Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@kala shared a link, 3 weeks, 4 days ago
FAUN.dev()

Nathan Lambert: Open Models Will Never Catch Up

Open models will be the engine for the next ten years of AI research, according to Nathan Lambert, a research scientist at AI2. He explains that while open models may not catch up with closed ones due to fewer resources, they are still crucial for innovation. Lambert emphasizes the importance of int.. read more  

Nathan Lambert: Open Models Will Never Catch Up
Link
@kala shared a link, 3 weeks, 4 days ago
FAUN.dev()

My AI Adoption Journey

A dev walks through the shift from chatbot coding toagent-based AI workflows, think agents that read files, run code, and double-check their work. Things only clicked once they built outcustom tools and configsto help agents spot and fix their own screwups. That’s the real unlock... read more  

Link
@kala shared a link, 3 weeks, 4 days ago
FAUN.dev()

Generative Pen-trained Transformer

MeetGPenT, an open-source, wall-mounted polargraph pen plotter with a flair for generative art. It blends custom hardware, Marlin firmware, a Flask web UI running on Raspberry Pi, and Gemini-generated drawing prompts. The stack? Machina + LLM. Prompts go in, JSON drawing commands come out. That driv.. read more  

Link
@kala shared a link, 3 weeks, 4 days ago
FAUN.dev()

Towards self-driving codebases

OpenAI spun up a swarm of GPT-5.x agents - thousands of them. Over a week-long sprint, they cranked out runnable browser code and shipped it nonstop. The system hit 1,000 commits an hour across 10 million tool calls. The architecture? A planner-worker stack. Hierarchical. Recursive. Lean on agent ch.. read more  

Towards self-driving codebases
Link
@kala shared a link, 3 weeks, 4 days ago
FAUN.dev()

Self-Optimizing Football Chatbot Guided by Domain Experts on

Generic LLM judges and static prompts fail to capture domain-specific nuance in football defensive analysis. The architecture for self-optimizing agents built on Databricks Agent Framework allows developers to continuously improve AI quality using MLflow and expert feedback. The agent, such as a DC .. read more  

Link
@devopslinks shared a link, 3 weeks, 4 days ago
FAUN.dev()

Demystifying : Why You Shouldn’t Fear Observability in Traditional Environments

OpenTelemetry is friendly with the past. It now pipesreal-time observability into legacy systems- no code rewrite, no drama. Pull structured metrics straight from raw logs, Windows PDH counters, or SQL Server stats. It doesn’t stop there. Got MQTT-based IoT gear? OTLP export or lightweight adapters .. read more  

Demystifying : Why You Shouldn’t Fear Observability in Traditional Environments
Link
@devopslinks shared a link, 3 weeks, 4 days ago
FAUN.dev()

How GEICO lowered its $300M cloud spend and decoupled security from the network

GEICO's IT infrastructure transformation journey highlights the shift from legacy network-centric security model to a more modern, identity-first approach. By centralizing identity and secrets management using HashiCorp Vault, GEICO improved security, reliability, and compliance across their hybrid .. read more  

Link
@devopslinks shared a link, 3 weeks, 4 days ago
FAUN.dev()

Scaling PostgreSQL to power 800 million ChatGPT users

OpenAI pushedPostgreSQLto handle millions of QPS across 800M users. How? Nearly 50 read replicas, heavy read offloading, and serious trimming on write pressure. Writes? Sent elsewhere. Sharded systems likeCosmosDB, lazy writes, and app-level tweaks helped sidestep PostgreSQL’sMVCCwrite amplification.. read more  

Scaling PostgreSQL to power 800 million ChatGPT users
Link
@devopslinks shared a link, 3 weeks, 4 days ago
FAUN.dev()

CloudBees CEO: Why Migration Is a Mirage Costing You Millions

A new CloudBees survey shows 57% of enterprises dropped over $1M on cloud migrations last year. Each effort blew past budget by an average of $315K. The kicker? Many teams still treatmodernization as migration- a shortcut that usually leads to drained budgets, burned-out devs, and delays in shipping.. read more  

Link
@devopslinks shared a link, 3 weeks, 4 days ago
FAUN.dev()

The only Terraform pipeline you will ever need: GitHub Actions for Multi-Environment Deployments

A sharp new GitHub Actions pipeline can now sniff out which Terraform environments changed - anywhere in the repo, no matter how nested - and run them in parallel. Fast, clean, and automatic. It leans onmatrix jobs,Checkovfor static analysis,Workload Identity Federationfor secure cloud access (no ha.. read more  

The only Terraform pipeline you will ever need: GitHub Actions for Multi-Environment Deployments
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.