TFIR: Open Source, Cloud Native & AI/ML

In this episode of TFiR Insights, I invited Chris Patterson, Product Manager, GitHub Actions – GitHub to join us and talk about how GitHub is approaching DevOps. We touched upon a wide range of topics which are listed below:

Under Investment In Software Development Will Hurt Companies: 2021 Predictions By Camunda by TFiR Media LLC

As much as we want to think that companies are prioritizing security in the cloud-native world, that is not the case. According to Karsten Samaschke, CEO of Cloudical, “Companies plan for security when pretty much everything is deployed, but that’s too late in the cloud and cloud-native environments.”

Misconfigurations and bugs are primary causes of security, but Samaschke believes not having the right processes in place also exposes companies to attackers. Security is as much a people/culture problem as it is a technology problem. Developers often have this mindset of looking at Ops and Security folks as their enemies. DevSecOps is trying to address that, but there is still a long way to go.

Samaschke also highlighted the complexity of modern cloud-native architecture that contributes to security issues. This has been an eye-opening discussion and I hope you enjoy it as much as I did.

“Security is one of those things where it's like a chain, if you have one weak link, it doesn't matter how strong the other links are, the chain as a whole is weak,” said William Morgan, CEO of Buoyant. Morgan believes that security has to be in place for every aspect of a business to be successful. It’s like an airbag in a car, or a parachute in a plane. When you need it, you wish you had one.

While advanced users who are experimenting with technologies like LinkerD are quite aware of Zero Trust and DevSecOps and are embracing these practices in their environments, there are still many other users who are still getting started with Kubernetes or still have legacy components and these users are still figuring out security.

In a nutshell, there is a huge opportunity for cloud native security players to help these users with securing their applications and environments.

Here is a discussion with Archis Gore, CTO of Polyverse about the challenges of security in the Kubernetes & Cloud Native world. The series titled ‘Cloud-Native Security’ is sponsored by Polyverse.

Linode is doing extensive work on improving the cloud experience for its users by improving the network. It's all open-source, software-defined network replacing proprietary black boxes with commodity hardware and open-source software. Linode has created its own Linux-based operating system called LNOS (Linode Network Operating System) which runs Linode’s full stack of orchestration and monitoring on top of Linux. This discussion with Dan and Maddie covers the work Linode is doing in the networking space. I hope you enjoyed the discussion.

This is a discussion with Javier Perez, Open Source Program Manager, IBM Z, and LinuxONE at IBM.

“Kubernetes is like a tsunami that is moving through every organization that’s doing computation,” said Sam Ramji, Chief Strategy Officer at DataStax. “It’s lifting everyone off of the virtual machine world and putting them into the container world.”

Duena Blomstrom is Co-Founder and CEO of PeopleNotTech, a company that brings back focus on people from tech. Psychological health and safety is a key indicator of high performing organizations. Especially in the age of the hybrid workforce, companies need to pay attention to the psychological aspects of their employees. Blomstrom will be delivering sessions at the upcoming DevOps Enterprise Summit to cover these topics. We sat down with her to not only get a preview of her presentation at the summit but also learned the importance of psychological health and safety of employees.

This is a conversation with Archis Gore, CTO of Polyverse. Polyverse recently joined the newly announced Open Source Security Foundation (OpenSSF), a Linux Foundation project.

Gore argues that Open Source software is built collaboratively. It doesn’t have a single ‘owner’ or a vendor. The community as a whole is the owner. What it means is that when it comes to security there is no ‘throat to choke’. No one owns SSL flaws, no one owns Heartbleed. Where does the buck stop? The Linux Foundation has been working on improving the security of open source projects, whether it hosts them or not. OpenSSF is an ambitious project in the direction of promoting the security of open-source software.

“I really see a massive explosion just waiting to happen in security benefits from that specific point of view where all the Linux Foundation projects can institutionalize security learnings, patterns, behaviors and operate in ways which were only available to large corporations,” said Gore.

Here are some of the topics that we covered:

Q: What is OpenSSF?

Q: What is the significance and importance of the foundation?

Q: How will it have an impact across the Linux Foundation?

Q: Security should be part of the development pipeline and not an afterthought?

Q: What value is Polyverse bringing to the openSSF?