The New Stack Podcast

Listen to more Podcasts from The New Stack here : https://thenewstack.io/

Prisma, from Palo Alto Networks, sponsored this podcast, following its Cloud Native Security Live, 2020 Virtual Summit held Feb. 11, 2020.

The concept of DevSecOps is getting a lot of play these days — and for good reason. As organizations’ DevOps seek to boost their rates of deployments and updates at cadences unheard of just a few years ago, the risk of vulnerabilities can often increase at the same rate in theory. While it doesn’t have to be this way, of course, some organizations struggle with remediating vulnerabilities long after the software has been deployed, not only causing major potential headaches when breaches occur (think Equifax), but causing additional pain when developers must reconfigure code again, and in extreme cases, reinvent the wheel.

The solution, of course, is for security teams to become vested in code development at the very beginning of the production cycle. This is what agile DevOps teams are supposed to do anyway, but many organizations have not implemented the necessary culture, tools and processes to do this. After years of existing as a concept, DevSecOps formalizes the often missing security links in development processes today.

In this edition of The New Stack Makers podcast, DevSecOps evolution and why it is so vital today were discussed.

The guests were selected for there first-hand experience and experience with DevSecOps were:

Rohit Gupta, global segment leader, security, for Amazon Web Services (AWS).

Cindy Blake, security advocate, for GitLab.

Shaan Mulchandani, AWS security practice, for Accenture.

The New Stack Publisher Alex Williams hosted this episode.

Read More:

Welcome to The New Stack Context, a podcast where we discuss the latest news and perspectives in the world of cloud native computing. This week we spoke with Ryan Staatz, head of DevOps at LogDNA, about running stateful services on Kubernetes, as part of our series of posts and podcasts on the challenges of running Kubernetes in 2020.

TNS editorial and marketing director Libby Clark hosted this episode, alongside founder and publisher Alex Williams and TNS Managing Editor Joab Jackson.

Each month on The New Stack, we pick ta heme to devote a certain amount of coverage, issues that we hear are important to our readers. This month, we looked at one of the ongoing challenges for Kubernetes around how to run stateful applications.

As Staatz explains in his post on the subject, “A Blueprint for Running Stateful Services on Kubernetes,”

“State” refers to the condition that an application is in at a particular point in time. A stateful application changes its behavior based on previous transactions; in other words, it maintains a memory of the past. Examples of stateful applications include databases, caches, and content management systems (CMS) such as WordPress. With stateful applications, the application must have a location where it can store its state as data. This data needs to be available to the application throughout its lifespan. In a basic single-server, single-instance application, this could be as easy as storing data directly on the host filesystem.

We chat with Staatz about his preferred approaches to running stateful applications on Kubernetes, as well as how LogDNA supports these architectures with its own logging service. Then, later in the show, we discuss some other recenet posts on the topic: Analyst Janakiram MSV in his post, “Different Approaches for Building Stateful Kubernetes Applications,” reveals that there are a number of different ways to provide stateful support to K8s. A Q&A with Saad Ali, the chair of the Kubernetes Storage Special Interest Group at the Cloud Native Computing Foundation, discusses the work already done to make run stateful workloads easier, as well as the challenges that remain and what to look for in the future.

We also give a listen to The New Stack Makers podcast with InfluxData’s Chris Churilo, who offers some perspective on why organizations increasingly rely on time series databases to “make products or services better.”

Read more https://thenewstack.io/

In this episode of The New Stack Makers, we talk to Kris Beevers about the importance of the traffic manager role and so much more as we look ahead to this year in enterprise tech. Seven years ago, Beevers co-founded NS1, the networking automation company or, as he calls it, “the system of record for many, many of the key domains and the applications on the Internet today.”

He says that each of us interacts with NS1 dozens of times a day, like when we are connecting on LinkedIn or sharing files on DropBox.

NS1 sits at the base of this new traffic management stack, steering that traffic across our increasingly complex and distributed systems. This stack also includes content networking delivery networks (CDN), load-balancing tooling, edge networking footprints, Service Mesh, service discovery, and egress optimization. This new role isn’t just about measuring if traffic is working correctly, but really understanding both your users and systems to know how traffic is reaching the application, if you’re using the right networking providers and venders, and if you’re choosing data centers, clouds and CDNs effectively.

This new traffic management role sits at the heart of greater site reliability engineering trends like chaos engineering and progressive delivery. It’s about using your tooling stack to understand how your whole tooling reacts to prepare for the worst.

Read more stories like this here! https://thenewstack.io/

Prisma, from Palo Alto Networks, sponsored this podcast, following its Cloud Native Security Live, 2020 Virtual Summit held Feb. 11, 2020.

Agile development teams may able to meet software release and update cadences at faster and faster rates — but ultimately, their deployments are only as good as the underlying code. Applications that lack robustness or have vulnerabilities that are discovered until only after its too late can defeat the whole purpose of Agile DevOps. The hard truth is that policies and practices must involve testing and monitoring from the outset of code development while extending throughout the entire CI/CD lifecycle.

The main theme of this edition of The New Stack Makers podcast recorded live at Palo Alto Networks’ studio in Santa Clara, CA, is how to protect software throughout the entire supply chain. The guests were:

Dr. Chenxi Wang, a managing general partner for Rain Capital, a keynote speaker and a “Forbes” contributor.

Rochelle Mattern, a Google Cloud customer engineer at Google.

Gareth Rushgrove, a director of product management at Snyk

The New Stack Publisher Alex Williams hosted this episode.

Welcome to The New Stack Context, a podcast where we discuss the latest news and perspectives in the world of cloud native computing. This week we have two guests, who discuss their experience with the challenges of securing open source software.

First, we talk to Frank Nagle, a professor at Harvard Business School and co-director of the Census II project to assess security practices in open source software components, in partnership with the The Linux Foundation’s Core Infrastructure Initiative (CII). We discuss his findings, including the surprising state of under-management for most open source projects.

We also chat with Neeraj Poddar, Aspen Mesh co-founder and engineering lead who developed the fix for a recent vulnerability in the Istio service mesh project. We speak with Poddar about the challenges of quickly fixing an bug in an open source program when there are so many stakeholders, and how the work should be cordoned off until a public announcement is ready to be made.

Time series data management continues to underpin huge swaths of application deployments today across on premises, and increasingly, cloud native environments. Whether it’s video streaming, real-time financial security data management, energy utility management or any application that requires time stamps for often very complex datasets at massive scales, time series data will play an integral role. Today’s time series data platforms can typically be used for data analysis and forecasting by processing millions of data points per second.

Pricing has also become affordable for a growing number of enterprises seeking high-powered data analysis as a way to distinguish themselves from the competition. These organizations also do not necessarily have the financial backing that the world’s largest financial institutions or Fortune 100 companies have at their disposal.

In this The New Stack Makers podcast, Chris Churilo, responsible for technical product marketing at InfluxData, offer some background and perspective on why organizations increasingly rely on time series databases to “make products or services better.” Churilo also discussed why organizations are shifting their databases and management to cloud environments and why InfluxData recently extended to its InfluxDB Cloud 2.0 serverless time-series Platform as a Service (PaaS) to include Google Cloud Platform (GCP) as well as Amazon Web Services (AWS) cloud environments.

“Time series data is useful for monitoring anything that you want to make improvements on,” Churilo said. “So, of course, your cloud infrastructure is one thing that you definitely want to always be monitoring to make sure that you can provide the best service, especially if you have applications sitting on top of it that are customer-facing or even internally-facing — no one can tolerate having a slow application.”

Read more here:

https://thenewstack.io/get-better-monitoring-with-a-time-series-database/

Prisma, from Palo Alto Networks, sponsored this podcast, following its Cloud Native Security Live, 2020 Virtual Summit held Feb. 11, 2020: http://bit.ly/39OjW11

The traditional role of the IT security professionals in the past largely involved drafting and implementing policies and best practices, as well as managing security-vulnerability detection and remediation. Interaction with developers was usually relegated to the post-deployment stages of software development.

But in this new age of DevOps, security practices have evolved, especially for cloud native security. Many of the differences can be attributed to how software development underpins DevOps processes. Consequently, security team members have become more development-focused and should play a role throughout the entire production pipeline (think of it as part of a shift to the left in CI/CD).

In this edition of The New Stack Makers podcast recorded live at Palo Alto Networks’ studio in Santa Clara, CA, how security practices have evolved and changed are discussed. The guests were:

Ben Bernstein, senior vice president of product and engineering at Palo Alto Networks.

Matt Chiodi, chief security officer of Public Cloud at Palo Alto Networks.

Xiaobo Long, senior vice president of cloud security at Citibank.

In many ways, the evolution of the role of the security professional for cloud native environments is part of the change. In that respect, security, as well as DevOps, is about culture, and thus, people.

“The DevOps movement enabled not just a digital transformation on the business side,” but digital transformation also “transformed the processes and the things that people do to deploy software and to build software. New programming languages that were previously dictated by the company are now available to everyone,” Bernstein said. “So, it’s all about the people and giving them the ability to choose the best tools for themselves and security has traditionally not been that way. And what you can see is that for us as a security company, it’s very important to empower the people to not only make the right security decision but also give them a set of a wide range of capabilities to pick and choose what they think is most important.”

Welcome to The New Stack Context, a podcast where we discuss the latest news and perspectives in the world of cloud native computing. Today we’re talking to The New Stack news correspondent Mike Melanson, about his recent coverage of the ongoing debate over the value of microservices. We also discuss the top podcasts and news stories for the week, covering topics such as developer relations, mobile platform development and optimization, and distributed architectures.

We have been covering the debate over the relative merits of microservices for a while now. Microservices offer a number of advantages on the development side. Separate teams can work different parts of a language, even in their preferred languages and tools. Updates can be quietly inserted without needing to refresh the entire application. But while the hype around microservices is considerable, industry observers have been starting to recognize the limitations as well. Many have been advocated returning to the opposite approach: building single large “monolithic” applications.

Recently, Melanson wrote about Google cloud native evangelist Kelsey Hightower’s belief that monoliths are the future.

“Monoliths are the future because the problem people are trying to solve with microservices doesn’t really line up with reality,” Hightower wrote in his own blog post. A company lacking coding discipline that ends up with a disaster of a codebase may see microservices as an answer, but in reality, it is just trading class instantiation for function calls. “They’re initiating things and throwing it over a network and hoping that it comes back,” Hightower writes.

In this episode of The New Stack Analysts podcast, we explore how two Kubernetes Special Interest Groups (SIG) are taking into account all of the various user personas in order to help shape the user experience on Kubernetes. Guests on this episode include:

Tasha Drew, co-chair of the Kubernetes Usability SIG and a product line manager for Kubernetes and Project Pacific at VMware.

Lei Zhang, co-chair of the Kubernetes Application Delivery SIG and a staff engineer at Alibaba.

Emily Omier, The New Stack correspondent and a content strategist for cloud native companies.

In this podcast, we ask Brock about the changes she has seen in the U.K., post-Brexit, as well as the open source culture in the country, and what can be done to bring more visibility to the vast pools of developer talent that the country possesses.

Then later in the show, we discuss the top topics on the site for the week, including the need to improve user interfaces, Bruce Perens’ departure from the Open Source Initiative, a new World Wide Web Consortium standard that will help distributed tracing, and the surprising utility of the humble Unix awk command.