Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@varbear shared a link, 3 weeks, 3 days ago
FAUN.dev()

What Is an Async Agent, Really?

An async agent is not inherently async, it depends on whether you wait for it to finish or not. Async agents can manage their own event loop of other agents, spawning and coordinating them to handle tasks, just like an async runtime in programming. This architectural distinction allows for concurren.. read more  

Link
@varbear shared a link, 3 weeks, 3 days ago
FAUN.dev()

I struggled to code with AI until I learned this workflow

AI coding assistants work best when given clear context, a specific plan, and implemented in small, reviewable steps. Start with context, then a plan, and iterate through implementation and testing to avoid AI freelancing pitfalls... read more  

Link
@varbear shared a link, 3 weeks, 3 days ago
FAUN.dev()

Company as Code

Organisations rely heavily on digital systems, yet manage important organisational data using outdated manual methods despite advanced automation capabilities in other areas. A novel "Company as Code" concept proposes a programmatic representation of the entire organisation, enabling structured, ver.. read more  

Link
@kaptain shared a link, 3 weeks, 3 days ago
FAUN.dev()

Introducing Node Readiness Controller

Kubernetes just dropped theNode Readiness Controller- a smarter way to track node health. It slaps taints on nodes based on custom signals, not just the plain old "Ready" status. The goal? Safer pod scheduling that actually reflects what’s going on under the hood. It's powered by theNodeReadinessRul.. read more  

Link
@kaptain shared a link, 3 weeks, 3 days ago
FAUN.dev()

How GKE Inference Gateway improved latency for Vertex AI

Vertex AI now plays nice withGKE Inference Gateway, hooking into the Kubernetes Gateway API to manage serious generative AI workloads. What’s new:load-awareandcontent-aware routing. It pulls from Prometheus metrics and leverages KV cache context to keep latency low and throughput high - exactly what.. read more  

How GKE Inference Gateway improved latency for Vertex AI
Link
@kaptain shared a link, 3 weeks, 3 days ago
FAUN.dev()

CVE-2026-22039: Kyverno Authorization Bypass

Kyverno - a CNCF policy engine for Kubernetes - just dropped a critical one:CVE-2026-22039. It lets limited-access users jump namespaces by hijacking Kyverno'scluster-wide ServiceAccountthrough crafty use of policy context variable substitution. Think privilege escalation without breaking a sweat. I.. read more  

CVE-2026-22039: Kyverno Authorization Bypass
Link
@kaptain shared a link, 3 weeks, 3 days ago
FAUN.dev()

How Kubernetes Learned to Resize Pods Without Restarting Them

Kubernetes v1.35 introduces in-place Pod resizing, allowing dynamic adjustments to CPU and memory limits without restarting containers. This feature addresses the operational gap of vertical scaling in Kubernetes by maintaining the same Pod UID and workload identity during resizing. With this breakt.. read more  

How Kubernetes Learned to Resize Pods Without Restarting Them
Link
@kaptain shared a link, 3 weeks, 3 days ago
FAUN.dev()

Why Kubernetes is retiring Ingress NGINX

The Kubernetes Steering Committee is pulling the plug onIngress NGINX- official support ends March 2026. No more updates. No security patches. Gone. Why? It's been coasting on fumes. One or two part-time maintainers couldn't keep up. The tech debt piled up. Now it's a security liability. What's next.. read more  

Why Kubernetes is retiring Ingress NGINX
Link
@kala shared a link, 3 weeks, 3 days ago
FAUN.dev()

Nathan Lambert: Open Models Will Never Catch Up

Open models will be the engine for the next ten years of AI research, according to Nathan Lambert, a research scientist at AI2. He explains that while open models may not catch up with closed ones due to fewer resources, they are still crucial for innovation. Lambert emphasizes the importance of int.. read more  

Nathan Lambert: Open Models Will Never Catch Up
Link
@kala shared a link, 3 weeks, 3 days ago
FAUN.dev()

My AI Adoption Journey

A dev walks through the shift from chatbot coding toagent-based AI workflows, think agents that read files, run code, and double-check their work. Things only clicked once they built outcustom tools and configsto help agents spot and fix their own screwups. That’s the real unlock... read more  

The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.