Want data privacy? Work on data security first by Taylor Armerding link.medium.com/Lw5xCIPWsnb

The Pitfalls of Blind Trust: Open Source and the Log4Shell Vulnerability toolbox.com/it-security/vuln…

Thanks, and glad you liked it!

Congratulations! Now as you go about examining bars, please do remember to tip well

With opinions billed in six minute increments and a six minute minimum

#RSAC attendees - if you want to chat following my session on software supply chains, please feel free to book a meeting in the app

The reply to any question in Slack: My calendar is up to date

Can you check the order status of your new laptop in Ariba?

Thank you! Happy 2021 to everyone!

Congrats Steve. Welcome to the AppSec world!

If only travel were possible

Calling all tech writers! Open source benefits when we all contribute. If you've struggled to deploy a project - or hear people moaning about a lack of docs - help improve the docs! Thank you @Didicodes #opensource #devops #cloud

Since it feels like we're in Groundhog Day, I propose that become the function name

UCSD Pascal, ADA, Fortran, C, x86 ASM, C++, Basic, Bash, C#, Golang Showing how early I got started, or my age - you decide

Join @ghaff and myself at 1PM EDT today to talk about the state of open source #opensource #devops #devsecops #CloudComputing #containers /cc @RedHat @redhatopen @SW_Integrity

I tend to ask "why" questions which can place people on the defensive, so when someone is new I explain that their contribution is welcome but without test cases, it could fall on someone else to fix issues and that someone won't have the context the contributor has

I try and walk them through. I can't assume anything about their experience level or access to resources, so generally I want to see in the PR something about what testing was performed. If nothing else, it lets me know if I need to test something specific before merging.

Within the code contributor space, the worst always has something to do with testing before making a pull request. Usually the lack of testing or an expectation for a merge with a LGTM. The bigger the change set, the more likely to get the "but, but, but" argument.

Best case is finding out that your project has become a cornerstone of their business, and you've never heard of the business. Then having them step up to become a community leader in their own right.

For me it's users who think open source projects are commercial software. Stuff like wanting roadmap presentations, getting angry that features are "taking too long", or a "what's taking so long to fix this bug" sentiment