InfoWorld

Java services are the most-impacted by third-party vulnerabilities, according to the “State of DevSecOps 2024” report just released by cloud security provider Datadog.

Released on April 17, the report found that 90% of Java services were susceptible to one or more critical or high-severity vulnerabilities introduced by a third-party library. The average for other languages was 47%.

Datadog’s report analyzed tens of thousands of applications and container images and thousands of cloud environments to assess application security. Following Java in the vulnerabilities assessment were JavaScript, at roughly 70%; Python, at 62%; .NET, at 50%; PHP, at 35%; and Go (golang) and Ruby, both at about 32%.

To read this article in full, please click here

As of the first quarter of 2024, 83% of developers were involved in devops-related activities such as performance monitoring, security testing, or CI/CD, according to the State of CI/CD Report 2024, published by the Continuous Delivery (CD) Foundation, a part of the Linux Foundation.

Released April 16, the State of CI/CD Report 2024 is downloadable from the CD Foundation, authored by developer researcher SlashData, and sponsored by CloudBees, provider of a DevSecOps platform.

To read this article in full, please click here

Modern software applications are underpinned by a large and growing web of APIs, microservices, and cloud services that must be highly available, fault tolerant, and secure. The underlying networking technology must support all of these requirements, of course, but also explosive growth.

Unfortunately, the previous generation of technologies are too expensive, brittle, and poorly integrated to adequately solve this challenge. Combined with non-optimal organizational practices, regulatory compliance requirements, and the need to deliver software faster, a new generation of technology is needed to address these API, networking, and security challenges.

To read this article in full, please click here

The Rust language team has published a point release of Rust to fix a critical vulnerability to the standard library that could benefit an attacker when using Windows.

Rust 1.77.2, published on April 9, includes a fix for CVE-2024-24576. Before this release, Rust’s standard library did not properly escape arguments when invoking batch files with the bat and cmd extensions on Windows using the Command API. An attacker who controlled arguments passed to a spawned process could execute arbitrary shell commands by bypassing the escape. This vulnerability becomes critical if batch files are invoked on Windows with untrusted arguments. No other platform or use was affected. Developers already using Rust can get Rust 1.77.2 using the command: rustup update stable.

To read this article in full, please click here

Synopsys has introduced Black Duck Supply Chain Edition, a software composition analysis (SCA) package that helps organizations mitigate upstream risk in software supply chains, including from AI code.

Announced April 9, Black Duck Supply Chain Edition is intended to address a rise in software supply chain attacks targeting vulnerable or maliciously altered open source and third-party components. Due April 25, the product combines open source detection technologies, automated third-party software bill of materials (SBOM) analysis, and malware detection to give a view of software risks inherited from open source, AI-generated code, and third-party code, Synopsys said. Security and development teams can track dependencies across the application life cycle to find and resolve security vulnerabilities, malicious packages, and license violations and conflicts, the company added.

To read this article in full, please click here

Synopsys has introduced Black Duck Supply Chain Edition, a software composition analysis (SCA) package that helps organizations mitigate upstream risk in software supply chains, including from AI code.

Announced April 9, Black Duck Supply Chain Edition is intended to address a rise in software supply chain attacks targeting vulnerable or maliciously altered open source and third-party components. Due April 25, the product combines open source detection technologies, automated third-party software bill of materials (SBOM) analysis, and malware detection to give a view of software risks inherited from open source, AI-generated code, and third-party code, Synopsys said. Security and development teams can track dependencies across the application life cycle to find and resolve security vulnerabilities, malicious packages, and license violations and conflicts, the company added.

To read this article in full, please click here

Synopsys has introduced Black Duck Supply Chain Edition, a software composition analysis (SCA) package that helps organizations mitigate upstream risk in software supply chains, including from AI code.

Announced April 9, Black Duck Supply Chain Edition is intended to address a rise in software supply chain attacks targeting vulnerable or maliciously altered open source and third-party components. Due April 25, the product combines open source detection technologies, automated third-party software bill of materials (SBOM) analysis, and malware detection to give a view of software risks inherited from open source, AI-generated code, and third-party code, Synopsys said. Security and development teams can track dependencies across the application life cycle to find and resolve security vulnerabilities, malicious packages, and license violations and conflicts, the company added.

To read this article in full, please click here

Parasoft has launched a tool to enhance safety testing for C and C++ applications. The tool comes at a time when the two venerable programming languages have come under fire over safety concerns.

Announced April 8, the C/C++test CT (Continous Testing) tool is intended to empower large developer teams to build reliable and dependable embedded systems. It provides a comprehensive solution for large teams engaged in the development of safety-critical and security-critical C and C++ products, Parasoft said. C/C++test CT integrates with developers’ desktop environments such as Visual Studio Code, unit testing frameworks such as GoogleTest, Boost.Test, and CppUnit, and CI/CD workflows for continuous testing and efficiency, according to Parasoft.

To read this article in full, please click here

The Eclipse Foundation announced that it is partnering with the Apache Software Foundation and other open source foundations to establish common specifications for secure software development based on existing open source best practices.

In an April 2 blog post, Eclipse said that the goal of the initiative was to meet the challenges of cybersecurity in the open source ecosystem and demonstrate cooperation with the European Union’s Cyber Resilience Act (CRA). Participants include Apache, Eclipse, the Rust Foundation, the PHP Foundation, the Blender Foundation, the OpenSSL Software Foundation, and the Python Software Foundation.

To read this article in full, please click here

Over the past decade, Rust has emerged as a language of choice for people who want to write fast, machine-native software that also has strong guarantees for memory safety.

Other languages, like C, may run fast and close to the metal, but they lack the language features to ensure program memory is allocated and disposed of properly. As noted recently by the White House Office of the National Cyber Director, these shortcomings enable software insecurities and exploits with costly real-world consequences. Languages like Rust, which put memory safety first, are getting more attention.

To read this article in full, please click here

2023 has been a breakout year for developers and generative AI. GitHub Copilot graduated from its technical preview stage in June 2022, and OpenAI released ChatGPT in November 2022. Just 18 months later, according to a survey by Sourcegraph, 95% of developers report they use generative AI to assist them in writing code. Generative AI can help developers write more code in a shorter space of time, but we need to consider how much of a good thing that may be.

To read this article in full, please click here

The key benefits of platform engineering are increased developer productivity, better quality of software, reduced lead time for deployment, and more stable applications, according to Puppet by Perforce’s 2024 State of Devops Report: The Evolution of Platform Engineering.

The report is based on a survey of 474 participants who work with a platform engineering team at their organizations. The survey was conducted in the summer of 2023.

Other benefits cited include cost savings, reduced time for product development, reduced errors, and reduced risk of security breaches. “Security has never just been IT’s job,” said Kapil Tandon, Puppet by Perforce vice president of product management, in the executive summary. “With secure tools built into most platforms, platform engineering is empowering more people than ever to take responsibility for security.”

To read this article in full, please click here

The benefits of developing software in the cloud include increased flexibility and reliability, greater efficiency, and reduced costs. But cloud-based development also presents a host of challenges. Knowing what to watch out for is the first step to protecting your applications and development efforts. Here, are 10 pitfalls to consider before developing, testing, or deploying applications in the cloud.

10 reasons to think twice before developing in the cloud

1. Performance and latency issues
2. Cybersecurity and data protection threats
3. Vendor lock-in
4. Runaway costs
5. Regulatory compliance requirements
6. Compatibility and integration issues
7. Scalability demands
8. Distributed collaboration and communication
9. Testing and deployment hurdles
10. Developing for a global market

Performance and latency issues

While cloud services are generally reliable in terms of availability and performance, service outages or performance issues can impact development efforts.

To read this article in full, please click here

Java Development Kit (JDK) 22, released by Oracle March 19 as the latest version of standard Java, offers a number of security enhancements, covering areas ranging from an asymmetric key interface to a new security option for -XshowSettings that allows developers to easily display security-related settings.

In a March 20 blog post on Oracle’s inside.java web page, Sean Mullan, technical lead of the Java Security libraries team and lead of the OpenJDK Security Group, detailed the security enhancements in JDK 22.

To read this article in full, please click here