Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@kala shared a link, 1 month, 1 week ago
FAUN.dev()

AI and QE: Patterns and Anti-Patterns

The author shared insights on how AI can be leveraged as a QE and highlighted potential dangers to watch out for, drawing parallels with misuse of positive behaviors or characteristics taken out of context. The post outlined anti-patterns related to automating tasks, stimulating thinking, and tailor.. read more  

Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

How when AWS was down, we were not

During the AWS us-east-1 meltdown - when DynamoDB, IAM, and other key services went dark - Authress kept the lights on. Their trick? A ruthless edge-first, multi-region setup built for failure. They didn’t hope DNS would save them. They wired in automated failover, rolled their own health checks, an.. read more  

How when AWS was down, we were not
Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

Collaborating with Terraform: How Teams Can Work Together Without Breaking Things

When working with Terraform in a team environment, common issues may arise such as state locking, version mismatches, untracked local applies, and lack of transparency. Atlantis is an open-source tool that can help streamline collaboration by automatically running Terraform commands based on GitHub .. read more  

Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

Self Hostable Multi-Location Uptime Monitoring

Vigilant runs distributed uptime checks with self-registeringGo-based "outposts"scattered across the globe. Each one handles HTTP and Ping, reports back latency by region, and calls home over HTTPS. The magic handshake? Vigilant plays root CA, handing outephemeral TLS certson the fly... read more  

Self Hostable Multi-Location Uptime Monitoring
Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

Test Automation Structure for Single Code Base Projects

The authors discuss the development of a new automation infrastructure post-merger, leading to a unified automation project that can handle all cultures, languages, and clients efficiently. They chose Playwright over Cypress for its improved resource usage and faster execution times, aligning better.. read more  

Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

How Netflix optimized its petabyte-scale logging system with

Netflix overhauled its logging pipeline to chew through5 PB/day. The stack now leans onClickHousefor speed andApache Icebergto keep storage costs sane. Out went regex fingerprinting - slow and clumsy. In came aJFlex-generated lexerthat actually keeps up. They also ditched generic serialization in fa.. read more  

How Netflix optimized its petabyte-scale logging system with
Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

The AI Gold Rush Is Forcing Us to Relearn a Decade of DevOps Lessons

Sauce Labs just dropped a reality check:95% of orgshave fumbled AI projects. The kicker?82% don’t have the QA talent or toolsto keep things from breaking. Even worse,61% of leaders don’t get software testing 101, leaving AI pipelines full of holes - cultural, procedural, and otherwise. System shift:.. read more  

Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

A Love Letter to FreeBSD

A Linux user takes FreeBSD for a spin - and comes away impressed. What stands out? Clean, deliberate engineering.Boot environmentsmake updates stress-free. The newpkgbasesystem adds modularity without chaos. And the OS treatsuptimenot just as a metric, but as a design goal. The essay makes a solid c.. read more  

Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

The $1,000 AWS mistake

A missingVPC Gateway Endpointsent EC2-to-S3 traffic through aNAT Gateway, lighting up over$1,000in unnecessary data processing charges. All that for in-region traffic hitting an AWS service. Why? AWS defaulted the route to the NAT Gateway. It only takes the free S3 Gateway Endpoint if youtellit to. .. read more  

The $1,000 AWS mistake
Link
@devopslinks shared a link, 1 month, 1 week ago
FAUN.dev()

Terraform Workbook - Your Guide to Infra as Code (IaC)

This post outlines the various Terraform project files and their purposes, such as vars.tf for default variable declarations, terraform.tfvars for overriding default variable values, terraform.tf for tfstate backends and provider declarations, version.tf for Terraform version constraints, and .terra.. read more  

Terraform Workbook - Your Guide to Infra as Code (IaC)
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.