Reducing security risk in open source software with GitHub Actions and OpenSSF Scorecards V4
We’re excited to announce the V4 release of the OpenSSF’s Scorecard project in partnership with Google. ⌘ Read more
Prosodical Thoughts: Prosody 0.11.12 released
We are pleased to announce a new minor release from our stable branch.
This is a security release that addresses a denial-of-service vulnerability in
Prosody’s mod_websocket. For more information, refer to the
20220113 advisory.
A summary of changes in this release:
Security- util.xml: Do not allow doctypes, comments or processing instructions
As usual, download instructions for many platforms can be f … ⌘ Read more
The Open Source Software Security Summit: securing the world’s code together
My colleague Stormy Peters and I are proud to represent GitHub at the White House’s Open Source Software Security Summit to share how securing open source begins by empowering developers. ⌘ Read more
お知らせ：侵入型ランサムウェア攻撃を受けたら読むFAQ ⌘ Read more
Securing the Software Supply Chain with Docker Business
Organizations are increasingly facing new challenges in trying to protect their software supply chain. This has become especially difficult as the workforce has transitioned to a more distributed model with organizations scaling and onboarding more developers on distributed teams. With the number of software supply-chain attacks increasing by 650% in 2021, coordinating all of these […]
The post [Securing the Software Su … ⌘ Read more
Now consumer “security” software is mining cryptocurrency! ⌘ Read more
How the community powers GitHub Advanced Security with CodeQL queries
The GitHub Security Lab’s CodeQL bounty program fuels GitHub Advanced Security with queries written by the open source community. ⌘ Read more
Ignite Realtime Blog: Openfire 4.6.7 released (Log4j 2.17.1 only change)
Openfire 4.6.7 has been released with only a single change to bump the bundled log4j library to version 2.17.1. Whilst we do not believe Openfire to be vulnerable to the CVEs associated with the log4j 2.17.0 and 2.17.1 releases, we realize that many folks are running naive security scanners that are simply checking for bundled jar versions.
The [changelog](https://download.igniterealtime.org/open … ⌘ Read more
Paul Schaub: PGPainless 1.0.0 Released!
Close to the end of 2021 I’m excited to announce the release of PGPainless version 1.0.0! After a series of release candidates, it is finally time to party! The OpenPGP library successfully underwent a security audit in late November and I feel like it finally reached a state of sufficient maturity to be worthy of a major release with a “1” at the front.
. The fake markdown is a bit of a drag.
A render mode for Gemini probably wouldnt be too hard. There are markdown to Gemini libs out there.
With Web3 the whole trust a 3rd party browser ext + high fees + env impact for compute and storage are serious no gos for me.. I have heard one too many horror stories about clicking the wrong link and some script draining your metamask wallet.
Ignite Realtime Blog: Openfire 4.6.6 and 4.5.5 releases (Log4j-only changes)
As we’re monitoring developments around the recent Log4j vulnerabilities, we’ve decided to provide another update for Openfire to pull in the latests available updates from Log4j.
Since the previous release, the Log4j team released a new version (2.16.0) of their library, that provides better protection against the original vulnera … ⌘ Read more
5 automations every developer should be running
Looking to avoid security vulnerabilities, buttons that don’t work, slow site speeds, or manually writing release notes? This one’s for you. ⌘ Read more
Using GitHub’s security features to help identify Log4j exposure in your codebase
Use GitHub’s security features to assess Apache Log4j exposure and, where possible, mitigate this vulnerability within your GitHub repositories. ⌘ Read more
How to define security requirements for your OSS project
Defining your security requirements is the most important proactive control you can implement for your project. Here’s how. ⌘ Read more
Docker Secure Images: What Are They and How Do I Use Them?
One of the major challenges in today’s development environments is balancing innovation with security. Focusing on both is never a small effort and might seem tedious or constraining at times, but when security is implemented from the start, it can shorten development time and prevent exposure to vulnerabilities. This is why Docker rolled out Docker […]
The post [Docker Secure Images: What Are They and How Do I Us … ⌘ Read more
Docker Verified Publisher: Trusted Sources, Trusted Content
Six months since its launch at DockerCon, the Docker Verified Publisher program delivers on its promise to developers and partners alike The Docker Verified Publisher program means trusted content and trusted sources for the millions of Docker users. At the May 2021 DockerCon, Docker announced its Secure Software Supply Chain initiative, highlighting Docker Verified Publisher […]
The post [Docker Verified Publishe … ⌘ Read more
Write more secure code with the OWASP Top 10 Proactive Controls
This lesser-known OWASP project aims to help developers prevent vulnerabilities from being introduced in the first place. ⌘ Read more
Secure deployments with OpenID Connect & GitHub Actions now generally available
GitHub Actions now supports OpenID Connect for secure deployment to different cloud providers via short-lived, auto-rotated tokens. ⌘ Read more
How to squash bugs by enrolling in OSS-Fuzz
OSS-Fuzz is Google’s awesome fuzzing service for open source projects. GitHub Security Lab’s @kevinbackhouse describes enrolling a project. ⌘ Read more
The Copyright Office expands your security research rights
Recently, the Copyright Office responded to the calls to clarify the scope of protected security research. ⌘ Read more
Your Docker Business Questions Answered
In our recent live webinar, Management & Security at Scale with Docker Business (check out the webinar recording here) Docker Senior Product Marketing Manager Cat Siemer and Head of Dev Rel and Community Peter McKee discussed our new product subscription tier, Docker Business and how it addresses the challenges faced by large organizations that require enhanced […]
The post [Your Docker Business Questions Answered](https://www.docker.com/blog/your-do … ⌘ Read more
Accelerate security adoption in your organization
The GitHub Services Engineers have released the Advanced Security Enforcer GitHub Action to enable organizations to utilize code scanning in a consistent and automated way. ⌘ Read more
Erlang Solutions: Blockchain Tech Deep Dive ¼
INTRODUCTIONBlockchain technology is transforming nearly every industry, whether it be banking, government, fashion or logistics. The benefits of using blockchain are substantial – businesses can lower transaction costs, free up capital, speed up processes, and enhance security and trust. So it’s no surprise that more and more companies and developers are interested in working with the technology and leveraging its potential than ev … ⌘ Read more
What’s new from GitHub Changelog? October 2021 recap
A public beta of the new GitHub Issues, a “security manager” role for organizations, a command palette beta, and lots more. ⌘ Read more
How to Select the Docker Subscription That’s Right for You
On August 31st, 2021, we announced updates to our product subscription tiers. These changes are helping us to deliver on our mission to simplify application development and remove complexities for developers, while also providing the security and scale businesses rely on. With four different subscription options: Personal, Pro, Team, and Business, it might be difficult […]
The post [How to Select the Docker … ⌘ Read more
From Netnod to Mullvad
Tomorrow is my last day at Netnod after seven years. While at Netnod I
have mostly spent my time helping build several different anycast DNS
solutions, but I also did some IX provisioning stuff, some security
work, and in some small way also helped bring the Network Time\
Security protocol forward.
A few years back I was the team leader for the develop … ⌘ Read more
An Easier Way to Get Started with Docker Business
As you may have already heard, the January 31st grace period to move to a paid subscription for commercial use of Docker Desktop is fast approaching. With this announcement, we introduced our new subscription tiers, including Docker Business–our offering specifically for organizations who want to scale their use of Docker all while maintaining security and […]
The post [An Easier Way to Get Started with Docker Business](https:/ … ⌘ Read more
Blue-teaming for Exiv2: adding custom CodeQL queries to code scanning
The Exiv2 team tightened our security by enabling GitHub’s code scanning feature and adding custom queries tailored to the Exiv2 code base. ⌘ Read more
GitHub’s commitment to npm ecosystem security
We’re sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm. ⌘ Read more
Highlights from GitHub’s security roadmap at Universe 2021
During Universe, we received a number of security questions ranging from our strategy to our advisories. Here’s what we’ve got planned! ⌘ Read more
GitHub Enterprise Server 3.3 enhances CI/CD and adds a new security manager role
This latest release sees the introduction of a new role, a new webhook for GitHub Actions, and a bright edge to dark mode. ⌘ Read more
Three rules of bug fixing for better OSS security
When you’re fixing a bug, especially a security vulnerability, you should add a regression test, fix the bug, and find & fix variants. ⌘ Read more
Blue-teaming for Exiv2, part 1: creating a security advisory process
This blog post is the first in a series about hardening the security of the Exiv2 project. My goal is to share tips that will help you harden the security of your own project. ⌘ Read more
PEP 672: Unicode-related Security Considerations for Python
This document explains possible ways to misuse Unicode to write Python
programs that appear to do something else than they actually do. ⌘ Read more
October 2021 Newsletter
The latest and greatest content for developers. Webinar | Management & Security at Scale with Docker Business See how Docker Business enables centralized management and security for organizations. Register Now! Check out this recap of the Screaming in the Cloud episode, Heresy in the Church of Docker Desktop with Scott Johnston. [Learn More] The latest edition of […]
The post October 2021 Newsletter appeared first on [Dock … ⌘ Read more
Notary v2 Project Update
Supply chain security is something that has been increasingly important to all of us in the last few years. Almost as important as the global supply chains that are having problems distributing goods around the world! There have been many attacks via the supply chain. This is where some piece of software that you use […]
The post Notary v2 Project Update appeared first on Docker Blog. ⌘ Read more
GitHub Actions for security and compliance
GitHub Actions can automate several common security and compliance tasks, even if your CI/CD pipeline is managed by another tool. ⌘ Read more
GitHub security update: revoking weakly-generated SSH keys
On September 28, 2021, we received notice from the developer Axosoft regarding a vulnerability in a dependency of their popular git GUI client - GitKraken. An underlying issue with a dependency, called `keypair`, resulted in the GitKraken client generating weak SSH keys. ⌘ Read more
GitHub Advisory Database now powers npm audit
Today, we’re adding a proxy on top of the GitHub Advisory Database that speaks the `npm audit` protocol. This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database. ⌘ Read more
Webinar Recap: Docker Business – Management & Security at Scale
Recently, Docker Head of Developer Relations Peter McKee and Docker Head of Sales Scott Campbell led a webinar to spotlight the new Docker Business tier. During the webinar, Peter and Scott drill down into Docker Business, the pain points it addresses, the incredible value Docker Desktop packs under the hood, what makes Docker itself such […]
The post [Webinar Recap: Docker Business – Management & Secur … ⌘ Read more
Join Us at SnykCon 2021!
This week is Snyk’s annual SnykCon virtual conference that aims to connect with the global developer and security communities and Docker is excited to participate as a gold sponsor for the second year! At last year’s conference, we discussed our partnership with Snyk to incorporate their leading vulnerability scanning across the entire Docker application development […]
The post Join Us at SnykCon 2021! appeared first on [ … ⌘ Read more
Cybersecurity spotlight on bug bounty researchers @chen-robert and @ginkoid
GitHub’s bug bounty team is excited to kick off Cybersecurity Awareness Month with a spotlight on two security researchers who participate in the GitHub Security Bug Bounty Program. ⌘ Read more
Two-Factor Security Key
⌘ Read more
GitHub Enterprise Server 3.2 is now generally available
Today, we’re excited to announce that GitHub Enterprise Server 3.2 is generally available. This release brings over 70 new features and changes that improve developer experience and deliver new security capabilities. ⌘ Read more
GitHub Advisory Database now supports Rust
We’re excited to announce that the GitHub Advisory Database now includes curated security advisories on the Rust ecosystem! ⌘ Read more
Accelerating New Features in Docker Desktop
In November 2019 Docker announced our re-focusing on the needs of developers. Specifically, we set out to simplify the complexity of modern application development to help developers get their ideas from code to cloud as quickly and securely as possible. We’ve made a lot of progress since delivering against our public roadmap, including shipping Docker […]
The post [Accelerating New Features in Docker Desktop](https://www.docker.com/blog/acc … ⌘ Read more