Join us

ContentUpdates from The Open Source Security Foundation (OpenSSF) is a...
Link
@faun shared a link, 6 months ago
FAUN.dev()

TIOBE Programming Index News September 2025: Perl Regains the Spotlight

Perl 5 has risen to **10th place in the TIOBE Index**, increasing in popularity even though the exact reason is unknown. Perl 6, or Raku, lags behind Perl 5 in rankings and has not seen the same rise in attention. Other top languages like C and Java have experienced slight falls in rankings... read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

You Vibe It, You Run It?

Vibe Coding lets developers create software by chatting with AI, skipping traditional coding. But the non-determinism of AI prompts poses significant risks for reliability and maintainability, potentially leading to addiction-like dependence on this new tool. Think twice before fully embracing this .. read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

Guardians of the Agents 

A new static verification framework wants to make runtime safeguards look lazy. It slaps **mathematical safety proofs** onto LLM-generated workflows *before* they run—no more crossing fingers at execution time. The setup decouples **code from data**, then runs checks with tools like **CodeQL** and .. read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

GitHub Copilot on autopilot as community complaints persist

GitHub's biggest debates right now? Whether to shut down AI-generated "noise" fromCopilot—stuff like auto-written issues and code reviews. No clear answers from GitHub yet. Frustration is piling up. Some devs are ditching the platform altogether, shifting their projects toCodebergor spinning upself-.. read more  

GitHub Copilot on autopilot as community complaints persist
Link
@faun shared a link, 6 months ago
FAUN.dev()

Understanding LLMs: Insights from Mechanistic Interpretability

LLMs generate text by predicting the next word using attention to capture context and MLP layers to store learned patterns. Mechanistic interpretability shows these models build circuits of attention and features, and tools like sparse autoencoders and attribution graphs help unpack superposition, r.. read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

Building Agents for Small Language Models: A Deep Dive into Lightweight AI

Agent engineering with **small language models (SLMs)**—anywhere from 270M to 32B parameters—calls for a different playbook. Think tight prompts, offloaded logic, clean I/O, and systems that don’t fall apart when things go sideways. The newer stack—**GGUF** + **llama.cpp**—lets these agents run loc.. read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

Introducing the MCP Registry

The new **Model Context Protocol (MCP) Registry** just dropped in preview. It’s a public, centralized hub for finding and sharing MCP servers—think phonebook, but for AI context APIs. It handles public and private subregistries, publishes OpenAPI specs so tooling can play nice, and bakes in communit.. read more  

Link
@faun shared a link, 6 months ago
FAUN.dev()

The LinkedIn Generative AI Application Tech Stack: Extending to Build AI Agents

LinkedIn tore down its GenAI stack and rebuilt it for scale—with agents, not monoliths. The new setup leans on distributed, gRPC-powered systems. Central skill registry? Check. Message-driven orchestration? Yep. It’s all about pluggable parts that play nice together. They added sync and async modes.. read more  

The LinkedIn Generative AI Application Tech Stack: Extending to Build AI Agents
Link
@faun shared a link, 6 months ago
FAUN.dev()

Vibe coding has turned senior devs into ‘AI babysitters,’ but they say it’s worth it

Fastly says95% of developersspend extra time fixing AI-written code. Senior engineers take the brunt. That overhead has even spawned a new gig: “vibe code cleanup specialist.” (Yes, seriously.) As teams lean harder on AI tools, reliability and security start to slide—unless someone steps in. The re.. read more  

Vibe coding has turned senior devs into ‘AI babysitters,’ but they say it’s worth it
Link
@faun shared a link, 6 months ago
FAUN.dev()

AgentHopper: An AI Virus

In the “Month of AI Bugs,” researchers poked deep and found prompt injection holes bad enough to run **arbitrary code** on major AI coding tools—**GitHub Copilot**, **Amazon Q**, and **AWS Kiro** all flinched. They didn’t stop at theory. They built **AgentHopper**, a proof-of-concept AI virus that .. read more  

AgentHopper: An AI Virus
The Open Source Security Foundation (OpenSSF) is an industry-backed foundation focused on strengthening the security of the global open source software ecosystem. It brings together major technology companies, cloud providers, open source communities, and security experts to address systemic security challenges that affect how software is built, distributed, and consumed.

OpenSSF was launched in 2021 and operates under the Linux Foundation, combining efforts from earlier initiatives such as the Core Infrastructure Initiative (CII) and industry-led supply chain security programs. Its mission is to make open source software more trustworthy, resilient, and secure by default, without placing unrealistic burdens on maintainers.

The foundation works across several key areas:

- Supply chain security: Developing frameworks, best practices, and tools to secure the software lifecycle from source to deployment. This includes stewardship of projects like sigstore and leadership on SLSA (Supply-chain Levels for Software Artifacts).

- Security tooling: Supporting and incubating open source tools that help developers detect, prevent, and remediate vulnerabilities at scale.

- Vulnerability management: Improving how vulnerabilities are discovered, disclosed, scored, and fixed across open source projects.

- Education and best practices: Publishing guidance, training, and maturity models such as the OpenSSF Best Practices Badge Program, which helps projects assess and improve their security posture.

- Metrics and research: Advancing data-driven approaches to understanding open source security risks and ecosystem health.

OpenSSF operates through working groups and special interest groups (SIGs) that focus on specific problem areas like securing builds, improving dependency management, or automating provenance generation. This structure allows practitioners to collaborate on concrete, actionable solutions rather than high-level policy alone.

By aligning maintainers, enterprises, and security teams, OpenSSF plays a central role in reducing large-scale risks such as dependency confusion, compromised build systems, and malicious package injection. Its work underpins many modern DevSecOps and cloud-native security practices and is increasingly referenced by governments and enterprises as a baseline for secure software development.