Skip to main content

Posts

Cloudsmith Extends Policies and Controls to Secure Application Binaries

Cloudsmith this week revealed it has expanded the policy management and continuous risk detection capabilities it makes available within its software artifact management platform to now include policy templates, cooldown policies, and expanded evaluation triggers. Alison Sickelka, vice president of product for Cloudsmith, said these additions to the platform will make it simpler to prevent malicious packages from inadvertently being incorporated into the binaries that DevOps teams deploy in production environments. For example, policy templates written in the Rego programming language can now be used to provide a set of baseline controls that are consistently implemented across a DevOps workflow. Additionally, DevOps teams can now implement a set of cooldown policies that prevent any recently made available software package from being indexed. That capability ensures that only versions of a validated package are exposed to application developers, noted Sickelka. That’s crucial beca...
Post a Comment
Read more
Recent posts

Deterministic Robots, Agentic Reasoning: Balancing Reliability and Flexibility in Software Test Automation

Summary: Scott Robohn explores how UiPath Test Cloud mitigates the “release gap” caused by rapid, AI-driven development by offering a platform that blends a combination of deterministic automation, AI agents, and human oversight. By distinguishing between deterministic “robots” for efficient, cost-effective regression and flexible “agents” for complex reasoning, the platform empowers quality engineers to use agentic reasoning selectively while managing AI-related consumption and cost. Drawing on his network engineering background, Scott advocates for adopting these software testing principles to build greater resilience and adaptability within NetDevOps and broader IT infrastructure domains. Intro I had the pleasure of serving as a delegate for the UiPath Test Cloud Tech Field Day Showcase . I’ve heard a lot about UiPath from my consulting clients and in the market over the last few years, so I jumped at the opportunity to be a part of the delega...
Post a Comment
Read more

Microsoft’s GitHub Hit by Major Outage as AI-Driven Demand Strains Infrastructure

GitHub, the Microsoft Corp.-owned code hosting platform serving more than 180 million developers, is still reeling from a widespread outage on Monday that severely disrupted software development pipelines globally. The hours-long incident was the latest in a relentless series of reliability failures for a service struggling to keep pace with an unprecedented surge in artificial intelligence (AI)-assisted coding traffic. The disruptions began around 9:40 a.m. EDT, initially manifesting as performance degradation across core services. The issue rapidly escalated, causing error rates to spike near 20% for web interface and API traffic, while archive and raw repository content downloads suffered a staggering 50% failure rate. Key capabilities — including GitHub Actions automated testing, webhooks, GitHub Pages, and the AI pair-programmer Copilot — were heavily compromised. Downdetector logged thousands of user reports at the peak of the disruption, with minor outage spikes simultaneousl...
Post a Comment
Read more

Is Your New DevSecOps Tooling Reducing Work Or Just Adding to It?

Security belongs in the software delivery pipeline. The harder question is where, how often and at what cost. Many pipeline teams eventually add security scanning to CI/CD, and relatively few go back afterward to measure what it actually cost the delivery process. Security coverage went up. Something else changed too, and it is rarely measured with the same rigor. “Shift left” gets treated as a free upgrade: catch problems earlier, at lower cost, with no real downside. That is true for the cost of fixing a vulnerability. It is not automatically true for the cost of running your pipeline. A security control can be worth adding and still change your delivery economics in ways worth naming honestly, rather than assuming they net out to zero. What Changes When Security Enters the Pipeline SAST, SCA, container scanning, secret scanning, and dependency analysis all do real work, and none of them are free to run. Each one is a pipeline stage with its own execution time, and many scale wit...
Post a Comment
Read more

GitHub Hit by Widespread Outage, Halting Work for Global Developers

A major technical outage struck GitHub on Monday morning, disrupting workflows for millions of developers worldwide for several hours as critical services, automated testing pipelines, and artificial intelligence (AI) coding tools suffered high error rates. The hosting platform — a subsidiary of Microsoft Corp. that supports roughly 180 million users — first reported performance issues around 9:40 a.m. EDT. The disruption quickly escalated as thousands of users flooded outage-tracking platforms like Downdetector to report failing repositories, broken downloads, and degraded performance. At the peak of the incident, GitHub confirmed error rates of approximately 20% across its web interface and API traffic. Core functions faced even steeper degradation: raw repository content and archive downloads suffered error rates near 50%, while enterprise authentication features like SAML, OIDC, SCIM, and Team Sync were broadly impacted. The chaos broadened by mid-morning when GitHub confirmed d...
Post a Comment
Read more

Ten Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 Leidos Bethesda, MD Senior DevOps Engineer $131,300 to $237,350 SAIC San Diego, CA Cloud DevOps Engineer $120,001 to $160,...
Post a Comment
Read more

Dynatrace Acquires Arize as AI Agents Deepen the Observability Challenge

Dynatrace announced Thursday it has agreed to acquire AI observability company Arize in a $915 million cash and stock transaction. Rick McConnell, CEO of Dynatrace, said the company expects demand for AI observability will keep growing as more AI systems move into production. He said acquiring Arize would speed up Dynatrace’s roadmap, expand its developer reach and bring Arize’s AI team into the company. Dynatrace said the deal would combine Arize’s AI evaluation and observability software with its own platform for correlating telemetry and tracing dependencies across applications, services and infrastructure. The transaction includes about $815 million in cash and replacement equity awards for Arize employees and is expected to close later this quarter or early in Dynatrace’s fiscal third quarter. DevOps teams are already used to piecing together telemetry across distributed systems when something breaks. AI adds another source of context to correlate when information about model ...
Post a Comment
Read more