The overall situation is improving, but it’s still very painful from a development perspective, he said. Secrecy is counter to the open source ethos, he said.

    As new applications are built using a memory-safe programming language, the overall security posture of an organization will steadily improve. The challenge, of course, is that the number of developers that know how to build applications using those languages is still relatively small. Of course, replacing trillions of lines of code that have already been constructed using a variety of legacy non-memory-safe languages represents a gargantuan task that might never be fully completed—but shifting to a modern programming language is a major step in the right direction when it comes to application security.

    There may even come a day when the way applications are coded is a lot more secure by default than it is today. That may not necessarily resolve every application security issue, but as the programming languages become inherently more secure, the pressure on developers to become cybersecurity experts should ease—assuming, of course, they are willing to learn a new way to write code.

  • Rust Foundation Allies With OpenSSF and JFrog to Secure Code

    Rust Foundation Allies With OpenSSF and JFrog to Secure Code

    The Rust Foundation announced today it is working with the Open Source Security Foundation (OpenSSF) and JFrog to help maintainers secure open source software created using the Rust programming language.

    Rebecca (Bec) Rumbul, executive director at the Rust Foundation, said even though Rust is a memory-safe language, there are still security issues that maintainers need to be able to address. The goal is to provide the resources those maintainers need to better secure their software supply chains.

    As part of that effort, the Rust Foundation is adding a dedicated security team to help maintainers of open source projects built using Rust to better secure their software supply chains. That team is being underwritten by JFrog and the Alpha-Omega Initiative funded by Google and Microsoft which was recently launched by OpenSSF. JFrog last week announced it is joining the Rust Foundation at the Platinum level alongside Amazon Web Services (AWS), Google, Huawei, Meta, Microsoft and Mozilla.

    The first initiative for the security team will be to conduct a security audit and develop threat modeling tools that will provide the foundation for a set of best security practices for maintainers, said Rumbul. The team will also help advocate for those security practices across the Rust landscape, including the Cargo package manager and Crates.io directory projects.

    The OpenSSF has previously called for replacing programming languages like Java that are not memory-safe as part of a larger plan to secure open source software supply chains.

    In general, the Rust Foundation is committed to enabling Rust developers to achieve their scale, security and sustainability goals, said Rumbul. Given the early stages of the Rust programming language, there is no better time to start addressing security issues that application developers can’t ignore, she added.

    In the longer term, The Rust Foundation is also committed to providing developers with Rust security education and is also working to come up with a fair approach to certifying which projects have achieved an appropriate level of cybersecurity maturity, said Rumbul.

    It’s not clear whether developers are abandoning older programming languages in favor of a memory-safe language such as Rust. Rust employs a compiler to track the ownership of values that can be used once and a borrow checker that manages how data is used without having to rely on traditional garbage collection techniques.

    Of course, replacing trillions of lines of code that have already been constructed using a variety of legacy languages is a gargantuan task that might never be fully completed. However, as new applications are built using a memory-safe programming language, the overall security posture of an organization will steadily improve. The challenge, of course, is that the number of developers that know how to build applications using those languages is still relatively small.

    Nevertheless, there may come a day when the way applications are coded is a lot more secure by default than it is today. In the meantime, however, the number of vulnerabilities that exist with application environments is still too numerous to count.

  • Playwright: A Modern, Open Source Approach to End-To-End Testing

    Playwright: A Modern, Open Source Approach to End-To-End Testing

    I was excited when I started writing my first end-to-end tests years ago. The idea was promising; create an automated test suite that spins up a browser and mimics your user’s behavior. Test your website end-to-end. Frontend, backend, your database—you name it. All these automated tests would cover everything! Unfortunately, it wasn’t all roses and sunshine. The implementation was more complicated than expected and the results were not as stable as I had hoped. On one hand, I expected that learning a new testing framework would take time. But on the other hand, investing time and money just to end up with flaky tests and countless false positive alerts was not acceptable.

    Luckily, testing frameworks evolved, and new libraries make end-to-end testing more approachable and, most importantly, less flaky. One of the more recent solutions is Playwright. Let me tell you more about it!

    Write Your Test Code in Four Different Languages

    While Playwright’s default choice is Node.js, it offers support for three other languages: Java, .NET and Python. You’re in good hands if your team uses one of these languages because no one wants to learn a new language just to write some tests, right?

    Cross-Browser Tests on the Back of the Chrome DevTools Protocol

    Contrary to other solutions, Playwright doesn’t use the WebDriver protocol. It leverages the Chrome DevTools protocol to communicate with Chromium browsers (Chrome/Edge) directly. This approach allows for more direct and quicker communication. Your tests will be more powerful and less flaky.

    But Playwright doesn’t stop at Chromium browsers. The team behind the project understood that cross-browser tests are essential for an end-to-end testing solution. They’re heavily invested in providing a seamless experience for Safari and Firefox, as well, and even Android WebView compatibility is in the works.

    Testing your sites in Chrome, Edge, Firefox and Safari is only a configuration matter. And this saves time and headaches!

    Fast Tests Due to Auto-Waiting

    It’s not only about automating multiple browsers, though. If your tests are hard to write because you have to place countless “sleep” statements everywhere, your test suite will take hours to complete and become a burden.

    To avoid unnecessary waits, Playwright comes with “auto-waiting.” The idea is simple: Instead of figuring out when a button is clickable by yourself, Playwright performs actionability tests for you.

    Let’s look at an example:

    “`
    await page.click(‘[data-test=cta]’)
    “`

    There’s nothing fancy about clicking a button, right? Except in Playwright, there is. This innocent “click” call includes additional convenience functionality. When you call “click,” the framework checks and waits for a matching DOM element to be:

    – attached to the DOM
    – visible
    – stable (it’s not animating or moving)
    – able to receive events (not hidden or obscured by other elements)
    – enabled

    All these checks guarantee that your target element is ready to roll when you want to interact with it and, more importantly, it’s clicked as quickly as possible. Don’t worry about DOM elements. Just interact with them and let Playwright figure out the rest—no more wait statements!

    Auto-waiting is built into all of Playwright’s interaction methods so that you don’t slow down your test suite. Your tests will be easier to write and run as quickly as possible.

    But that’s not all! While I use Playwright via the command line, it also comes with handy tools to make end-to-end testing easier.

    Valuable Tools to Create, Debug and Analyze

    Playwright provides additional commands and visual tools to make the writing of end-to-end tests as accessible as possible.

    Record Scripts With Codegen

    To give you a head start with your first test, use Playwright’s test generator.

    “`
    npx playwright codegen playwright.dev
    “`

    Only a single CLI command is necessary to spin up two new windows: An interactive browser and the Playwright Inspector. The fun part is that every interaction in the browser window will be recorded and shown in the inspector.

    If you want to create a Playwright test that navigates somewhere, clicks a button and fills out a form, these tools are perfect for creating an initial setup.

    Playwright library

    Replay the generated script, adjust your selectors and assertions, and you’re good to go!

    Congratulations! You just created your first end-to-end test, and I bet it didn’t take you more than a few minutes to get there.

    Debug Your Scripts While Running Them

    When your test suite grows, you’ll find yourself in situations where you must debug complex scripts. For these cases, Playwright provides a handy debug view.

    Enable debug mode by explicitly calling `test –debug` or defining the environment variable `PWDEBUG=1`.

    “`
    npx playwright test –debug
    PWDEBUG=1 npm run test
    “`

    Playwright then opens a browser and the inspector walks you through your test case, similar to your editor’s debugger. Additionally, it highlights the touched elements with a little red circle so you can see what was clicked or filled.

    Playwright debugger

    This approach is perfect for debugging tests during local development. But what about debugging failed tests that run in CI or on a different machine? There’s a solution for that, too!

    Analyze and Debug Previously Failed Tests

    In an ideal scenario, you’ll run your tests automatically on commit or deployment in your CI/CD pipeline. But debugging failed tests from a different environment can be a massive challenge.

    Luckily, the Playwright framework allows you to enable a trace mode. Trace mode records all script actions while screenshotting and keeping the website’s state.

    Trace view

    Then, if your tests fail on your remote servers, use the provided Playwright tooling to load a generated `trace.zip` file and inspect the test to find out what failed. Method calls, a timeline and screenshots will be available—it’s time travel debugging at your service!

    A Refreshing Approach to Synthetic Monitoring and Testing

    These are only a few things that make Playwright my testing framework of choice today and the team behind it develops fast and ships new releases every month.

    If you want to learn more about the Playwright framework or to chat with the maintainers, there’s a very active community Slack channel with many friendly people.

    So, do you still avoid end-to-end tests because they used to be slow and flaky? I hope that I could convince you to give it another try. Because there’s nothing better than knowing that you didn’t break things while developing and shipping software.

  • Free Dev Tools! But What’s the Catch?

    Free Dev Tools! But What’s the Catch?

    Software companies, especially young startups, are always in a development race – by definition, they are trying to maximize achievements and minimize their burn rate. That means development teams naturally face an internal tug-of-war. On one hand, they seek to use the newest dev tools that the market can offer, targeting their applications to become better (more secure, more efficient and compliant with the latest standards). On the other hand, they cannot spend money on such tools since they need to save every penny. With the current economic climate, many new investments are being delayed or, at minimum, double-checked. 

    To appeal to developers, many vendors and software development tool companies offer freemium programs. Some are driven by the spirit and the goodwill of open source and community; others are business-to-developer (B2D) companies relying on the product-led growth (PLG) mode. If developers see value in the free tools, they are more likely to become paying customers later on to get access to more features.

    Here, we’ll review the common parameters of popular free developer tools and distinguish their services between the free tier (aka the community tier), the entry-level paid tier and other paid program offerings. We’ll look at tools for observability, logging, vulnerability scanning, compliance, authentication and VPNs.

    1. Volume Threshold

    Logs are considered to be one of the three pillars of observability and are the bread and butter of troubleshooting and debugging. The more code lines you have in your product, the more loglines you collect, store and aggregate. Logs accumulation can quickly get out of hand and become very heavy on the budget. One logs aggregation vendor, Sumologic, provides a freemium offer that allows log collection up to one gigabyte per day. If you need more volume, you can move to their paid tier that allows for higher volumes or pay more for no limits at all.

    2. Transactions Threshold 

    Transactions and tests are probably the most imperative features of a freemium offer. It involves the core offering with a quantity limitation, giving you a chance to try the product through practical use, but you’ll probably have to move up quickly into the first paid tier. Snyk.io, for example, will help you scan your open source software for flaws alongside container vulnerabilities as early as code creation, with up to 200 open source tests and 100 container tests per month.

    3. Certified: Security and Compliance 

    It’s one thing to play with, say, a free AutoCAD seat that doesn’t involve sensitive data and another thing entirely to draft the next-generation design that must not leak to your competitors. Security and compliance certification is often included in the freemium tiers; more detailed reports and analysis of security and compliance are for the paying tiers only.

    4. Availability and SLA Support 

    Having a free tool is great–but if this tool is bound to a proprietary service, then you should probably demand these tools meet the same standards and SLAs that you are offering your customers. Observability platform Rookout offers 24/7 support and dedicated account managers and tools for enterprise customers in all tiers.

    5. Legal Aspects 

    One key aspect of free tiers is the legal aspect of using the tool. The dev tool may interact with sensitive data, not only in your own dev environment but also with your customers’ environments. Your customers may require your dev operations to meet specific criteria, making the free tier a potential legal issue. For example, if you use the free tier of JFrog to manage your supply chain, you won’t be able to use Artifactory to publish data to third parties; should you want to do that, you will have to move to one of the paid commercial programs.

    6. Usage Threshold

    Some free tools operate based on a usage model—you are entitled to a free tier until a certain amount of users or actions is reached. Auth0, for example, a user authentication solution (now part of Okta), provides their service free of charge for up to 7,000 users (generous!) but should you grow beyond that, you’ll need to graduate to a paid tier and be charged according to your monthly usage.

    7. Speed Threshold

    Some free and freemium offerings are tempered based on connectivity speed, bandwidth and even VPN. Today, you can even get a secure VPN for free, but only to a specific threshold. For example, ProtonVPN will provide you with a free VPN at a medium speed, if you move to the highest speed VPN, you’ll need to move to a paid tier.

    In most cases, the freemium tier will limit a dev tool’s usage according to one or a few main characteristics but will allow you to perform the basic actions and enjoy the essence of the tool. Some parameters may be trivial, like volume of tests, while others require developers and DevOps teams to carefully monitor usage. There’s a lot of value in free and freemium dev tools—but make sure you read the fine print.