Product Director, Nexus Repository
Toronto, Ontario
Joined November 2017
- Tweets149
- Following46
- Followers71
- Likes183
Michael Prescott @ Sonatype retweeted
I’ve spent much time thinking about why organizations struggle to understand the implications of the rise in malicious oss compared to typical vulnerabilities.
It ultimately comes down to psychology. In this article, I explore the psychological barriers that prevent effective action against these threats.
forbes.com/sites/forbestechc…
Michael Prescott @ Sonatype retweeted
🚨 an example of an adversary trying to push their malware as a coding solution. Please be careful with any dependencies
A threat actor is now advising StackOverflow devs seeking debugging help to install a 'pytoileur' #Python package as a "solution" to their code troubles.
🛑DO NOT fall for this, it's a trap—the package has encoded code hidden on line 17 via whitespaces and infects Windows users with #trojan as soon as it's installed!
sonatype.com/blog/pypi-crypt… #opensource #malware
Michael Prescott @ Sonatype retweeted
A stark reminder from the attack on XZ & libzma: It's more than a vulnerability, it's a calculated assault on the stretched open-source infrastructure of our digital world. Read my full take on the implications, actions you can take and the urgent call for collective vigilance
blog.sonatype.com/cve-2024-3…
Michael Prescott @ Sonatype retweeted
📢 Today marks a new era! Introducing SBOM Manager - the industry's first integrated system of record for managing SBOMs! A powerful, one-stop shop for easy, cost-effective, and compliant #SBOM management, monitoring, and distribution. bit.ly/4cnJpPU
Michael Prescott @ Sonatype retweeted
How to get started with Repository Health Check (RHC) 2.0, available in Sonatype Nexus Repository Manager 3.3: share.sonatype.social/nfjeu
Michael Prescott @ Sonatype retweeted
Well, the CRA passed through committee in a way that will avoid further discussion. There's zero chance they knew there were still significant issues and yet here we are.
Read more: devops.com/the-cyber-resilie…
Current status:
Michael Prescott @ Sonatype retweeted
Sonatype Named a Leader in The Forrester Wave™ for Software Composition Analysis securityboulevard.com/2023/0…
Michael Prescott @ Sonatype retweeted
Thrilled to share that @sonatype has been named in the 2023 Gartner Magic Quadrant for Application Security Testing (AST)!
Sonatype is recognized as a key vendor for software supply chain security and software composition analysis. Read more👇 share.sonatype.social/zutyr
Michael Prescott @ Sonatype retweeted
Hit close to home recently. Releasing code to a package manager has several advantages over just tagging code git. May seem obvious but when a vendor starts with "just build our tag" these are the reasons they should be producing a binary.
Package management in software ecosystems continues to evolve, but is it headed in the right direction? 📦 Sonatype's @devcasing explores the world of package managers in this excellent blog post: share.sonatype.social/2amm3
Michael Prescott @ Sonatype retweeted
☎️ Hey friends, could we ask a favor?
We're looking for your opinions and 10 minutes of your time. 👇
🔗 bit.ly/3UyX6mM
Michael Prescott @ Sonatype retweeted
The EU CRA Directive and the PLD have some very troubling language and implications for open source. The eclipse blog is a mandatory read on what it could mean here 👇
If you author open source, or even depend upon open source software (hint: everyone does) and you're not increasingly alarmed by what's happening in the EU first with the CRA and now with the PLD, you really need to sit up and pay attention: blogs.eclipse.org/post/mike-…
Michael Prescott @ Sonatype retweeted
⚡️ Speed - Developers need to move quickly.
🔒 Security - But they also need to ensure that an organization’s SLDC is protected.
🥷 Sonatype - Sonatype’s Repository Firewall helps to identify and block threats.
@devcasing details the process. 🔗 bit.ly/3AwVYqE
Michael Prescott @ Sonatype retweeted
Excited to share that @sonatype is a winner of the 2023 DevOps Excellence Awards! Our industry-leading Nexus Repository has been named the Best Open Source #DevOps Tool by @Computing_News 🏆 pbynd.co/n4sqx
Michael Prescott @ Sonatype retweeted
Today, the White house released an updated cyber security strategy. It has a pretty significant statement in objective 3.3 about moving liability from attacks to the vendors of software if not following safe harbour practices. @Brian_Fox deep dives below blog.sonatype.com/white-hous…
Michael Prescott @ Sonatype retweeted
Are you having trouble understanding the graph of your dependencies and where to best make some upgrades to improve your security, legal, quality posture? Take a look at BomDr from @sonatype . We're trying to make managing your deps fun and not a chore. bomdoctor.sonatype.com/#/hom…
ALT BomDr can provide snarky comments about the state of your application. Can you handle it?
Michael Prescott @ Sonatype retweeted
"Since 2019, @Sonatype’s AI tooling has found roughly 107,000 items that have been labelled as harmful, suspicious, or proof-of-concept."
🙊
➡️ bit.ly/3Yw3xZ3 via @OpenSourceForU
Michael Prescott @ Sonatype retweeted
Several practical measures to mitigate the risk of malicious code injection cited in @Sonatype's 8th Annual State of the Software Supply Chain Report. 🌀
👉 bit.ly/3UjGhKT
Michael Prescott @ Sonatype retweeted
PSA: CVE-2022-31289 is *NOT* a vulnerability or even a bug. The writeup on it was rushed without following any responsible disclosure and after half-baked "research."
blog.sonatype.com/nexus-repo…
@pmmali_ @HackerGautam @shifacyclewala here's the opportunity to set the record straight on your blog and reports.