December 2018 Summaries

Data breaches are costly for enterprises, and a significant portion of cybercrime is due to compromised passwords and insider attacks. To enhance security, JFrog has introduced a feature that increases the protection of database connection passwords used by JFrog Artifactory, Xray, and Distribution. This new mechanism involves storing sensitive information, such as database connection strings, in a temporary configuration file that is deleted after use, ensuring that credentials are not accessible to attackers. The feature demands that companies securely store these configuration files offline since they are necessary for starting new instances of the services. This security measure requires diligence in managing the temporary files, especially when using platforms like Kubernetes, where services may need to be manually restarted. The overall message encourages organizations to prioritize data security as a New Year's resolution to safeguard against cybercrime.

By 2020, data accumulation is expected to equal the number of stars in the universe, with DevOps playing a crucial role in managing this influx through automation and CI/CD processes, which enhance agility and application deployment. With a significant majority of organizations implementing DevOps, its impact is evident in emerging applications like IoT and smart vehicles, as these sectors are projected to grow substantially. Future DevOps trends include the integration of AI to streamline testing and predict software behavior, 5G technology's potential to revolutionize IoT connectivity and update frequency, low-code tools to simplify pipeline creation, and the advent of DataOps to manage data-driven applications. These trends underscore a shift towards a Liquid Software paradigm, where continuous updates become the norm, promising transformative advancements in the DevOps landscape.

The JFrog Visual Studio extension facilitates seamless integration with JFrog tools within the Visual Studio environment, providing developers with essential insights into licenses and security vulnerabilities detected by JFrog Xray in NuGet packages. This extension enables on-the-spot notifications about security vulnerabilities directly within the IDE, displaying detailed information in a dedicated panel as soon as the code is built. It is a free tool that requires JFrog Xray version 2.5.0 or above, and can be easily installed via the Visual Studio environment under Tools > Extensions and Updates, by searching for "JFrog."

Creating serverless applications involves packaging serverless functions with direct and runtime dependencies into a chosen Function as a Service (FaaS) platform. Currently, the lack of a common standard for function packaging leads to vendor-specific lock-in, hindering function portability across different platforms. The article advocates for an open, extensible "Function Package" standard that separates function code and direct dependencies from runtime-specific configurations, allowing functions to be reused across multiple serverless environments with only the necessary external configurations added at installation. The proposal highlights the advantages of container runtimes and custom function runtimes while noting the high coupling between functions and runtime environments in existing models. By creating language-specific profiles and leveraging stable dependency references, this approach aims to enable repeatable, efficient deployments and reduce cloud-vendor dependency, allowing developers to focus more on application logic rather than operational details.

Java 11 licensing has caused confusion in the market, with Oracle offering two main options for obtaining the Java Development Kit (JDK): the Oracle JDK and the OpenJDK, both built from the same code base but differing primarily in support contracts. The OpenJDK is open-source and now essentially identical to the Oracle JDK, having adopted many features once exclusive to the commercial version, while licensing under GPLv2 with a classpath exception eases some common concerns about GPL's "copy-left" nature. Alternatives to Oracle's JDK exist, with companies like IBM providing extended support for certain Java versions, and JFrog, which uses Java in its products like JFrog Artifactory, transitioning to OpenJDK as Java 8 approaches its end of life. Users are encouraged to consult their legal teams regarding compliance and licensing details, and Oracle provides extensive resources on the subject for further information.