Dependabot now supports security updates for Dart and Flutter apps that use Pub packages github.blog/changelog/2022…

These numbers are scary! (On the other hand: I will always have a job!). Culture a Stumbling Block to DevOps, DevSecOps devops-com.cdn.ampproject.org/c/s/devops.com…

.NET 7 Networking Improvements devblogs.microsoft.com/dotnet/dotnet-…

New blogpost! Adding the OSSF scorecard action to your repository: devopsjournal.io/blog/2022/12/0… This can help you improve the security in your repository, with actionable alerts (and super easy fixes for some!).

So... I have enabled actionlint on 3 repos today, and fixed 2 workflows that had vulnerabilities or errors in them. And I am educating people on using GitHub Actions in a safe way for a couple of years now! ActionLint: github.com/rhysd/actionli… #BeSaferPeople #DevOps #GitHub

Finding the next Log4j – OpenSSF’s Brian Behlendorf on pivoting to a ‘risk-centred view’ of open source development. portswigger.net/daily-swig/fin…

My top blogposts created in 2022: Number 7: Configuration as Code for the GitHub platform. There are lots of posts talking about this, but few with an actual implementation. I create one for inviting users and creating repos for them. Read it here: devopsjournal.io/blog/2022/03/1…

My top blogposts created in 2022: Number 6: devopsjournal.io/blog/2022/06/0… My take on how I create a GitHub Action and where I start.

My top blogposts created in 2022: Number 5 devopsjournal.io/blog/2022/01/1… About detecting usage of the camera in Windows and triggering my Home Automation setup for that!

My top blogposts created in 2022: Number 4 devopsjournal.io/blog/2022/09/1… About scanning the entire! GitHub Actions Marketplace for security issues in their dependencies!

My top blogposts created in 2022: Number 3 devopsjournal.io/blog/2022/03/1… About a much asked for approach to cleanup the notifications on GitHub

My top blogposts created in 2022: Number 2 devopsjournal.io/blog/2022/08/1… Only created in August, but now my best viewed post on a monthly basis! Six reasons of why you workflow did not start and how to check them!

My best viewed blogposts created in 2022: Number 1 devopsjournal.io/blog/2022/01/0… Explaining the different types of GitHub Access Tokens you can use to get access to GitHub

10 software supply chain attacks you can learn from reversinglabs.com/blog/10-supply…

Devs urged to rotate secrets after CircleCI suffers security breach | The Daily Swig portswigger.net/daily-swig/dev…

I scanned every package on PyPi and found 57 live AWS keys tomforb.es/i-scanned-ever…

The GitHub Silverware Drawer Dilemma, Or: Finding Active Repository Forks | Hackaday hackaday.com/2023/01/08/the…

Interesting read! medium.com/bondora-engine…

Very insightful post on attacking Source Control Management systems (SCM)! medium.com/boostsecurity/…