Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

Building Etsy Buyer Profiles with LLMs

Every day, nearly 90M buyers look for unique items out of over 100 million listings on the Etsy. The platform uses large language models to create detailed buyer profiles anonymously capturing their interests. Adjustments in data retrieval and processing have reduced the time and cost of generating .. read more  

Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

OpenAI announces new mentorship program for budding tech founders

OpenAI introduced a new program called "OpenAI Grove" for early tech entrepreneurs to build with AI. The program is aimed at individuals in the pre-idea to pre-seed stage and offers mentoring, access to tools and models, and in-person workshops. Grove's first cohort will run from Oct. 20 to Nov. 21,.. read more  

Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

OpenAI eats jobs, then offers to help you find a new one

OpenAI just fired a shot across LinkedIn’s bow. Its new jobs platform—part ofOpenAI Academy—aims to certify AI skills, then plug users directly into hiring pipelines. Walmart's already on board. Market signal:OpenAI’s not just training people anymore. It's moving in on talent placement, pulling the .. read more  

OpenAI eats jobs, then offers to help you find a new one
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

AI Models Need a Virtual Machine

Microsoft and academic researchers want to give AI models a new kind of home: theAI Model Virtual Machine (MVM). Think of it like theJVM, but for LLMs—an interface layer that standardizes how models plug into host software. The MVM enforcessecurity,isolation, andtool-calling rules, while also unloc.. read more  

Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

Paused Kubernetes project finds path forward

TheExternal Secrets Operator (ESO)is moving again. After hitting pause from maintainer burnout, it’s back under CNCF incubation—with a rebooted structure in place. New governance, clear contributor paths, and support tracks for CI, core dev, and testing are all in. But don’t expect fresh releases ju.. read more  

Paused Kubernetes project finds path forward
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

Pooling Connections with RDS Proxy at Klaviyo

Klaviyo replaced ProxySQL on EC2 and moved toAWS RDS Proxy. Why? Less overhead. Simpler failovers. Smarter pooling. RDS Proxy handlesmultiplexing, packing thousands of client queries into way fewer DB connections. IAM access and built-in failover routing sweeten the deal... read more  

Pooling Connections with RDS Proxy at Klaviyo
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

Easy will always trump simple

Rich Hickey’s classic “Simple Made Easy” talk is making the rounds again—as a mirror held up to dev culture under pressure. The punchline: we keep picking solutions that areeasy but tangled, instead ofsimple and sane. The essay draws a sharp line between that habit and a concept from biology: exapt.. read more  

Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

24 Best Command Line Performance Monitoring Tools for Linux

A fresh look at Linux monitoring tools shows the classics still hold—but the visual crowd’s moving in. Old-school command-liners liketopandvmstatremain go-to’s for quick reads. But picks likeNetdata,btop, andMonitbring dashboards, colors, and actual UX. Tools likeiftop,Nmon, andSuricatastretch deep.. read more  

24 Best Command Line Performance Monitoring Tools for Linux
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more

A fresh CVE (2025-55305) just put Electron apps in the hot seat. The bug? Chromium-based apps fail to treatV8 heap snapshot filesas potential attack vectors. That crack lets unsigned JavaScript slip past code signing and run inside heavyweight targets like Slack, 1Password, and Signal. The heart of.. read more  

Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more
Link
@faun shared a link, 6 months, 3 weeks ago
FAUN.dev()

The Hidden AWS Cost Traps No One Warns You About (and How I Avoid Them)

Calling outfive sneaky AWS cost traps—the kind that creep in through overlooked defaults and quiet misconfigs, then blow up your bill while no one's watching... read more  

The Hidden AWS Cost Traps No One Warns You About (and How I Avoid Them)
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.