Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@varbear shared a link, 6 days ago
FAUN.dev()

Stop Forwarding Errors, Start Designing Them

A fresh take on Rust error handling just dropped - and it's calling out the usual suspects. Forget blindly forwarding errors withanyhowor smearing context around withProvider. This approach pushes forstructured, intent-driven error types- errors that say what to do next (like "retry this") instead o.. read more  

Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

Agentic AI, MCP, and spec-driven development: Top blog posts of 2025

AI speeds up dev - but it’s a double-edged keyboard. It sneaks in subtle bugs and brittle logic that break under pressure. To keep things sane, teams are fighting back withguardrail patterns,AI-aware linters, andtest suites hardened for hallucinated code... read more  

Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

21 Lessons From 14 Years at Google

A seasoned Google engineer drops 21 sharp principles for scaling engineering beyond just writing code. Think:clarity beats cleverness,users over egos,alignment over being “right.”The core message? Build systems humans can work with - especially under stress. Favorites: kill pointless work, treat pro.. read more  

21 Lessons From 14 Years at Google
Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

Year in Review: Lessons From 12 Projects Patreon Shipped in 2025

Patreon engineers made massive bets in 2025, shipping code across all areas of the system and enabling impactful features like Autopilot's growth tools suite. Expanding Autopilot's scope, reach, and effectiveness was a challenge, especially guaranteeing recipient redemption after email delivery in a.. read more  

Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

Distinguishing yourself early in your career as a developer

A seasoned dev maps the job market into three tiers:local/public companies,VC-backed/startups, andBig Tech/finance. Each step up brings more money, more competition, and a steeper climb. Category 3(Big Tech/finance): Highest salaries. Broadest interview access. Brutal prep required. Category 2(start.. read more  

Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

The Code Review That Cost $2 Million, CodeGood

New data shows only15% of code review comments catch real bugs. The rest? Nitpicks on style, naming, or formatting - stuff linters and AI were made to handle. Human reviews burn through$3.6M a yearin larger orgs and still miss the tough stuff: threading issues, system integration bugs, rare edge cas.. read more  

Link
@varbear shared a link, 6 days, 1 hour ago
FAUN.dev()

Build an AI-powered website assistant with Amazon Bedrock

AWS spun up a serverless RAG-based support assistant usingAmazon BedrockandBedrock Knowledge Bases. It pulls in docs via a web crawler and S3, then stuffs embeddings intoAmazon OpenSearch Serverless. Access is role-aware, locked down withCognito. Everything spins up clean withAWS CDK... read more  

Build an AI-powered website assistant with Amazon Bedrock
Link
@kaptain shared a link, 6 days, 1 hour ago
FAUN.dev()

BadPods Series: Everything Allowed on AWS EKS

A security researcher ran a full-blown container escape on EKS usingBadPods- a tool that spins up dangerously overprivileged pods. The pod broke out of its container, poked around the host node, moved laterally, and swiped AWS IAM creds. All of it slipped past EKS’s defaultPod Security Admission (PS.. read more  

BadPods Series: Everything Allowed on AWS EKS
Link
@kaptain shared a link, 6 days, 1 hour ago
FAUN.dev()

Streamline your containerized CI/CD with GitLab Runners and Amazon EKS Auto Mode

GitLab Runners now work withAmazon EKS Auto Mode. That means hands-off infra, smarter scaling, and built-in AWS security. Runners spin up onEC2 Spot Instances, so teams can cut CI/CD compute costs by as much as90%- without hacking together flaky pipelines... read more  

Streamline your containerized CI/CD with GitLab Runners and Amazon EKS Auto Mode
Link
@kaptain shared a link, 6 days, 1 hour ago
FAUN.dev()

Kubernetes GPU Management Just Got a Major Upgrade

Kubernetes 1.34 droppedDynamic Resource Allocation (DRA)- think persistent volumes, but for GPUs and custom hardware. Vendors can now plug in drivers and schedulers for their devices, and workloads can pick exactly what they need. Coming in 1.35: a newworkload abstractionthat speaks the language of .. read more  

The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.