As developers we all have our morning startup routine: make coffee, check slack/discord/email, read the latest news. One thing I do as part of my daily startup routine is check the Snyk vulnerability database for the latest open source vulnerabilities. It’s been especially interesting to see the types of exploits and vulnerabilities that appear in different ecosystems. For example, since May 2021 I’ve been watching the emergence of vulnerabilities in Tensorflow libraries.

Authentication, authorization, and accounting, often called AAA or Triple-A, are sets of services and protocols that enable granular access control over computer networks. Before the popularity of mainstream HTTP-based authentication protocols such as OAuth and SAML, AAA protocols were the primary way to authenticate users or machines to network services.

Though Kubernetes has grown in popularity, it still has a steep learning curve that can make it hard to adopt the technology. Those who can’t get past this initial hurdle are often left behind in the fast-paced field of software development. This article will introduce YAML files for Kubernetes object configuration. YAML provides a way to declaratively configure your Kubernetes applications, and these declarative files allow you to effectively scale and manage your applications.

As part of our ongoing efforts to offer you the most comprehensive and advanced SDLC protection capabilities, JFrog continues to boost the capabilities of our Xray security and compliance product. In this blog, we offer an overview of recent Xray improvements, all aimed at helping you fortify your software, reduce risk, scale security, streamline compliance and accelerate releases with confidence.

More than 90% of applications will be cloud-native by 2023. As organizations transition from monolithic, on-premise environments to dynamic cloud-based ones, ensuring access control becomes more critical — and complex. That’s why I co-created Open Policy Agent, also known as OPA. OPA unifies policy enforcement across the cloud-native stack.

Today, we announced our entrance into the Static Application Security Testing (SAST) market. It’s a significant development for WhiteSource, which has until now been solely focused on open source software security. In this post, I explain why we decided to make this move beyond open source into proprietary code security, and the value it will bring to developers, security teams, and their organizations.

We’re excited to announce that our Snyk Business plan will now be available as a free trial. Many developers love Snyk products, but the true power of our platform is displayed when it’s used across an organization. No company wants to navigate a security incident, but ensuring that your entire SDLC is protected can be a challenge. The Snyk Business plan gives your organization access to empowering and easy-to-use tools to ensure nothing slips through the cracks.

Kubernetes is an API-centric orchestration platform. Every request, from the cluster components to users interacting with the system, has to go through the API server. The API server is a component in the control plane, and acts as a gatekeeper for the operation requests originating from both inside and outside of the cluster.

Being a sysadmin is definitely not for the average human being. You have to always be ready to help people, fight hackers, use tech gadgets … actually, a sysadmin’s typical day sounds a lot like the life of a superhero! But even superheroes have a dark side. We asked our sysadmin community to share some naughty things they’ve ever done — or keep doing. Naturally, their responses will remain anonymous due to the delicacy of the topic!

JFrog’s Security Research team recently disclosed an RCE (remote code execution) issue in Apache Cassandra, which has been assigned to CVE-2021-44521 (CVSS 8.4). This Apache security vulnerability is easy to exploit and has the potential to wreak havoc on systems, but luckily only manifests in non-default configurations of Cassandra.