Docker Inc have announced general availability of Docker Security Scanning, which was previously known as Project Nautilus. The release comes alongside an update to the CIS Docker Security Benchmark to bring it in line with Docker 1.11.0, and an updated Docker Bench tool for checking that host and daemon configuration match security benchmark recommendations.
GitLab has just announced a fix for a number of important security fixes, including a critical privilege escalation, and strongly recommends that all GitLab installations from version 8.2 onwards be upgraded immediately. InfoQ has spoken with GitLab’s Stan Hu, VP of Engineering.
Last week saw the first DevOps Days conference catering specifically to the enterprise world, in London. Talks ranged from re-thinking (traditional) management processes in a technology-disrupted world to facts and drivers of DevOps adoption by early adopters. The idea of bi-modal IT was also discussed throughout the conference, as well as need for better security and opinionated platforms.
In July 2013 Security Explorations discovered a vulnerability in Java by which attackers could elevate their access privileges. Oracle released a patch, but a simple modification was discovered that still makes the attack effective. Once known, Oracle released a patch as part of 8u77. In this article we investigate the little understood class loading process at the heart of the problem.
This article presents a review of the first day at the O'Reilly Software Architecture conference, held in New York City 12-13th April. Sessions summarised include, ‘blah, blah... microservices...blah, blah’, ‘the evolution of evolutionary architecture’, ‘Death Star Security’, ‘Twelve Patterns for Hypermedia Architecture’, ‘Architecture Without an End State’ and 'Leading Simplicity'.
Capital One launched the DevExchange Beta developer site and initial API offering last month.
While most of the attention is on .NET Core, work continues on the original .NET Framework. Recently released as a preview, version 4.6.2 is primarily focused on security and WinForms/WPF related features.
Microsoft recently announced an expansion of their Azure regions world-wide. The number of regions announced now sits at 30, with 22 being generally available (GA). The most recent wave, of Azure regions, focuses on trusted environments for government customers or regions with specific privacy needs.
The NPM project has formally acknowledged a long-standing security vulnerability in which it is possible for malicious packages to run arbitrary code on developer's systems, leading to the first NPM created worm. With the recent problems with NPM, is it safe to use any more? InfoQ investigates.
The court appearance between Apple and the FBI, originally scheduled for later today, has been postponed a week until after Easter, following a request from the FBI to defer.
Axel Fontaine on the "Bootable App" pattern, a bare bones machine image for deploying immutable infrastructure to the cloud. This minimal image covers all layers of the stack, including OS kernel, libraries and runtime environment but still has a small footprint, reducing both image upload time and storage costs while also significantly reducing the attack surface on running instances.
On February 25th, 2016 Microsoft announced updates to their Operations Management Suite (OMS). The updates, in this particular iteration of the service, are focused on the security and audit portions of the suite and target the user experience, additional capabilities and features.
InfoQ's Rags Srinivas caught up with Bryan Cantrill a day after the Containers Summit at New York City and discussed all things containers from Solaris Zones to Docker.
Apple and the FBI have appeared before the House Committee on the Judiciary Hearings to argue over the legalities of whether Apple should be compelled to create an insecure version of iOS to allow the FBI to break into a suspect's phone. InfoQ has been watching the live video stream and summarises the outcome.
Apple has responded to questions raised about its stance with the FBI and CEO Tim Cook has appeared on live TV to defend Apple's stance. They have now filed a lawsuit to have the FBI's case dismissed. InfoQ updates you with the latest on the subject.
CONTENT IN THIS BOX
PROVIDED BY OUR SPONSOR
Increase security on compromised platforms with Intel® SGX.
An Intel technology for application developers who are seeking to protect select code and data from disclosure or modification.
A Developer’s Perspective.
Developers have long been constrained by the security capabilities that major platform providers have exposed for application development. How Bromium and wolfSSL employ Intel® SGX to create more secure, next-generation solutions.
Learn more about the Intel SGX SDK, a collection of APIs, libraries, documentation, sample source code, and tools that allows software developers to create and debug Intel SGX enabled applications in C/C++.
Protect Application Code, Data, & Secrets from Attack.
Developers can partition their application into CPU hardened “enclaves” or protected areas of execution that increase security even on compromised platforms.
Intel Software Guard Extensions (SGX) for Dummies.
At its root, Intel® SGX is a set of new CPU instructions that can be used by applications to set aside private regions of code and data.