Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@varbear shared a link, 2 months ago
FAUN.dev()

Distinguishing yourself early in your career as a developer

A seasoned dev maps the job market into three tiers:local/public companies,VC-backed/startups, andBig Tech/finance. Each step up brings more money, more competition, and a steeper climb. Category 3(Big Tech/finance): Highest salaries. Broadest interview access. Brutal prep required. Category 2(start.. read more  

Link
@kaptain shared a link, 2 months ago
FAUN.dev()

BadPods Series: Everything Allowed on AWS EKS

A security researcher ran a full-blown container escape on EKS usingBadPods- a tool that spins up dangerously overprivileged pods. The pod broke out of its container, poked around the host node, moved laterally, and swiped AWS IAM creds. All of it slipped past EKS’s defaultPod Security Admission (PS.. read more  

BadPods Series: Everything Allowed on AWS EKS
Link
@kaptain shared a link, 2 months ago
FAUN.dev()

Streamline your containerized CI/CD with GitLab Runners and Amazon EKS Auto Mode

GitLab Runners now work withAmazon EKS Auto Mode. That means hands-off infra, smarter scaling, and built-in AWS security. Runners spin up onEC2 Spot Instances, so teams can cut CI/CD compute costs by as much as90%- without hacking together flaky pipelines... read more  

Streamline your containerized CI/CD with GitLab Runners and Amazon EKS Auto Mode
Link
@kaptain shared a link, 2 months ago
FAUN.dev()

Implementing assurance pipeline for Amazon EKS Platform

AWS released a full-stack CI/CD validation pipeline forAmazon EKS. It pulls in six layers of testing,Terraform,Helm,Locustload testing, and evenAWS Fault Injectionfor pushing resilience to the edge. The goal: bake policy checks, functional tests, and brutal load tests right into pre-deployment. Fewe.. read more  

Link
@kaptain shared a link, 2 months ago
FAUN.dev()

From Deterministic to Agentic: Creating Durable AI Workflows with Dapr

Dapr droppedDurable Agents- a mashup of classic workflows and LLM-driven agents that can actually get things done and survive rough edges. They track reasoning steps, tool calls, and chat states like a champ. If things crash, no problem: Dapr Workflows and Diagrid Catalyst bring it all back... read more  

From Deterministic to Agentic: Creating Durable AI Workflows with Dapr
Link
@kaptain shared a link, 2 months ago
FAUN.dev()

Kubernetes GPU Management Just Got a Major Upgrade

Kubernetes 1.34 droppedDynamic Resource Allocation (DRA)- think persistent volumes, but for GPUs and custom hardware. Vendors can now plug in drivers and schedulers for their devices, and workloads can pick exactly what they need. Coming in 1.35: a newworkload abstractionthat speaks the language of .. read more  

Link
@kaptain shared a link, 2 months ago
FAUN.dev()

1.35: Enhanced Debugging with Versioned z-pages APIs

Kubernetes 1.35 makes a quiet-but-crucial upgrade: z-pages debugging endpoints now returnstructured, machine-readable JSON. That means tools- not just tired humans - can parse control plane state directly. The responses areversioned, backward-compatible, and tucked behind feature flags for now... read more  

Link
@kaptain shared a link, 2 months ago
FAUN.dev()

v1.35: New level of efficiency with in-place Pod restart

Kubernetes 1.35, as you may know, introducedin-place Pod restarts(alpha). It's a real reset: all containers, init and sidecars included - without killing the Pod or kicking off a reschedule. Think restart without the cloud drama. Big win for workloads with heavy inter-container dependencies or massi.. read more  

Link
@kaptain shared a link, 2 months ago
FAUN.dev()

v1.35: Watch Based Route Reconciliation in the Cloud Controller Manager

Kubernetes v1.35 sneaks in an alphafeature gatethat flips the CCM route controller from "check every X minutes" to "watch and react." It now usesinformersto trigger syncs when nodes change - plus a light periodic check every 12–24 hours... read more  

Link
@kala shared a link, 2 months ago
FAUN.dev()

The 2026 Data Engineering Roadmap: Building Data Systems for the Agentic AI Era

Data engineering’s getting flipped.AI agentsandLLMsaren’t just tagging along anymore - they’re the main users now. That means engineers need to buildcontext-aware, machine-readable data systemsthat don’t just store info but actually make sense of it. Think:vector databases,knowledge graphs,semantic .. read more  

The 2026 Data Engineering Roadmap: Building Data Systems for the Agentic AI Era
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.