Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@varbear shared a link, 1 month, 1 week ago
FAUN.dev()

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

The Socket Threat Research Team has been following North Korea’s Contagious Interview operation as it targets blockchain and Web3 developers through fake job interviews. The campaign has added at least197 malicious npm packagesand over31,000 downloadssince last report, showcasing the adaptability of.. read more  

Link
@varbear shared a link, 1 month, 1 week ago
FAUN.dev()

Building Mac Farm: Running 2000+ iOS Pipelines Daily

At Trendyol, they runover 2,000 iOSpipelines daily across130 Mac machines, executing50,000+ unit testsand10,000+ UI testsfor their iOS apps. The team initiated a mobile CI transformation to address the challenges of scale and performance as their team grew and AI usage increased. They built a macOS .. read more  

Link
@varbear shared a link, 1 month, 1 week ago
FAUN.dev()

Partitions, Sharding, and Split-for-Heat in DynamoDB

DynamoDB starts to grumble when a single partition gets hit with more than 1,000WCU. To dodge throttling, writes need to fan out across shards. Recommended move: start with10 logical shards. WatchCloudWatch metrics. DialNup or down. Letburstandadaptive capacitybuy you breathing room - untilSplit-for.. read more  

Partitions, Sharding, and Split-for-Heat in DynamoDB
Link
@varbear shared a link, 1 month, 1 week ago
FAUN.dev()

How to Get Developers in Your Team to Contribute to Your Test Automation

A fresh blog post dives into how to get devs pulling their weight ontest automation- not as extra credit, but as part of shipping code. The playbook: tie automation work straight to thedefinition of done, clear up who owns what, and stop pretending delivery pressure is a mystery. The big idea? Most .. read more  

How to Get Developers in Your Team to Contribute to Your Test Automation
Link
@varbear shared a link, 1 month, 1 week ago
FAUN.dev()

Before You Push: Implementing Quality Gates in Your Software Project

This post discusses best practices for automated testing in software engineering, including unit tests and integration tests for databases, APIs, and emulators. It also covers end-to-end tests using tools like Cypress, Appium, Postman, and more. Additionally, it highlights the importance of environm.. read more  

Link
@kaptain shared a link, 1 month, 1 week ago
FAUN.dev()

In-place Pod resizing in Kubernetes: How it works and how to use it

Kubernetes 1.33 and 1.34 takein-place Pod resource updatesfrom beta to battle-ready. You can now tweak CPU and memory on the fly - no Pod restarts needed. It's on by default. What’s new: memory downsizing with guardrails, kubelet metrics that actually tell you what’s going on, and smarter retries th.. read more  

In-place Pod resizing in Kubernetes: How it works and how to use it
Link
@kaptain shared a link, 1 month, 1 week ago
FAUN.dev()

KubeCon North America 2025 Recap: Federation and

HAProxy just droppedUniversal Mesh, a fresh spin on service mesh design. Forget the per-service sidecars - this model plants high-speed gateways at the network edges instead. Result? Lighter by 30–50% on resources, easier to upgrade, and way less hassle routing traffic across Kubernetes, VMs, and cl.. read more  

KubeCon North America 2025 Recap: Federation and
Link
@kaptain shared a link, 1 month, 1 week ago
FAUN.dev()

Ingress NGINX Is Retiring. Here’s Your Path Forward with HAProxy

TheIngress NGINX projectis riding off into the sunset by March 2026. Time to pick a new horse. One strong contender: theHAProxy Kubernetes Ingress Controller. It matches feature-for-feature, comes with deeper observability, and reloads configs without taking your cluster offline. HAProxy’s not stopp.. read more  

Ingress NGINX Is Retiring. Here’s Your Path Forward with HAProxy
Link
@kaptain shared a link, 1 month, 1 week ago
FAUN.dev()

Developers don’t care about Kubernetes clusters

Most cloud-native tools obsess over clusters. Not developers. That means poor support for things like promoting code between environments or deploying by feature - not just by repo. The author pushes for a better way: platforms that hide the Kubernetes mess and tame CI/CD. Think feature-driven deplo.. read more  

Developers don’t care about Kubernetes clusters
Link
@kaptain shared a link, 1 month, 1 week ago
FAUN.dev()

udwall: A Tool for Making UFW and Docker Play Nice With Each Other

Hexmos droppedudwall, a declarative firewall manager that finally makesUFWandDockerplay nice. Docker’s notorious for bulldozing past UFW rules via iptables. udwall patches that hole. It syncs rules across both, auto-reconciles changes, backs up configs, and plugs cleanly intoAnsible. No more duct-ta.. read more  

udwall: A Tool for Making UFW and Docker Play Nice With Each Other
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.