| |
| Here's a look at today's Dev briefing. - CrowdStrike survey revealed just 54% of major code changes undergo security scrutiny.
- Snyk highlighted GitHub Copilot's ability to amplify security issues in a codebase.
- Microsoft unveiled a new toolkit to find risks in a developer's generative AI systems.
Thank you. Sudarshan
p/sudarshan | |
| 1 | | A recent CrowdStrike survey revealed that just 54% of all major code changes undergo complete security scrutiny before deployment. CrowdStrike surveyed 400 security professionals from various industries in July 2023 to prepare the CrowdStrike 2024 State of Application Security report. More: - About one-third (34%) of organizations review around 75% of code changes, while 44% review less than half of the code changes.
- 71% of the organizations release updates at least once a week. Teams are using documentation (74%) and spreadsheets (68%) to catalog and inventory their applications and APIs.
- Respondents pointed to security reviews taking more than one business day (81%) as the primary factor for not reviewing more of their code changes.
- Nearly 90% of the teams are using multiple tools to detect and prioritize vulnerabilities and threats, increasing complexity and cost.
|     | |
| 2 | | Frustration among developers continues as Visual Studio's extensibility model remains in preview even after its launch in September 2021. Visual Studio 2022 17.9, released last week, added new features, such as a custom data visualizer for debugging, Language Server Protocol (LSP) support for Rust, etc., to the preview of Visual Studio Extensibility. More: - Microsoft has still not clarified when the new extensibility model will exit the preview phase as developers grapple with challenges related to APIs in the old Visual Studio SDK.
- Last December, a developer determined that none of the existing extensions in Visual Studio could be rewritten to incorporate the new APIs after conducting a thorough review.
- Principal software engineer at Microsoft, Bertan Aygun, responded that the development of a new SDK incorporates all existing extensibility areas of Visual Studio, requiring APIs that are user-friendly and support various execution modes.
- He added that Microsoft plans to categorize APIs between stable and preview states after the release of a broader preview version of VisualStudio.Extensibility.
| | | |
| |
|
| 3 | | In a recent blog post, Snyk said Github Copilot may suggest insecure code that amplifies an existing codebase's vulnerabilities. It also added that the AI code generation tool is less likely to suggest insecure code in projects without security issues. More: - According to Snyk, the average commercial software project has around 40 vulnerabilities in first-party code, of which 33% are high-severity issues. AI tools generate code using these vulnerabilities as contextual cues.
- Using Copilot in codebases containing security vulnerabilities could reinforce poor coding practices and allow potentially insecure code to be implemented without a thorough review.
- To mitigate security issues in code generated by AI assistants, Snyk recommended developers conduct manual code reviews and adhere to secure coding guidelines.
- Additionally, it advised security teams to put SAST guardrails in place, provide development teams with the necessary training and awareness, and help prioritize and triage the backlog of issues per development team.
| | | |
| 4 | | Microsoft introduced the Python Risk Identification Toolkit for generative AI (PyRIT) to empower developers to find risks in their generative AI systems. Microsoft's AI Red Team, established in 2018, created the tool to mimic real-world adversaries and their strategies to identify vulnerabilities, mitigate risks, and enhance overall system security. More: - PyRIT incorporates abstraction and extensibility through five interfaces: target, datasets, scoring engine, the ability to support multiple attack strategies, and memory management.
- The tool can automatically generate thousands of adversarial AI prompts to assess a neural network's resilience against hacking attempts.
- According to Microsoft's Red Team, the toolkit addresses the limitations of manual probing and existing automation tools. It helps tackle the unique challenges of red teaming in the generative AI paradigm.
- The release contains demos, including common scenarios notebooks, to help developers get started with the tool.
| | | |
| |
|
| 5 | | New Tools and Updates: - Android launched the ML Kit Document Scanner API, which simplifies adding advanced document scanning capabilities for quickly and easily digitizing paper documents.
- Microsoft unveiled the TypeScript 5.4 release candidate, adding restrictions around enum compatibility and member naming and improvements in mapped type behavior since the beta release.
- Git announced the availability of Git 2.44 with support for reusing objects across multiple packs, faster rebases with git replay, a new pathspec attribute, and more.
- Predibase introduced LoRA Land, a collection of 25 open-source language models for use cases such as text summarization, code generation, etc., to enable enterprises to train generative AI applications.
- Jet Admin, an app builder for building client portals, custom CRMs, internal tools, and admin panels, launched recently on ProductHunt.
| | | |
| 6 | | 📚 Tutorials: - This article demonstrates how to set up a Node server with TypeScript in 2024.
- JetBrains published best practices, tips, and tricks for software development using Java.
- Learn how to design APIs with typed throws in Swift.
- Here is a complete guide to Compose Navigation with Nested, Multiple Backstack & Dialog Navigation.
| | | |
| 7 | | Quick Hits: - Discover the trends shaping 2024 and learn how trust will be the key to business success. Shape your strategy and get ahead with this latest report.*
- In a recent blog post, GitHub explained how AI code generation works and showcased how its functions and capabilities work, enhancing the development experience.
- Swift announced it is joining Google Summer of Code 2024 and invited developers to write an official proposal and submit it to the GSoC website.
- JetBrains received its Service Organization Control 2 (SOC II) report developed by the American Institute of CPAs (AICPA).
- Visa and Mastercard have come to a historic $5B settlement, marking a pivotal moment for small business owners. If your business accepts Visa/MC, claim your share today.*
*This is a sponsored listing. | | | |
| Upcoming Events | | MAR
7 | | Portfolio Diversification - Learn from knowledgable experts on the latest trends in alternative investment assets like private equity, crypto, real estate, and the art market. | | | | | | * This is a sponsored event | | | |
 | Analyst | | Sudarshan lives in Toronto, Canada, and is an engineering graduate. He is passionate about business, tech, entrepreneurship, and politics. FUN FACT: Sudarshan worked for the election campaign teams of two heads of state in India. When he is not busy with work, he enjoys hiking, playing cricket, and cooking. | | This newsletter was edited by Aaron Crutchfield | |
| |
| |
|
| |
Comments
Post a Comment