Skip to main content

Posts

Is Your New DevSecOps Tooling Reducing Work Or Just Adding to It?

Security belongs in the software delivery pipeline. The harder question is where, how often and at what cost. Many pipeline teams eventually add security scanning to CI/CD, and relatively few go back afterward to measure what it actually cost the delivery process. Security coverage went up. Something else changed too, and it is rarely measured with the same rigor. “Shift left” gets treated as a free upgrade: catch problems earlier, at lower cost, with no real downside. That is true for the cost of fixing a vulnerability. It is not automatically true for the cost of running your pipeline. A security control can be worth adding and still change your delivery economics in ways worth naming honestly, rather than assuming they net out to zero. What Changes When Security Enters the Pipeline SAST, SCA, container scanning, secret scanning, and dependency analysis all do real work, and none of them are free to run. Each one is a pipeline stage with its own execution time, and many scale wit...
Post a Comment
Read more
Recent posts

GitHub Hit by Widespread Outage, Halting Work for Global Developers

A major technical outage struck GitHub on Monday morning, disrupting workflows for millions of developers worldwide for several hours as critical services, automated testing pipelines, and artificial intelligence (AI) coding tools suffered high error rates. The hosting platform — a subsidiary of Microsoft Corp. that supports roughly 180 million users — first reported performance issues around 9:40 a.m. EDT. The disruption quickly escalated as thousands of users flooded outage-tracking platforms like Downdetector to report failing repositories, broken downloads, and degraded performance. At the peak of the incident, GitHub confirmed error rates of approximately 20% across its web interface and API traffic. Core functions faced even steeper degradation: raw repository content and archive downloads suffered error rates near 50%, while enterprise authentication features like SAML, OIDC, SCIM, and Team Sync were broadly impacted. The chaos broadened by mid-morning when GitHub confirmed d...
Post a Comment
Read more

Ten Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 Leidos Bethesda, MD Senior DevOps Engineer $131,300 to $237,350 SAIC San Diego, CA Cloud DevOps Engineer $120,001 to $160,...
Post a Comment
Read more

Dynatrace Acquires Arize as AI Agents Deepen the Observability Challenge

Dynatrace announced Thursday it has agreed to acquire AI observability company Arize in a $915 million cash and stock transaction. Rick McConnell, CEO of Dynatrace, said the company expects demand for AI observability will keep growing as more AI systems move into production. He said acquiring Arize would speed up Dynatrace’s roadmap, expand its developer reach and bring Arize’s AI team into the company. Dynatrace said the deal would combine Arize’s AI evaluation and observability software with its own platform for correlating telemetry and tracing dependencies across applications, services and infrastructure. The transaction includes about $815 million in cash and replacement equity awards for Arize employees and is expected to close later this quarter or early in Dynatrace’s fiscal third quarter. DevOps teams are already used to piecing together telemetry across distributed systems when something breaks. AI adds another source of context to correlate when information about model ...
Post a Comment
Read more

GitHub Copilot’s Latest Update Bets on Model Choice, Not Model Loyalty

Most development teams don’t pick one AI model and stick with it anymore. They pick the best model for the job at hand and switch when the job changes. GitHub’s latest round of Copilot updates, published Aug. 13 in its weekly changelog covering the week of Aug. 10, reads like an admission that this is now normal — and that Copilot needs to be built around it rather than around any single model. The headline additions are two new models. Kimi K3 is rolling out across Copilot Pro, Pro+, Max, Business, and Enterprise plans. MAI-Code-1.1-Flash arrives alongside it, with native image understanding and what GitHub describes as improvements in coding quality, instruction-following, tool use, and performance. Neither replaces anything. They sit next to the models already available, which is the point. GitHub isn’t trying to win developers over to one model family. It’s trying to make sure whichever model they trust is one click away. That same logic shows up in Visual ...
Post a Comment
Read more

Treat Business Workflow Changes Like Deployments

Business automation often reaches production without the release discipline applied to application code. A routing rule changes, an approval threshold moves, or an integration starts writing to a new system. The edit may happen in a visual builder instead of a repository, but its blast radius is still real: orders can duplicate, customers can receive the wrong message, and operators can lose the context needed to recover. The useful shift is to treat every workflow change as a deployment. That does not mean forcing a full software delivery platform onto every automation tool. It means defining a small release contract before the new behavior touches live work. Define the Deployable Unit A workflow is larger than its diagram. Its deployable unit includes decision rules, field mappings, credentials, schedules, permissions, retry behavior, operator screens, and every external side effect. If a change affects any of those elements, the release record should name them explicitly. Give t...
Post a Comment
Read more

Developer Resistance to AI Isn’t Fear – It is Identity 

Developers are often assumed to resist AI because they fear it will take their job , that using it means training their own replacement. That is not quite right. What is happening is that AI has changed, permanently, what the job of a developer is. And not every developer is, or has to be, okay with that. A 2024 peer-reviewed study backs this up: developers’ concerns centre less on job loss and more on how AI reshapes the work itself. The market data agrees. In 2025, 84 percent of developers were using or planning to use AI coding tools, yet only 33 percent trusted the code those tools produce, according to the same survey . Adoption is rising. Trust is falling. That gap is the real signal, and it has nothing to do with job security. Traditional coding is hands-on. Developers solve problems, shape architecture, write code, debug, and make technical decisions directly. That is the part most engineers enjoy. AI-assisted coding moves the developer up a level: instructing, reviewin...
Post a Comment
Read more