Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@kala shared a link, 3 months, 2 weeks ago
FAUN.dev()

Cato CTRL™ Threat Research: HashJack - Novel Indirect Prompt Injection Against AI Browser Assistants

A new attack method -HashJack- shows how AI browsers can be tricked with nothing more than a URL fragment. It works like this: drop malicious instructions after the#in a link, and AI copilots likeComet,Copilot for Edge, andGemini for Chromemight swallow them whole. No need to hack the site. The LLM .. read more  

Link
@kala shared a link, 3 months, 2 weeks ago
FAUN.dev()

1,500+ PRs Later: Spotify’s Journey with Our Background Coding Agent

Spotify just gave its internal Fleet Management tooling a serious brain upgrade. They've wired inAI coding agentsthat now handle source-to-source transformations across repos - automatically. So far? Over 1,500 AI-generated PRs pushed. Not just lint fixes - these include heavy-duty migrations. They'.. read more  

1,500+ PRs Later: Spotify’s Journey with Our Background Coding Agent
Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

How when AWS was down, we were not

During the AWS us-east-1 meltdown - when DynamoDB, IAM, and other key services went dark - Authress kept the lights on. Their trick? A ruthless edge-first, multi-region setup built for failure. They didn’t hope DNS would save them. They wired in automated failover, rolled their own health checks, an.. read more  

How when AWS was down, we were not
Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

Collaborating with Terraform: How Teams Can Work Together Without Breaking Things

When working with Terraform in a team environment, common issues may arise such as state locking, version mismatches, untracked local applies, and lack of transparency. Atlantis is an open-source tool that can help streamline collaboration by automatically running Terraform commands based on GitHub .. read more  

Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

Self Hostable Multi-Location Uptime Monitoring

Vigilant runs distributed uptime checks with self-registeringGo-based "outposts"scattered across the globe. Each one handles HTTP and Ping, reports back latency by region, and calls home over HTTPS. The magic handshake? Vigilant plays root CA, handing outephemeral TLS certson the fly... read more  

Self Hostable Multi-Location Uptime Monitoring
Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

Test Automation Structure for Single Code Base Projects

The authors discuss the development of a new automation infrastructure post-merger, leading to a unified automation project that can handle all cultures, languages, and clients efficiently. They chose Playwright over Cypress for its improved resource usage and faster execution times, aligning better.. read more  

Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

How Netflix optimized its petabyte-scale logging system with

Netflix overhauled its logging pipeline to chew through5 PB/day. The stack now leans onClickHousefor speed andApache Icebergto keep storage costs sane. Out went regex fingerprinting - slow and clumsy. In came aJFlex-generated lexerthat actually keeps up. They also ditched generic serialization in fa.. read more  

How Netflix optimized its petabyte-scale logging system with
Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

The AI Gold Rush Is Forcing Us to Relearn a Decade of DevOps Lessons

Sauce Labs just dropped a reality check:95% of orgshave fumbled AI projects. The kicker?82% don’t have the QA talent or toolsto keep things from breaking. Even worse,61% of leaders don’t get software testing 101, leaving AI pipelines full of holes - cultural, procedural, and otherwise. System shift:.. read more  

Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

A Love Letter to FreeBSD

A Linux user takes FreeBSD for a spin - and comes away impressed. What stands out? Clean, deliberate engineering.Boot environmentsmake updates stress-free. The newpkgbasesystem adds modularity without chaos. And the OS treatsuptimenot just as a metric, but as a design goal. The essay makes a solid c.. read more  

Link
@devopslinks shared a link, 3 months, 2 weeks ago
FAUN.dev()

The $1,000 AWS mistake

A missingVPC Gateway Endpointsent EC2-to-S3 traffic through aNAT Gateway, lighting up over$1,000in unnecessary data processing charges. All that for in-region traffic hitting an AWS service. Why? AWS defaulted the route to the NAT Gateway. It only takes the free S3 Gateway Endpoint if youtellit to. .. read more  

The $1,000 AWS mistake
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.