Julien Richard

🚨Medium Risk Vulnerability🚨 in #Sylius, an Open Source eCommerce Framework on Symfony. A security vulnerability (CVE-2024-40633) allows an attacker to access sensitive guest customer information via the adjustments API endpoint. This highlights the importance of #APISecurity. Users are advised to upgrade to versions 1.12.19, 1.13.4 and above. #OWASP #InfoSec #CyberSecurity https://lnkd.in/ei_W9nMT

1

New Update! Lumos API by DQMH Consortium - Bug fix: Prepare Project - Error 1063 when scripting Request and Wait for Reply Kudos to contributor Olivier Jourdan Check it out:https://lnkd.in/gB8SYE3K

4

https://caxus.net/ 🚀Terraform and GitLab CI Pipelines: The Ultimate Solution for Infrastructure Management 🚀 1. Total Automation 🤖: With Terraform, you can define your infrastructure as code. This means you can create and manage all your cloud resources automatically and repeatably. 2. Seamless Integration ➡️: Thanks to GitLab CI/CD, every change you make in your code can be automatically reflected in your infrastructure. No more manual deployments prone to errors. 3. Security and Transparency 🔒: All changes in your infrastructure are recorded in your Git repository. This allows for total control and a transparent history of all modifications. 4. Continuous Development 🔄: With GitLab CI Pipelines, you can create pipelines that automatically validate, test, and deploy your Terraform configurations. It has never been easier to ensure that everything works as it should! 5. Guaranteed Scalability 📈: By using these tools, you can quickly scale your infrastructure to deal with traffic spikes or new features. 6. Cost Reduction 💸: By automating infrastructure management, you reduce human errors and optimize resource usage, resulting in lower operating costs. 7. Team Efficiency 🛠️: These tools allow your development and operations teams to work together efficiently, minimizing wait times and improving collaboration. 8. Flexibility and Adaptability 🧩: Adjust and evolve your infrastructure according to business needs without complications, all while using market best practices. 9. Recommended Tools 🛠️: Some tools that can help improve productivity are: VSCode for code editing, Terraform Cloud for remote state management, and Slack for quick and effective communication. At Caxus, we are experts in adopting AWS cloud solutions 🌩️. If you want to optimize your infrastructure using Terraform and GitLab CI Pipelines, contact us and let's take your business to the next level. Contact us by Whatsapp: https://buff.ly/4aSbAWy Contact us today for more information! [email protected] We’d love to discuss how we can save you proyect in the cloud. [email protected] #devops #GitLabCI #aws #automation #terraform #gitlabci #pipelines #caxus #gitlab #DominaTuIndustria #Collaboration #Efficiency #CloudAdoption #Seguridad #Optimizacion #LinkedIn #HerramientasDigitales #AprendizajeContinuo #work #growing #teamwork #creatividad #DevSecOps #machinelearning #security #devsecops #cloud #infrastructure #DataAnalytics #AgileInfrastructure #CloudAdoption #Caxus

2

Join our webinar to learn how DevOps teams can master code signing to enhance their agile software delivery practices. Our webinar replay will discuss the significance of code signing in DevOps workflows and provide practical guidance on integrating it seamlessly into your continuous integration and delivery (CI/CD) pipelines. https://lnkd.in/g9ApMGNB #EncryptionConsulting #Cybersecurity #CodeSigning #CodeSign #SoftwareSecurity #DataProtection #EnterpriseSecurity #SecureCoding #CICD #CICDPipeline #HSM #SoftwareSupplyChain

1

Did your authentication secrets leak from the public cloud ? Knowing what you have is key, when comes the time to assess the impact of such cloud issue. "Bitbucket artifact files can leak plaintext authentication secrets" From the article : ➡ Bitbucket was not designed to manage secrets, suggesting that a dedicated, specialized product is used for that purpose instead. ➡ Developers are also recommended to carefully review artifacts to ensure no plain text secrets are contained inside the generated files. and more good info in the linked article #cybersecurity #leakdetection #governance #dataclassification #cloud https://lnkd.in/ePVJnzTX

5

Secure Coding in Infrastructure as Code (IaC) 🛡️💻 As IaC becomes the backbone of modern cloud infrastructure, securing it is crucial. Follow these practices for safer code: Validate Inputs 📝: Ensure proper validation to avoid exploits. Least Privilege 🔒: Limit access to only what’s necessary. Secrets Management 🔑: Never hardcode secrets; use secure vaults. Automate Security 🧪: Run security scans in your CI/CD pipeline. Version Control 🔄: Track changes and conduct code reviews. Avoid Defaults ⚙️: Customize security settings to your needs. By adopting these secure coding habits, you’ll build resilient, secure infrastructure that can withstand threats. Stay safe! 👩‍💻👨‍💻 #cybersecurity #iac #digitalsecurity

3

1 commentaire

Secure Coding in Infrastructure as Code (IaC) 🛡️💻 As IaC becomes the backbone of modern cloud infrastructure, securing it is crucial. Follow these practices for safer code: Validate Inputs 📝: Ensure proper validation to avoid exploits. Least Privilege 🔒: Limit access to only what’s necessary. Secrets Management 🔑: Never hardcode secrets; use secure vaults. Automate Security 🧪: Run security scans in your CI/CD pipeline. Version Control 🔄: Track changes and conduct code reviews. Avoid Defaults ⚙️: Customize security settings to your needs. By adopting these secure coding habits, you’ll build resilient, secure infrastructure that can withstand threats. Stay safe! 👩‍💻👨‍💻 #cybersecurity #security #digitalsecurity #IAC #ethicalhacking

2

1 commentaire

Figuring out what you have should be the initial step toward a successful API security program. However, with the growing proliferation of APIs, it might be challenging. Last week, we hosted Antoine Carossio, Bill Doerrfeld ,and Erik Wilde for a fireside chat on API sprawl. Together, we explored the key factors contributing to API sprawl, examined its causes, and discussed its implications. If you're trying to wrap your head around how to manage all the APIs within your organization, this conversation will definitely provide valuable insights 😉 Watch it here 👇

10

Are you facing high #costs and limited support for your cloud computing needs? 💡 You’re not alone! Just like HollaEx®, many companies struggle with maintaining their infrastructure without overspending. 🔑 With OVHcloud they were able to solve these major problems🚀 With affordable, privacy-focused Kubernetes services and tailored support, OVHcloud helped HollaEx streamline their operations across regions, boosting efficiency and peace of mind. 💻 If you ready to take your infrastructure to the next level join to learn how OVHcloud can be the solution for your business. RSVP for upcoming Knowledge Session to know more: https://lnkd.in/ersXPtn3 Check out the post below to learn about their journey with the OVHcloud Startup Program. #CloudComputing #Kubernetes #OVHcloud #Innovation #BusinessTransformation #TechSolutions #HollaEx #OVHcloudstartupprogram

17

Cloud costs and limited support slowing your growth? 💡 Discover how HollaEx® overcame these challenges with OVHcloud's privacy-focused Kubernetes services and expert support. 🚀 Join our upcoming Knowledge Session to learn how you can optimize your infrastructure and scale with OVHcloud. RSVP here: https://lnkd.in/gAe-CFPm 🙌 #OVHcloud #HollaEx #CloudSolutions #Kubernetes #StartupSupport

9

The three pillars are dead, long live OpenTelemetry’s 𝐬𝐢𝐠𝐧𝐚𝐥𝐬! In the OpenTelemetry terminology, different types of telemetry are known as 𝐬𝐢𝐠𝐧𝐚𝐥𝐬. OpenTelemetry provides support for the “classic” signals, namely metrics, logs, and traces (sometimes still referred to as “three pillars”, although that idiom is a remnant of the past, as we will cover in an upcoming “Observability and its history” series), but work is underway on other signals: profiling, real user monitoring, and events. 𝐌𝐞𝐭𝐫𝐢𝐜𝐬 are data collected over time and represent a measurement of a resource, i.e., 𝐭𝐢𝐦𝐞 𝐬𝐞𝐫𝐢𝐞𝐬. For example, the CPU utilization of a host, the count of Pods in a Kubernetes cluster, or the request count of a service can all be considered metrics. 𝐋𝐨𝐠𝐬 provide information about something happening at one point in time in a component. Logs are annotated with their 𝐬𝐞𝐯𝐞𝐫𝐢𝐭𝐲 to denote the offer of valuable insights at different levels of importance. Developers commonly use logs in production environments for debugging purposes. 𝐓𝐫𝐚𝐜𝐞𝐬 (or 𝐝𝐢𝐬𝐭𝐫𝐢𝐛𝐮𝐭𝐞𝐝 𝐭𝐫𝐚𝐜𝐢𝐧𝐠) involves capturing the path taken by a request within the various components of a (distributed) application, including timing information, errors encountered, and relevant attributes like HTTP status codes to analyze the performance and behavior of cloud-native applications. 𝐏𝐫𝐨𝐟𝐢𝐥𝐞𝐬, currently under early development in OpenTelemetry, measure the runtime behavior of an application by taking snapshots of the executed code at various points in time. This allows for identifying optimization opportunities in terms of CPU and memory consumption, as well as hot spots for execution time. #opentelemetry #opentelemetrynative

35

3 commentaires

𝐃𝐢𝐬𝐜𝐥𝐚𝐢𝐦𝐞𝐫: No Magic Recipe Here… Just really good insights you need to hear 👇 Have you checked out our latest episode of #CutTheOnion with Florian Pasquier, CTO at Carma? If not, you should! Today, CTOs are carrying around an increasingly complex toolbox - including DevOps, CloudOps, and SecOps (Security Operations). In this episode, Florian offers valuable insights into the challenges and opportunities that come with these evolving roles Florian shares why building strong engineering teams is the foundation for success in an ever-changing industry. While tech continues to advance rapidly, the basics—like creating stable, high-quality teams with empathy and storytelling—remain key to long-term success. Listen in or watch the episode 👇 ✔ Spotify: https://lnkd.in/gQUn7Zf5 ✔ Apple Podcasts: https://lnkd.in/g2PxChqy  ✔ Youtube: https://lnkd.in/e5vrjAHp #Podcast #CTOs #Insights #Leaders #SmartOSC

15

[Blog Post] DevOps Journey for Developers 🛠 Episode 02: Pulumi and Azure DevOps 💡   Continuing from our previous episode on the introduction of Pulumi, discover our guide and learn how to integrate Pulumi with Azure DevOps for seamless Infrastructure as Code (IaC) implementation.   Combined with Pulumi, Azure DevOps empowers developers to manage infrastructure using familiar programming languages like .NET, TypeScript, JavaScript, and Python.   This means: ✅ Less manual work ✅ More coding ✅ Well-organized, consistent, and scalable infrastructure   This hands-on approach will deepen your understanding of Pulumi and Azure DevOps, ensuring you're well-equipped to tackle any project with confidence. Read the full article here: 🔗 https://lnkd.in/dwF8EfSi   Find the previous episodes related to this series in the comments section.   Schedule a free session with a DevOps expert and discover your own possibilities 👉 https://lnkd.in/eSAFXW5R   #MDW #MDWDevelopers #InfrastructureAsCode #DevOps #Automation #Pulumi #CloudEngineering #CloudComputing #Azure

9

1 commentaire

Want to deploy a modern Cloud Development Environment in your OVHcloud project? 🌐 Check out this detailed OVHcloud blog on setting up Coder with Kubernetes, Helm, and PostgreSQL: http://cdr.co/4MzcwNA #CloudDevelopment #Kubernetes #DevOps #Coder -- Coder is a developer platform that combines control, efficiency, and productivity in one self-hosted solution. With Coder, you can safely accelerate your development process using the power of your own cloud, ensuring that your code and data remain secure. Embrace a faster and more efficient way to develop without the fear of losing your important assets. Learn more today: http://cdr.co/wMzMzNw

10

🌟 𝑷𝒍𝒂𝒕𝒇𝒐𝒓𝒎 𝑶𝒓𝒄𝒉𝒆𝒔𝒕𝒓𝒂𝒕𝒐𝒓: 𝑻𝒉𝒆 𝒑𝒍𝒂𝒕𝒇𝒐𝒓𝒎 𝒆𝒏𝒈𝒊𝒏𝒆𝒆𝒓𝒊𝒏𝒈 𝒈𝒂𝒎𝒆 𝒄𝒉𝒂𝒏𝒈𝒆𝒓 🌟 At PlatformCON 2024, Luca Galante talked about Platform Orchestrators. 𝐊𝐞𝐲 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬: 📌 Multicloud internal developer platforms are composed of multiple planes including developer control plane, integration delivery, monitoring and logging, security, and infrastructure. 📌 Many platform teams mistakenly start by building the front-end interface rather than focusing on the backend. This approach leads to ineffective platform designs that violate principles like the single responsibility principle and expose business logic unnecessarily. 𝐁𝐚𝐜𝐤𝐞𝐧𝐝 𝐅𝐨𝐜𝐮𝐬: The recommended approach is to start with the backend infrastructure. This is analogous to building a house by laying a solid foundation first, rather than starting with doors and windows. 𝐁𝐚𝐜𝐤𝐞𝐧𝐝 𝐃𝐞𝐬𝐢𝐠𝐧𝐬: 📌 𝐏𝐢𝐩𝐞𝐥𝐢𝐧𝐞-𝐁𝐚𝐬𝐞𝐝 𝐁𝐚𝐜𝐤𝐞𝐧𝐝𝐬: Traditional and familiar but limited in scalability and prone to complexity as logic and features are added. 📌 𝐆𝐫𝐚𝐩𝐡-𝐁𝐚𝐬𝐞𝐝 𝐁𝐚𝐜𝐤𝐞𝐧𝐝𝐬: Offer more scalability and manage complex logic better. They allow developers to request infrastructure in a simplified manner while the orchestrator handles complex configurations. 𝑨𝒅𝒗𝒂𝒏𝒕𝒂𝒈𝒆𝒔 𝒐𝒇 𝑮𝒓𝒂𝒑𝒉-𝒃𝒂𝒔𝒆𝒅 𝑩𝒂𝒄𝒌𝒆𝒏𝒅 𝑫𝒆𝒔𝒊𝒈𝒏: 📌 𝐀𝐛𝐬𝐭𝐫𝐚𝐜𝐭 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐫 𝐑𝐞𝐪𝐮𝐞𝐬𝐭𝐬: Developers can specify high-level requirements without detailed configurations. The platform orchestrator handles the complex logic and matches requests with predefined rules. 📌 𝐑𝐞𝐬𝐨𝐮𝐫𝐜𝐞 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: The orchestrator automates resource provisioning and environment progression, ensuring consistency and reducing manual intervention. 📌 𝐒𝐜𝐚𝐥𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐚𝐧𝐝 𝐌𝐚𝐢𝐧𝐭𝐞𝐧𝐚𝐧𝐜𝐞: The system scales well and simplifies updates across multiple deployments, allowing for easy rollouts and minimizing disruptions. #platformengineering #platformengineers #platformorchestrator

4

How does Escape's algorithm work? That's the question we often hear from security engineers. In his latest article, our CTO, Antoine Carossio, dives into the technical details behind Escape's Business Logic Security Testing algorithm. Read it if you want to learn: 👉 How the heart of Escape was inspired by the concept of Feedback-Driven Semantic API Exploration (FDSAE), a concept introduced by Marina Polishchuk, Researcher at Microsoft 👉 Why generating legitimate traffic on APIs is the real challenge 👉 How the algorithm works, including the explanation of the Metagraph 👉 How we tackle security problems Dive right in 👇

15

2 commentaires

Your mid-week contribution 🌟: Cloudquery👇 Led by Yevgeny Pats, CloudQuery is an open-source, high-performance data integration platform for security and infrastructure teams. Here’s why you should contribute to this repo: 1️⃣ Contributing to CloudQuery lets you leverage your Go programming, cloud infrastructure (AWS, GCP, Azure), and data integration skills. This experience will test your knowledge in building high-performance data processing applications, working with cloud APIs, and further your understanding of the nuances of ETL/ELT processes. With over 5,500 stars, this is your opportunity to jump on board this fast-growing repo! 🚀 2️⃣ There is a wide array of issues to pick from (176, to be precise!). If you enjoy working on this repo, there is much opportunity to come back and further contribute. ⚡️ 3️⃣ The repo welcomes new contributors. Many projects either fail to find or properly onboard new contributors. CloudQuery has, in the past month, onboarded 3 brand-new contributors to its repo. If you are looking for a welcoming and supportive repo, CloudQuery may be the project you are looking for! 🎉 If you want to contribute to more secure, efficient, and financially sound cloud operations, you can check more of cloudquery/cloudquery's open-source stats on Quira (https://lnkd.in/e8RAHJqS) or access the GitHub page https://lnkd.in/dfRXXqc.  📖

10