August 2023 Summaries

Software composition analysis (SCA) and supply chain security play crucial roles in ensuring the safety of software by identifying vulnerabilities in third-party components and securing the entire software development process, respectively. While SCA focuses on detecting risks within dependencies, supply chain security encompasses broader aspects including version control, CI/CD systems, and Integrated Development Environments (IDEs), aiming to protect every stage of software creation. Implementing a secure system development life cycle (S-SDLC), which integrates security activities at each phase, is essential for releasing secure software consistently. The text underscores the importance of habitual security practices within the software industry, advocating for comprehensive protection measures such as default identity and access management (IAM) settings and regular code vulnerability scans. Highlighting the innovative approach of Semgrep, which assesses the 'reachability' of vulnerabilities in applications, it encourages prioritizing fixes for exploitable risks. The writer also emphasizes the significance of regularly checking in code to source control to prevent costly losses and invites readers to engage with resources like the Semgrep community for further learning and collaboration.

Michael Hoffmann, a Site Reliability Engineer at Aiven, discusses the challenges of writing effective PromQL expressions for Prometheus, a widely-used monitoring system. Hoffmann highlights common pitfalls such as forgetting to specify certain labels like tenant_id, which can alter alert meanings, and the confusion between matrix selectors and subqueries, which can cause unexpected issues. To address these challenges, Hoffmann introduces Semgrep, a static analysis tool that now supports PromQL, allowing users to write syntax-resembling patterns to detect errors automatically. By defining specific rules in Semgrep, users can catch common mistakes in PromQL expressions, enhancing the reliability of monitoring setups. The tool's integration into CI processes ensures continuous detection of such issues, and while PromQL support in Semgrep is still experimental, Hoffmann invites the community for feedback and collaboration to improve its functionality.

We Hack Purple, an initiative founded to simplify access to application security knowledge and increase the number of AppSec professionals, has successfully graduated hundreds of new experts and built a thriving community of over 8,000 members since its inception in February 2020. Facing a pivotal decision between seeking venture capital or maintaining a small, community-focused approach, the founder chose to remain independent, allowing for more personalized service and support for other initiatives. A transformative opportunity arose when the founder's friend introduced the idea of merging with Semgrep, a company celebrated for its innovative AppSec tools and shared community values. This merger allows We Hack Purple to provide free training and expand its educational reach without the burdens of running a company, with the founder taking on the role of Head of Community & Education at Semgrep. The merger promises an enriched community experience with increased events, content, and training, inviting members to engage with the growing secure coding community.