EU data protection
fromInfoQ
1 day agoHow SBOMs and Engineering Discipline Can Help You Avoid Trivy's Compromise
SBOMs are essential for developers to enhance security and comply with new legislative requirements.
Her payment form wasn't connecting to the payment processor, and every attempt ended in an error message that made no sense. I understood her frustration. As a founder myself, I was acutely aware of the pain of trying to run a business and feeling like nothing was going your way. When I dug into her form, I found the problem a few minutes later: a mismatch between test mode and live credentials.
Overlooking how important a brief is will start your collaboration with a web development agency in London off on the wrong foot. A brief not only communicates what you're looking to build, but it also aligns everyone's expectations, mitigates delays and limits the amount of revisions required. Whether it's an e-commerce site launch, a branding overhaul or tweaking a few pain points, the guidance you provide will directly influence your website from day one.
This extends to the software development community, which is seeing a near-ubiquitous presence of AI-coding assistants as teams face pressures to generate more output in less time. While the huge spike in efficiencies greatly helps them, these teams too often fail to incorporate adequate safety controls and practices into AI deployments. The resulting risks leave their organizations exposed, and developers will struggle to backtrack in tracing and identifying where - and how - a security gap occurred.
Scrum has a bad reputation in some organizations. In many cases, this is because teams did something they called Scrum, it didn't work, and Scrum took the blame. To counter this, when working with organizations, we like to define a small set of rules a team must follow if they want to say they're doing Scrum. Enforcing this policy helps prevent Scrum from being blamed for Scrum-like failures.
During my eight years working in agile product development, I have watched sprints move quickly while real understanding of user problems lagged. Backlogs fill with paraphrased feedback. Interview notes sit in shared folders collecting dust. Teams make decisions based on partial memories of what users actually said. Even when the code is clean, those habits slow delivery and make it harder to build software that genuinely helps people.
Your coding apprentice can build, at your direction, pretty much anything now. The task becomes more like conducting an orchestra than playing in it. Not all members of the orchestra want to conduct, but given that is where things are headed, I think we all need to consider it at least.
"I've never felt this much behind as a programmer. The profession is being dramatically refactored as the bits contributed by the programmer are increasingly sparse and between. I have a sense that I could be 10X more powerful if I just properly string together what has become available over the last ~year and a failure to claim the boost feels decidedly like skill issue."
To find the typical example, just observe an average stand-up meeting. The ones who talk more get all the attention. In her article, software engineer Priyanka Jain tells the story of two colleagues assigned the same task. One posted updates, asked questions, and collaborated loudly. The other stayed silent and shipped clean code. Both delivered. Yet only one was praised as a "great team player."
Olimpiu Pop: Hello everybody. I'm Olimpiu Pop, an InfoQ editor, and I have in front of me Erica Pisani, one of the track hosts of QCon London 2025, and a very important track in my opinion. One that is important in general, but even more important these days. And the name of the track was performance and sustainability, which seems to be two opposing words. So, Erica, please introduce yourself.
Hast mentioned that they trust their unit tests and integration tests individually, and all of them together as a whole. They have no end-to-end tests: We achieved this by using good separation of concerns, modularity, abstraction, low coupling, and high cohesion. These mechanisms go hand in hand with TDD and pair programming. The result is a better domain-driven design with high code quality. Previously, they had more HTTP application integration tests that tested the whole app, but they have moved away from this (or just have some happy cases) to more focused tests that have shorter feedback loops, Hast mentioned.
Integrating databases into the CI/CD process or the DevOps pipeline is overlooked in the current DevOps landscape. Most organizations have adapted automated DevOps pipelines to handle application code, deployments, testing, and infrastructure configurations. However, database development and administration are left out of the DevOps process and handled separately. This can lead to unforeseen bugs, production issues, and delays in the software development life cycle.