Tag: automated updates
GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks
Tom Smith | | automated updates, CI/CD security, dependency cooldown, dependency pinning, dependency updates, devops security, GitHub Dependabot, lockfiles, malicious packages, open source security, package poisoning, package registry security, platform engineering, PyPi, Python Package Index, scoped access tokens, Software Supply Chain Security, supply chain attacksGitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads ...
Why Nano Updates Only Work if You Begin with the Latest and Greatest Software
Dustin Kirkland | | automated updates, CI/CD, container updates, continuous delivery, continuous improvement, CVE reduction, Dependency Management, devsecops, engineering and security collaboration, legacy modernization, Linux base images, modern software stacks, nano updates, secure development practices, security patching, software hygiene, software maintenance, software updates, technical debt, vulnerability managementIs there a silent threat of technical debt looming in your organization? You probably should take a deeper look. Modern software systems are composed of hundreds of interdependent components. How are you ...
