Developers just want to know if they have a vulnerability before putting code into production. But often, the answer back is not what the developer wants to hear.

More analysis is needed, the software security group will often reply, said Meera Rao, senior director of product management at Synopsys, in this latest episode of The New Stack Makers, hosted by Alex Williams, founder and publisher of The New Stack, 

Rao is the creator of a new intelligent orchestration technology that helps developers get their issues resolved without a long wait. That long wait is remedied by relying on Synopsys’ system to let developers know what’s wrong and whether specific security holes require immediate fixing or not.

Developers Just Want To Know if They Have a Problem

As GitOps moves beyond improving how code repositories are managed for continuous integration/continuous integration (CI/CD), the security component of GitOps has become more of a pressing issue as the use of Git, and GitOps, becomes more widely adopted. The open source community should also play a critical role in improving GitOps.

Hosted by Alex Williams, founder and publisher of The New Stack, this recording features Om Moolchandani, co-founder and CISO/CTO, for Accurics, Cindy Blake, senior security evangelist, GitLab, Frank Kim, fellow, SANS Institute; Sanjeev Sharma, head of platform engineering, Truist Financial and Katie Gamanji, ecosystem advocate, Cloud Native Computing Foundation (CNCF).

GitOps Modern Practices for Reaching a Desired State and Decreasing Exposure

A major part of improving developer velocity is about getting the most out of an observability platform. While that is a commonly held assumption, this best practice is also a far-reaching goal for many DevOps teams.

Hosted by Alex Williams, founder and publisher of The New Stack, this The New Stack Makers — podcast recorded during a virtual pancake breakfast — features a discussion on improving observability for developers. The featured guests were Zain Asgar, general manager, Pixie and New Relic open source and CEO and co-founder of Pixie Labs, Roopak Venkatakrishnan, engineering manager, Bolt (an e-commerce retailer tool), Ihor Dvoretskyi, developer advocate, Cloud Native Computing Foundation (CNCF) and Christine Wang, senior solutions engineer, Grafana Labs.

How to Improve Kubernetes Observability for Developer Velocity

Prisma Cloud from Palo Alto Networks sponsored this podcast.

Identity and access management (IAM) was previously relatively straightforward. Often delegated as a low-level management task to the local area network (LAN) or wide area network (WAN) admin, the process of setting permissions for tiered data access was definitely not one of the more challenging security-related duties. However, in today’s highly distributed and relatively complex computing environments, network and associated IAM are exponentially more complex. As application creation and deployment become more distributed, often among multicloud containerized environments, the resulting dependencies, as well as vulnerabilities, continue to proliferate as well, thus widening the scope of potential attack surfaces.

How to manage IAM in this context was the main topic of this episode of The New Stack Analysts podcast, as KubeCon + CloudNativeCon attendees joined TNS Founder and Publisher Alex Williams and guests live for the latest “Virtual Pancake & Podcast.” They discussed why IAM has become even more difficult to manage than in the past and offered their perspectives about potential solutions. They also showed how enjoying pancakes — or other variations of breakfast — can make IAM challenges more manageable.

The event featured Lin Sun, senior technical staff member and Master Inventor, Istio/IBM; Joab Jackson, managing editor, The New Stack and Nathaniel “Q” Quist, senior threat researcher (Public Cloud Security – Unit 42), Palo Alto Networks. Jackson noted how the evolution of IAM has not been conducive to handling the needs of present-day distributed computing. Previously, it was “not exactly a security thing” nor a “developer problem,” and wasn’t even “a security problem, he said.

“[IAM] really almost was a network problem: if a certain individual or a certain process wants to access another process or a resource online, then you have to have the permissions in place to meet all the policy requirements about who can ask for these particular resources,” Jackson said. “And this is an entirely new problem with distributed computing on a massive and widespread scale…it’s almost a mindset, number one, about who can figure out what to do and then how to go about doing it.”

Why IAM is a Pain Point in Kubernetes

On the last The New Stack Analysts of the year, the gang got together — remotely, obviously — to reflect on this year. And oh what a year! But for a year in tech, 2020 still had a lot of hits — and some misses.

Publisher Alex Williams was joined by Libby Clark, Joab Jackson, Bruce Gain, Steven Vaughan-Nichols, and Jennifer Riggins. We looked back on the year that saw millions die, no one fly, and a lot of jobs in turmoil. It was also a year that, while many things screeched to a halt, much of the tech industry had to keep going more than ever.

Is Hindsight Still Really 2020? 366 Days in Tech in Review

Is Hindsight Still 2020? Reviewing the Year in Tech

In this episode of The New Stack Analysts podcast, TNS founder and publisher Alex Williams virtually shared pancakes and syrup with guests to discuss how Apache Cassandra, gRPC and, other tools and platforms play a role in managing data on Kubernetes.

Mya Pitzeruse, software engineer and OSS contributor from effx; Sam Ramji, chief strategy officer at Datastax; and Tom Offermann, a lead software engineer at New Relic were the guests. They offered deep perspectives about the evolution of data management on Kubernetes and the work that remains to be done.

What is Data Management in the Kubernetes Age?

In this edition of The New Stack Analysts podcast, host Alex Williams, founder and publisher of The New Stack and co-host Cheryl Hung, vice president of ecosystem at CNCF Cloud Native Computing Foundation (CNCF), discuss why secrets management is essential for DevOps teams, what the tool landscape is like and why Vault was selected as the top alternative. CNCF Tech Radar contributors and featured guests were Steve Nolen, site reliability engineer, RStudio — which creates open source software for data science, scientific research and technical communication — and Andrea Galbusera, engineering and co-founder, AuthKeys, a SaaS platform provider for managing and auditing servers authorizations and logins.

HashiCorp Vault Gets Top Honors in Latest CNCF Tech Radar

The New Stack Makers is all about the developers, software engineers and operations people who build at-scale architectures that change the way we develop and deploy software.

For The New Stack Analysts podcast, please see https://soundcloud.com/thenewstackanalysts

For The New Stack @ Scale podcast, please see https://soundcloud.com/thenewstackatscale

For The New Stack Context podcast, please see https://soundcloud.com/thenewstackcontext

Subcribe to TNS on YouTube at: https://www.youtube.com/c/TheNewStack

Alex Williams, founder of The New Stack, hosts "The New Stack Analysts," a biweekly round-table discussion covering The New Stack's latest data research, and topics related to app development and back-end services.

Listen to our other TNS Podcasts on SoundCloud:

The New Stack Makers: https://soundcloud.com/thenewstackmakers 

The New Stack Context: https://soundcloud.com/thenewstackcontext

The New Stack @ Scale: https://soundcloud.com/thenewstackatscale

New tracks tagged #thenewstack