This week, my colleague Stephanie and I had the opportunity to interview Zhuojie Zhou (Rex) on the Future of Open Source Software Security. Rex is the co-founder of Magic Den and was one of the founding engineers of the experimentation platform at Uber. More: - Rex also worked on Facebook AI's PyTorch project. He helped build the CI/CD pipeline for the open-source infrastructure for testing and releasing PyTorch.
- He believes developers should come forward and contribute to open-source for better knowledge sharing and code composability.
- As an open-source project maintainer, he feels that creating good documentation is one of the biggest challenges for maintainers.
- According to him, improving the quality of npm through a regular audit and new features like dependabot in code repositories can prevent the next Log4Shell.
- Magic Eden is an NFT marketplace built on Solana. Earlier this week, it raised a $130M Series B round to expand beyond the Solana ecosystem.
| |
Amazon launched CodeWhisperer, its ML-powered coding companion, into preview at the re:Mars Conference. It is interesting to note GitHub announced the general availability of CoPilot, a similar service, earlier this week. More: - CodeWhisperer generates syntactically correct recommendations based on comments in natural language and code in the IDE.
- It uses contextual clues such as cursor location in the source code, code that precedes the cursor, code in other files of the same project, and comments to provide recommendations.
- CodeWhisperer can scan the source code file and inform developers of any security vulnerabilities in the generated or changed code.
- CodeWhisperer supports multiple IDEs and languages, including Python, Java, JavaScript, Visual Studio Code, IntelliJ IDEA, PyCharm, WebStorm, and Amazon's Cloud 9.
- Amazon claims it trained CodeWhisperer on billions of lines of code from open-source repositories, internal Amazon repositories, API documentation, and forums.
| |
 A message from INCOGNIA Location is the strongest trust signal to prevent fraud on mobile. How to get high opt-in rates? Location behavior is emerging as the strongest trust signal in mobile. When trusted users share their location with mobile apps supporting Incognia, fraud can be reduced by 90% and the user can experience zero friction. But what is the secret to achieving high opt-in rates for location permissions from mobile users? Join this webinar and learn: - What is the best timing for asking for location opt-in
- What is the messaging that will increase opt-in rates
- How to make users comprehend that sharing location is their best option for fraud prevention
Register now
| |
Google Chrome announced the beta of version 104 along with other updates this week. Google released a security update from Chome 103 that fixes 14 security issues, including a critical and two high-severity bugs. More: - Google announced the beta of Chrome 104 with Region Capture, which allows web apps to crop a track and remove content from it before sharing it remotely, Media Queries Level 4 specification, and focus group, out-out of credit card storage, shared element transition in origin trails.
- Deprecations and removals in the beta version include blocking iframes navigation to filesystems URL and removal of non-standard client hint mode and U2F API.
- Chrome rolled out Actions, enhanced safe browsing, and improved the built-in translation feature for its iOS app.
- iPhone users can also use Chrome to enter their save passwords across any app on iOS automatically.
| |
Software consulting company, Scott Logic released The State of WebAssembly 2022 survey results. The results were announced after surveying 299 application developers. More: - To the question which languages they use for WebAssembly development, 45% of developers responded they use Rust frequently or sometimes.
- JavaScript, which was not even an option in last year's survey, came in at a close second after Rust.
- Frequent usage of WebAssebly increased from 47% last year to 67% this year.
- Compared with last year's numbers in terms of usage, Blazor and Python have seen the steepest growth, and AssemblyScript saw the biggest decline.
- Developers are using WebAssembly for web development, serverless applications, containerization, and as a plug-in environment.
| |
 A message from SECURITY COMPASS Current approaches to Threat Modeling simply don’t work. - They are manual and inconsistent
- They take too long
- They don’t scale
- They don’t give developers what they need
Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure software. Learn more about current threat modeling challenges. See how a new, developer-centric approach to threat modeling can help your organization deliver secure software faster. Read Series on Threat Modeling And, yes, we understand that threat modeling is a time-consuming process that requires the expertise of security professionals and figuring out the best approach to mature application security programs can be difficult, especially with increasing internal demands for a faster time to market. According to this Total Economic Impact™study, SD Elements enabled its users to decrease the time needed to develop security requirements for products by 90%. See How
| |
Platform.sh, a platform for building, running, and scaling applications, raised a $140M Series D round. The funding round was co-led by Digital Partners, Morgan Stanley Expansion Capital, and Revaia, with participation from BGV, Eurazeo, Hiinov, and Partech. More: - Platform.sh offers an end-to-end solution for building, hosting, scaling, and managing a number of websites and web apps in different languages and frameworks.
- It provides developers with a dashboard to manage databases and workflows and create production replicas.
- Its customers include Adobe, Nestle, the Financial Times, and the U.S Chamber of Commerce, and it claims its ARR is around $40M.
- The fresh capital will be used to expand its position in Europe, Asia, and the US and to recruit new employees.
| |
New Tools and Updates: - Apple released the second beta of iOS and iPad 16. The beta version introduces new features such as RoomPlan - a new Swift API powered by ARKit that enables the 3D parametric model creation of an interior room, support for dynamic properties like @Environment in custom types confirming to Toolbar Content, etc.
- React announced the release of React Native 0.69.0 with improvements for the new architecture of React Native and new features such as React 18 support and bundled Hermes.
- GitHub released new functionalities for organizations to manage and scale with Codespaces. GitHub now allows admins set an organization-level maximum retention period and added support for organization-level REST API and CLI commands, currently in public beta.
- AWS announced that its App2Container, which it launched two years ago, now supports Azure DevOps for setting up a CI/CD pipeline to automate building and deploying container applications on AWS.
| |
Quick Hits: - During uncertain times, customer-centric businesses stay afloat. Find out why in this deep dive.*
- Researchers at Google's Threat Analysis Group detected that Milan-based RCS Labs used a combination of tactics to spy on Android and Apple phone users in Italy and Kazakhstan. TAG is actively tracking more than 30 vendors selling exploits or surveillance capabilities to government-backed actors.
- Microsoft rolled out new features to Edge that enables users to discover, learn, watch, and play games directly on its desktop version. Edge gets a new gaming homepage, Clarity Boost for enhancing console games with Xbox Cloud Gaming, one-click access to free games, and a new performance-boosting setting in efficiency mode.
- Brave Search is exiting its beta phase one year after it was launched. The privacy-focused search engine has surpassed 2.5B queries and saw a 5,000% growth in a year.
- Concerned about your SME’s security? Discover what a Zero Trust strategy entails — and how to use it to your advantage.*
*This is a sponsored post.
| |
Upcoming Events: - June 30 - HR Strategies to Retain Remote Employees (Register Here)
- July 20 - The Rise of Metaverse Gaming (Register Here)
- July 27 - Need To Know NoCoder - Yassine Tahi (Kinetix) (Register Here)
- August 17 - Build Your Diversified Portfolio: How To Invest in Bear Markets (Register Here)
- September 14 - Are Electric Cars Worth It? (Register Here)
DID YOU KNOW WE'RE HIRING? - We have multiple positions open for 100% remote, full-time analysts. Apply or refer someone.
| |
 |  | Sudarshan lives in Toronto, Canada, and is an engineering graduate. He is passionate about business, tech, entrepreneurship, and politics. FUN FACT: Sudarshan worked for the election campaign teams of two heads of state in India. When he is not busy with work, he enjoys hiking, playing cricket, and cooking. | | | | Editor | Gregory Bridgman is a writer and researcher with an academic background in politics and the philosophy of science and technology. He holds a BA from the University of Cape Town, an MS from University College London, and is currently completing a PhD at the University of Cambridge. He is interested in climate issues, technological changes, and the implications of the fourth industrial revolution. | |
Incognia is a privacy-first location identity company that provides frictionless mobile authentication for reduced fraud. | |
Security Compass is on a mission to accelerate software time-to-market while managing risk. | |
Comments
Post a Comment