Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

I set up an email triage system using Home Assistant and a local LLM, here's how you can too

A DIY email triage rig usingHome Assistant, IMAP, andOllamawires up local LLM smarts with YAML-fueled automation. At the core: an8B dolphin-llamamodel running on GPU, chewing through messy HTML emails, tagging them, and firing off priority-sorted summaries via notifications. Why it matters:A signal.. read more  

I set up an email triage system using Home Assistant and a local LLM, here's how you can too
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

37 Things I Learned About Information Retrieval in Two Years at a Vector Database Company

A Weaviate engineer pulls back the curtain on two years of hard-earned lessons in vector search—breaking downBM25,embedding models,ANN algorithms, andRAG pipelines. The real story? Retrieval workflows keep moving—from keyword-heavy (sparse) toward embedding-driven (dense). Across IR use cases, the .. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Combining GenAI & Agentic AI to build scalable, autonomous systems

Agentic AI doesn’t just crank out content—it takes the wheel. Where GenAI reacts, Agentic AI plans, perceives, and acts. Think less autocomplete, more autonomous ops. Hook them together, and you get a full-stack brain: content creation, real-time decisions, adaptive workflows, all learning as they .. read more  

Combining GenAI & Agentic AI to build scalable, autonomous systems
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Some thoughts on LLMs and Software Development

Most LLMs still play autocomplete sidekick. But seasoned devs? They get better results when the model reads and rewrites actual source files. That gap—between how LLMs are designed to work and how prosactuallyuse them—messes with survey data and muddies the picture on real gains in code quality and.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Availability Models: Because “Highly Available” Isn’t Saying Much

Antithesis and Jepsen want to kill hand-wavy "high availability" talk. Instead, they push for clearavailability models—majority,total,sticky, etc.—that spell out when an operationactuallyworks during failures. It's about precision, not platitudes. Why it matters:This reframes availability from a va.. read more  

Availability Models: Because “Highly Available” Isn’t Saying Much
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

ECScape: Understanding IAM Privilege Boundaries in Amazon ECS

A new ECS security mess—ECScape—lets low-privileged tasks on EC2 act like the ECS agent. That’s bad. Real bad. Why? Because it opens the door to stealing IAM credentials from other ECS tasks sharing the same host. Here’s the trick: The attacker hits the instance metadata service (IMDS) and fakes a .. read more  

ECScape: Understanding IAM Privilege Boundaries in Amazon ECS
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Observability in Go: What Real Engineers Are Saying in 2025

Go observability still feels like pulling teeth. Manual instrumentation? Tedious. Span coverage? Spotty. Telemetry volume? Totally out of hand. Even with OpenTelemetry gaining traction, Go lags behind Java and Python when it comes to auto-instrumentation and clean context propagation. Devs are hunt.. read more  

Observability in Go: What Real Engineers Are Saying in 2025
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

How to prepare for the Bitnami Changes coming soon

The Bitnami team has delayed the deletion of the Bitnami public catalog until September 29th. They will conduct a series of brownouts to prepare users for the upcoming changes, with the affected applications list being published on the day of each brownout. Users are advised to switch to Bitnami Sec.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Google Develops KFuzzTest For Fuzzing Internal Linux Kernel Functions

Google droppedKFuzzTest, a lean fuzzing tool built to hit Linux kernel internals—way past just syscalls. It brings a clean API, docs, and sample targets to get fuzzing fast. Why it matters:KFuzzTest marks a shift. Kernel fuzzing’s no longer just about hammering syscalls—it’s going deeper into the g.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

v1.34: User preferences (kuberc) are available for testing in kubectl 1.34

Kubernetes v1.34 pusheskubectlinto the future with a betauser preferencessystem. Drop a.kubercfile in place, and you can bake in default flags, toggle features likeinteractive deleteorServer-Side Apply, and wire up custom aliases—including pre- and post-args... read more  

The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.