Tag: opensource
-
AI is good at finding security vulnerabilities, not great at fixing them
Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday. Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the…
-
J.P. Morgan’s Patchmageddon: Time-to-Exploit Hits Zero Days While Time-to-Patch Nears 100, 18 Million Packages Have One Maintainer, and Only 75 of 530 High-Severity Mythos Findings Got Fixed
The time between a vulnerability’s disclosure and its first exploitation has fallen to zero days while the average organization’s time to patch has risen toward 100, and frontier models that find bugs at scale push both lines the wrong way. The exposed flank is open source: 18 million packages with one maintainer, a two-week patch…
-
516 patches across 6,000 vulnerabilities found by AI
Over six months of scanning some of the world’s most widely used open source projects, Anthropic’s models surfaced more than 29,000 candidate vulnerabilities. Its human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000. A disclosure dashboard puts some numbers behind the problem.…
-
400 Java flaws fixed by centaurs
For the more than 400 flaws, Lightwell engineers backported patches into the widely deployed versions of each library. Any fix that also applies upstream goes back to the open-source project under responsible disclosure protocols while Clearinghouse participants keep their embargo protections. Neither company has named the affected libraries. Behind the fixes, engineers from both companies…
-
Release your software all at once to defend against hacks
The Spring team is now releasing all updates on one day to give people a leg up in patching: Historically, we spread releases over a two-week period with each level of the Spring portfolio dependency tree shipping on a different day. While that approach has served us well over the years, in a world where…
-
New open source support plan from Broadcom VMware Tanzu
Padmanabhan said that promise means VMware will also provide “TrueSource trusted artifacts” for code that is not part of Spring, including the wider Java ecosystem, Python, and Node.js. … Broadcom’s curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record,” according to a company statement. “Thousands…
-
Using frontier models to find security problems in Spring Framework – a trickle turned into a tidal wave
“In March, we saw 55 reports coming from the community. In April, that went to 112. April is also when we finally got access to those frontier models and started doing internal scanning, and our internal scans gave us another 370 internal reports.” Michael Minella on the Spring Team. The historical baseline was about seven…
-
Docling: An open-source tool kit for advanced document processing – Looks useful for getting precious text out of the PDF silo, from IBM.
-
“the great murderer of boredom”
My Content Two Software Defined episodes this week: “I used to eat 7-Eleven pizza,” startups, open source, and more, with Sarah Christoff – After an extensive discussion of 7-Eleven pizza cuisine, in this episode, Whitney and Coté talk with Sarah Christoff. They discuss working at startups, the point of startups, working in open source and…
-
The good times in tech are over – ”If you were an engineer who loved working on your company’s open-source libraries, it’s probably sensible to confront the fact that the company never really cared about it that much.”
-
Deepseek: The Quiet Giant Leading China’s AI Race – ”Open source, publishing papers, in fact, do not cost us anything. For technical talent, having others follow your innovation gives a great sense of accomplishment. In fact, open source is more of a cultural behavior than a commercial one, and contributing to it earns us respect.…
-
Link: IBM Takes A Hands Off Approach With Red Hat
The reason for this hands-off attitude for such expensive acquisitions is simple: Both VMware and Red Hat live and die by the fact that they are neutral to any particular platform. While IBM may prefer Red Hat’s various elements of the stack – the Enterprise Linux operating system, the OpenShift container system, the OpenStack cloud…
-
🗂 The Non-Compete Software Movement
> If I want to grab a piece of software and build a business on top of it through my own labor, I need to go elsewhere. I’m not welcome to do that in your house. medium.com/@adamhjk/…
-
Link: ‘The gulf between apps and infrastructure is blurring’ says boss of DevOps darling Puppet
Their portfolio: Puppet Bolt, the company’s simplified open source automation framework, hit version 1.0; Puppet Insights, a tool for measuring how fast and how well teams commit code, showed up as a private beta; Puppet Discovery, for corralling IT resources, moved on to version 1.6; Pipelines for Containers 3.3 got Helm support; and Puppet Enterprise…
-
Coté’s Commonplace Book #40
I was down in France, just around Paris this week to speak at an event. The audience gave me the chance to work on a military-centric version of my standard talk which was fun, and was well received. I dove even deeper into the ongoing US Air Force story of modernizing their software. It’s chock…
You must be logged in to post a comment.