#open-source-supply-chain

[ follow ]
#open-source
Software development
fromZDNET
5 days ago

How AI has suddenly become much more useful to open-source developers

AI tools are becoming increasingly useful for open-source maintainers, but legal and quality issues remain.
Python
fromThe Hacker News
3 days ago

The State of Trusted Open Source Report

AI is reshaping software development and security, influencing container image usage and vulnerability management.
Software development
fromZDNET
5 days ago

How AI has suddenly become much more useful to open-source developers

AI tools are becoming increasingly useful for open-source maintainers, but legal and quality issues remain.
Software development
fromMedium
2 days ago

The Open-Source AI Agent Frameworks That Deserve More Stars on GitHub

Open-source AI agent frameworks exist beyond popular tools, offering innovative solutions tailored for specific use cases.
Information security
fromInfoQ
3 days ago

Open Source Security Tool Trivy Hit by Supply Chain Attack, Prompting Urgent Industry Response

A malicious release of the Trivy vulnerability scanner exposed critical weaknesses in software supply chain security, allowing for potential credential theft.
Cryptocurrency
fromnews.bitcoin.com
2 days ago

Linux Foundation and Coinbase Launch x402 Foundation for AI Agents

The Linux Foundation launched the x402 Foundation to establish an open protocol for seamless internet-native payments.
#kubernetes
fromMedium
2 days ago
DevOps

Kubernetes Scared Me Too - Until I Actually Understood It A no-fluff intro for devs who keep

DevOps
fromInfoQ
6 days ago

Kubernetes Autoscaling Demands New Observability Focus Beyond Vendor Tooling

Kubernetes autoscalers like Karpenter require new observability practices focusing on provisioning behavior, scheduling latency, and cost efficiency.
DevOps
fromMedium
2 days ago

Kubernetes Scared Me Too - Until I Actually Understood It A no-fluff intro for devs who keep

Kubernetes simplifies container orchestration, managing deployment, scaling, and traffic routing for applications across multiple servers.
DevOps
fromApp Developer Magazine
5 days ago

Lens Launches MCP Server to Connect AI Coding Assistants with Kubernetes

Lens by Mirantis integrates a Model Context Protocol server, simplifying AI coding assistants' access to Kubernetes clusters.
DevOps
fromInfoQ
6 days ago

Kubernetes Autoscaling Demands New Observability Focus Beyond Vendor Tooling

Kubernetes autoscalers like Karpenter require new observability practices focusing on provisioning behavior, scheduling latency, and cost efficiency.
Design
fromInfoQ
3 days ago

Panel: Taking Architecture Out of the Echo Chamber

Architecture's importance is growing, necessitating a shift in practice to avoid past mistakes and engage with broader conversations.
Agile
fromMedium
2 days ago

Best Way to Onboard Team To Claude Code

Onboarding a team to Claude Code enhances efficiency in design and development tasks, optimizing its use for prototyping and code reviews.
fromTheregister
3 days ago

Forking frenzy ensues after launch of Euro-Office

Euro-Office is a 'true sovereign office suite' and a 'replacement for Microsoft Office with intuitive interface and strong compatibility.'
European startups
Startup companies
fromwww.businessinsider.com
2 days ago

Jack Dorsey says Block employees now bring prototypes not slide decks to meetings

Block CEO Jack Dorsey has eliminated slide decks in favor of prototypes for meetings, emphasizing real-time modifications and reduced costs of decision-making.
fromRubyflow
3 days ago
Ruby on Rails

Internator now runs on OpenCode (bye Codex)

Internator is a Ruby CLI that automates code changes and now operates on OpenCode for enhanced flexibility and efficiency.
#npm
Node JS
fromInfoQ
4 days ago

Axios npm Package Compromised in Supply Chain Attack

A significant supply chain attack on Axios introduced a Remote Access Trojan via hijacked maintainer accounts, affecting numerous developer environments.
Node JS
fromBleepingComputer
5 days ago

Hackers compromise Axios npm package to drop cross-platform malware

Hackers compromised the Axios npm account to distribute remote access trojans across multiple operating systems.
Node JS
fromInfoQ
4 days ago

Axios npm Package Compromised in Supply Chain Attack

A significant supply chain attack on Axios introduced a Remote Access Trojan via hijacked maintainer accounts, affecting numerous developer environments.
Node JS
fromBleepingComputer
5 days ago

Hackers compromise Axios npm package to drop cross-platform malware

Hackers compromised the Axios npm account to distribute remote access trojans across multiple operating systems.
Marketing tech
fromFast Company
3 days ago

Why are designers, engineers, and product managers in a 'three-way standoff'?

The design job market is experiencing uncertainty as demand for product managers rises, raising concerns about the impact of AI on designer roles.
UX design
fromAzure DevOps Blog
4 days ago

Improving the Markdown Editor for Work Items - Azure DevOps Blog

Markdown editor usability improved by distinguishing between preview and edit modes to enhance user experience.
fromTheregister
5 days ago

Contracts are in C++26 despite disagreement over their value

Contracts are a means of setting preconditions and postconditions on function declarations, and adding assertion statements within functions. The feature is intended to help make C++ code safer and more reliable.
Intellectual property law
Information security
fromBleepingComputer
1 day ago

Axios npm hack used fake Teams error fix to hijack maintainer account

A social engineering attack linked to North Korean hackers compromised Axios maintainers, leading to a supply chain attack with malicious npm package versions.
Software development
fromDevOps.com
3 days ago

Why Code Validation is the Next Frontier - DevOps.com

Shared staging environments are inadequate for modern development; isolated, on-demand setups are needed for effective validation.
Artificial intelligence
fromFuturism
1 day ago

Say a Prayer for This Startup That's Replacing Its Developers With OpenClaw

OpenClaw is being used to create autonomous AI teams, raising concerns about job security for human developers.
DevOps
fromInfoQ
4 days ago

Github Integrates AI to Improve Accessibility Issue Management and Automate Feedback Triage

GitHub has launched an AI-powered workflow to streamline accessibility feedback into prioritized engineering tasks.
Cryptocurrency
fromnews.bitcoin.com
4 days ago

World Unveils New Toolkit, Expands Developer Program With World Build 3

World's Minikit 2.0 allows developers to convert web apps into Mini Apps with minimal code changes, enhancing compatibility and user experience.
#github
#ai
Artificial intelligence
fromFortune
3 days ago

In the age of vibe coding, trust is the real bottleneck | Fortune

AI tools can generate code rapidly, but they also introduce vulnerabilities and require rigorous verification to ensure security and compliance.
fromMedium
4 days ago
Software development

The AI Revolution in Development: Why Outer Loop Agents Are the Next Big Thing

Software development
fromInfoQ
1 week ago

From Friction to Flow: How Great DevEx Makes Everything Awesome

AI improves some aspects of software development but also reveals persistent challenges, particularly in deployment times.
Artificial intelligence
fromFortune
3 days ago

In the age of vibe coding, trust is the real bottleneck | Fortune

AI tools can generate code rapidly, but they also introduce vulnerabilities and require rigorous verification to ensure security and compliance.
Software development
fromMedium
4 days ago

The AI Revolution in Development: Why Outer Loop Agents Are the Next Big Thing

AI is set to revolutionize post-code push processes, automating tasks like security fixes, error logging, and code reviews.
Software development
fromInfoQ
1 week ago

From Friction to Flow: How Great DevEx Makes Everything Awesome

AI improves some aspects of software development but also reveals persistent challenges, particularly in deployment times.
DevOps
fromMedium
2 days ago

Fair Multitenancy-Beyond Simple Rate Limiting

Fair multitenancy ensures equitable infrastructure access for customers, balancing simplicity, performance, and safety in shared environments.
Software development
fromMedium
3 days ago

Zero-Effort Production Debugging: How I Automated Bug Fixes for My Side Project

Automating bug fixes with an AI agent streamlines maintenance for full-stack applications, enabling zero-effort management of errors.
Online Community Development
fromInfoQ
2 weeks ago

Platform Engineering as a Practice of Sociotechnical Excellence

Platform engineering drives sociotechnical change by integrating social and technical systems within organizations for improved collaboration and reliability.
#cybersecurity
Information security
fromThe Hacker News
2 days ago

UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack

A targeted social engineering campaign by North Korean actors led to a supply chain compromise of the Axios npm package.
Information security
fromSecurityWeek
5 days ago

TeamPCP Moves From OSS to AWS Environments

TeamPCP has exploited compromised credentials to target open source software, leading to significant data exfiltration and supply chain attacks.
Software development
fromTechzine Global
2 days ago

Cursor updates its platform with a focus on autonomous AI agents

Cursor 3 enhances software development by integrating AI agents for collaborative coding, reducing manual programming and streamlining workflows.
DevOps
fromTechzine Global
3 days ago

Observability warehouses, the next structural evolution for telemetry

Observability is essential for real-time insights in cloud systems, helping to reduce downtime and improve performance.
Media industry
fromInfoQ
3 weeks ago

Information Flow: The Hidden Driver of Engineering Culture

Ron Westrom identified three organizational cultures defined by how information flows: generative cultures where information is shared and people build things, bureaucratic cultures with controlled information flow, and pathological cultures where information is hoarded.
Software development
fromArs Technica
3 days ago

Anthropic says its leak-focused DMCA effort unintentionally hit legit GitHub forks

Anthropic's DMCA takedown mistakenly removed legitimate forks of its code, leading to backlash and a request for reinstatement of affected repositories.
Web frameworks
fromMedium
3 weeks ago

My 8-Year-Old Open-Source Project was a Victim of a Major Cyber Attack

A popular open-source project fell victim to a supply-chain attack through a development workflow loophole, threatening years of work and project reputation.
#agentic-ai
Artificial intelligence
fromComputerWeekly.com
4 days ago

AI-driven operating model key to cloud-native, autonomous networks | Computer Weekly

Agentic AI can transform telecom networks if operators establish cloud-native maturity and integrate autonomy while maintaining reliability.
Artificial intelligence
fromComputerWeekly.com
4 days ago

AI-driven operating model key to cloud-native, autonomous networks | Computer Weekly

Agentic AI can transform telecom networks if operators establish cloud-native maturity and integrate autonomy while maintaining reliability.
DevOps
fromTechzine Global
5 days ago

Harness adds four capabilities to close AI delivery gap

Harness is launching four new capabilities to enhance its Continuous Delivery platform, addressing the gap between code writing speed and release reliability.
#ai-in-open-source
fromZDNET
3 weeks ago
Miscellaneous

Why AI is both a curse and a blessing to open-source software - according to developers

fromZDNET
3 weeks ago
Artificial intelligence

Why AI is both a curse and a blessing to open-source software - according to developers

fromZDNET
3 weeks ago
Miscellaneous

Why AI is both a curse and a blessing to open-source software - according to developers

Artificial intelligence
fromZDNET
3 weeks ago

Why AI is both a curse and a blessing to open-source software - according to developers

AI can benefit open source when properly applied for security analysis, but causes harm when generating low-quality automated bug reports that overwhelm maintainers with false positives.
DevOps
fromInfoQ
6 days ago

Failure As a Means to Build Resilient Software Systems: A Conversation with Lorin Hochstein

Using software failures can enhance software architecture and reliability engineering practices.
#cicd
Software development
fromDevOps.com
5 days ago

The Trust Tax Framework: Measuring Developer Confidence in CI/CD Systems - DevOps.com

Test infrastructure credibility is crucial; developers lose trust when re-run rates exceed 30% and override rates surpass 5%.
Software development
fromDevOps.com
5 days ago

The Trust Tax Framework: Measuring Developer Confidence in CI/CD Systems - DevOps.com

Test infrastructure credibility is crucial; developers lose trust when re-run rates exceed 30% and override rates surpass 5%.
Information security
fromSecurityWeek
5 days ago

Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise

OAuth tokens pose significant security risks, especially when long-lived, as they can lead to widespread breaches across multiple organizations.
#software-development
DevOps
fromInfoWorld
6 days ago

How to build an enterprise-grade MCP registry

MCP registries are essential for integrating AI agents with enterprise systems, requiring semantic discovery, governance, and developer-friendly controls.
DevOps
fromApp Developer Magazine
1 week ago

Private Repository Secures the AI-driven Development Boom

ActiveState Curated Catalog provides a secure repository of vetted open source components for organizations, reducing risks associated with public registries.
Miscellaneous
fromTheregister
1 month ago

Open source package repositories face sustainability crisis

Open source repositories face unsustainable demand from companies misusing them as CDNs, prompting consideration of tiered payment systems where heavy users pay while individual developers remain free.
Software development
fromDEV Community
5 days ago

From Maintaining Open Source Libraries to Building an AI-Powered Tools OS with Rust and WebAssembly

Kitmul evolved from a modest project to a platform offering over 300 tools, leveraging AI to enhance development speed and user accessibility.
DevOps
fromInfoQ
1 week ago

Architecting Autonomy at Scale: Raising Teams Without Creating Dependencies

Aligning architectural decision authority to C4 abstraction levels clarifies ownership boundaries for distributed teams without needing a central approver.
#open-source-funding
fromTechCrunch
1 month ago
Non-profit organizations

A VC and some big-name programmers are trying to solve open source's funding problem, permanently | TechCrunch

fromTechCrunch
1 month ago
Non-profit organizations

A VC and some big-name programmers are trying to solve open source's funding problem, permanently | TechCrunch

DevOps
fromDevOps.com
1 week ago

From AI Code to Production: The Case for FeatureOps - DevOps.com

AI coding tools are widely used, but increased usage leads to decreased delivery stability and a control gap in understanding code impact.
Information security
fromDevOps.com
2 weeks ago

Harness Extends AI Security Reach Across Entire DevOps Workflow - DevOps.com

Harness launched AI security capabilities including automatic code securing during AI-assisted development and a module discovering, testing, and protecting AI components within applications.
#devops
DevOps
fromDevOps.com
1 week ago

Five Great DevOps Job Opportunities - DevOps.com

DevOps.com is launching a weekly jobs report to highlight opportunities for DevOps professionals amid a constrained talent pool.
DevOps
fromDevOps.com
1 week ago

Five Great DevOps Job Opportunities - DevOps.com

DevOps.com is launching a weekly jobs report to highlight opportunities for DevOps professionals amid a constrained talent pool.
Software development
fromInfoQ
2 weeks ago

Stripe Engineers Deploy Minions, Autonomous Agents Producing Thousands of Pull Requests Weekly

Minions are autonomous coding agents at Stripe that generate production-ready pull requests with minimal human intervention.
Philosophy
fromMedium
1 month ago

Why code is not the source of truth

Design specifications and blueprints, not implementation code, are the authoritative source of truth; implementation is derived from and judged against originating design authority.
Software development
fromInfoWorld
2 weeks ago

How AI is changing open source

Open source shifted focus from consumer visibility to critical infrastructure layers like Kubernetes, observability, and platform engineering that power AI and cloud-native systems.
#agentic-workflows
fromTechzine Global
1 month ago

AI code undermines control over open source and IP

While AI tools are lowering the barrier to development, the gap between speed and manageability is growing. In just over a year and a half, AI code assistants have grown from an experiment to an integral part of modern development environments. They are driving strong productivity growth, but organizations are not keeping up with the associated security and governance issues.
Information security
fromInfoWorld
1 month ago

An ode to craftsmanship in software development

Your coding apprentice can build, at your direction, pretty much anything now. The task becomes more like conducting an orchestra than playing in it. Not all members of the orchestra want to conduct, but given that is where things are headed, I think we all need to consider it at least.
Software development
Software development
fromInfoQ
1 month ago

GitHub's Points to a More Global, AI-Challenged Open Source Ecosystem in 2026

Open source faces unprecedented scale with 36 million new developers joining GitHub in 2025, requiring formal governance structures and strategies to manage AI-generated low-quality contributions.
fromInfoWorld
1 month ago

Open source maintainers are being targeted by AI agent as part of 'reputation farming'

The important shift is that software contribution itself is becoming programmable,
Artificial intelligence
fromInfoWorld
2 months ago

12 principles for improving devsecops

I once transitioned from a SaaS CTO role to become a business unit CIO at a Fortune 100 enterprise that aimed to bring startup development processes, technology, and culture into the organization. The executives recognized the importance of developing customer-facing applications, game-changing analytics capabilities, and more automated workflows. Let's just say my team and I did a lot of teaching on agile development and nimble architectures.
DevOps
fromDevOps.com
2 months ago

Bot-Driven Development: Redefining DevOps Workflow - DevOps.com

Industry professionals are realizing what's coming next, and it's well captured in a recent LinkedIn thread that says AI is moving on from being just a helper to a full-fledged co-developer - generating code, automating testing, managing whole workflows and even taking charge of every part of the CI/CD pipeline. Put simply, AI is transforming DevOps into a living ecosystem, one driven by close collaboration between human judgment and machine intelligence.
Software development
Software development
fromMedium
1 year ago

How Bit Reduces Development Costs

A composable, well-documented codebase increases reuse, reduces bugs, and enables AI and non-technical stakeholders to contribute effectively.
fromInfoWorld
2 months ago

Which development platforms and tools should you learn now?

Software development used to be simpler, with fewer choices about which platforms and languages to learn. You were either a Java, .NET, or LAMP developer. You focused on AWS, Azure, or Google Cloud. Full-stack developers learned the intricacies of selected JavaScript frameworks, relational databases, and CI/CD tools. In the best of times, developers advanced their technology skills with their employer's funding and time to experiment. They attended conferences, took courses, and learned the low-code development platforms their employers invested in.
Software development
[ Load more ]