Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Discovery IconThat's all from @The Open Source Security Foundation (OpenSSF) is a — explore more posts below...
News FAUN.dev() Team Trending
@devopslinks shared an update, 11 hours ago
FAUN.dev()

Anthropic Claude: $20,000, 16 AI Agents, and a Compiler That Builds Linux

Docker git GNU/Linux The Linux Kernel Rust

Anthropic researcher Nicholas Carlini orchestrated 16 autonomous Claude agents working in parallel to build a 100,000-line C compiler in Rust. Using a custom harness for task coordination, testing, and conflict resolution, the agent team produced a compiler capable of building Linux 6.9 across multiple architectures.

Story
@laura_garcia shared a post, 11 hours ago
Software Developer, RELIANOID

Remember the AWS US-EAST-1 outage?

On October 20, 2025, AWS suffered a major outage in its most critical region (N. Virginia), causing global service disruptions for nearly 24 hours and impacting 140+ services. - No cyberattack involved. - The root cause was a DNS resolution failure in DynamoDB, triggering cascading issues across EC2..

aws outage
Story
@eon01 shared a post, 13 hours ago
Founder, FAUN.dev

Three Events. One Week. The Heart of SoCal Tech.

Docker Kubernetes Pulumi Terraform vLLM

This March, Pasadena becomes a rare convergence point for security, open source, and DevOps practitioners. As a media partner,FAUN.dev()is proud to support three community-driven events that are deeply practitioner-focused and unapologetically real. - SCALEanchors the week asNorth America's largest..

SCaLE
Link
@varbear shared a link, 14 hours ago
FAUN.dev()

What Is an Async Agent, Really?

An async agent is not inherently async, it depends on whether you wait for it to finish or not. Async agents can manage their own event loop of other agents, spawning and coordinating them to handle tasks, just like an async runtime in programming. This architectural distinction allows for concurren.. read more  

Link
@varbear shared a link, 14 hours ago
FAUN.dev()

Discord Alternatives, Ranked

A veteran Discord admin did a deep dive into chat platform alternatives - Signal, Matrix, Zulip, Rocket.Chat, Discourse - stacked against five key pillars: functionality, openness, security, safety, and decentralization. Discord didn't come out looking great. Centralized. No end-to-end encryption. S.. read more  

Discord Alternatives, Ranked
Link
@varbear shared a link, 14 hours ago
FAUN.dev()

GitHub Actions Is Slowly Killing Your Engineering Team

A seasoned CI engineer lays into GitHub Actions - too fragile, too fuzzy, too slow. Logs glitch. YAML confuses. Compute chokes. It solves for convenience, not power. Buildkitesteps in with stronger bones: reproducible runs, clean orchestration, and scalable agents you control... read more  

Link
@varbear shared a link, 14 hours ago
FAUN.dev()

I struggled to code with AI until I learned this workflow

AI coding assistants work best when given clear context, a specific plan, and implemented in small, reviewable steps. Start with context, then a plan, and iterate through implementation and testing to avoid AI freelancing pitfalls... read more  

Link
@varbear shared a link, 14 hours ago
FAUN.dev()

Company as Code

Organisations rely heavily on digital systems, yet manage important organisational data using outdated manual methods despite advanced automation capabilities in other areas. A novel "Company as Code" concept proposes a programmatic representation of the entire organisation, enabling structured, ver.. read more  

Link
@kaptain shared a link, 14 hours ago
FAUN.dev()

Introducing Node Readiness Controller

Kubernetes just dropped theNode Readiness Controller- a smarter way to track node health. It slaps taints on nodes based on custom signals, not just the plain old "Ready" status. The goal? Safer pod scheduling that actually reflects what’s going on under the hood. It's powered by theNodeReadinessRul.. read more  

Link
@kaptain shared a link, 14 hours ago
FAUN.dev()

CVE-2026-22039: Kyverno Authorization Bypass

Kyverno - a CNCF policy engine for Kubernetes - just dropped a critical one:CVE-2026-22039. It lets limited-access users jump namespaces by hijacking Kyverno'scluster-wide ServiceAccountthrough crafty use of policy context variable substitution. Think privilege escalation without breaking a sweat. I.. read more  

CVE-2026-22039: Kyverno Authorization Bypass
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.