September 2018 Summaries

In the episode of "Exception Perceptions", GitHub Community Engineer Bex Warner discussed Probot, a framework for automating tasks on GitHub. Probot is a wrapper for GitHub Apps and can simplify software development workflows by handling repeated tasks. It works by listening to webhooks events like opening an issue or moving a project card, and then taking action via GitHub's REST and GraphQL APIs. Probot abstracts away the authentication process involved in using GitHub Apps. An example of a simple Probot app is adding a label 'needs-response' to every new issue that gets opened. The code for this involves listening on webhook events, finding out required information from GitHub Developer docs and v3 REST docs, and then making the API call using Probot's internal APIs.

To prevent cross-site scripting (XSS) and other code injection attacks, Content Security Policy (CSP) can be used by defining rules for what content is allowed from safe sources. By configuring web servers to return the Content-Security-Policy HTTP header with specific directives, such as `connect-src`, malicious requests like the one that led to the Newegg breach could have been blocked, preventing the capture of sensitive payment data. Implementing CSP can also help in detecting and responding to security incidents by sending reports to tools like Sentry, which can provide insights into potential vulnerabilities and alert administrators to suspicious activity.

The Sentry Unified SDK Updates provide a unified experience across all platforms, including Python, JavaScript, .NET, and Rust. The updates aim to make the SDKs more flexible by introducing a single way to bind data like tags, users, or contexts, which can be reconfigured using `configureScope`. This allows for powerful hints and hooks, such as before-breadcrumb and before-send callbacks, to modify strip data, discard entire breadcrumbs and events, and add additional information. The new SDKs are now live, and Sentry recommends that existing users upgrade to take advantage of the new features and improvements. The updates also introduce a unified API for easier integration across platforms.

Sentry is integrating with Microsoft Azure DevOps to provide enhanced release tracking, informative deploy emails, and assignee suggestions for new errors. The integration allows developers to unlock features such as route alerts to the right person based on the commit that caused the issue, cutting remediation time to five minutes. Sentry integrates with Azure DevOps to include issue tracking, continuous deployment automation, support for suspect commits, releases feature, and easy sign-on. The integration also enables users to create new Azure DevOps work items directly from Sentry issues, eliminating duplicate work and out-of-sync information. Additionally, the integration allows users to log into Sentry via their Azure DevOps account, making the onboarding process faster.

Sentry has updated its integration with GitHub and GitHub Enterprise, adding support for Releases feature, new permissioning options, and improved login and organization-wide setup features. The updates aim to help users save time, squash bugs, and work more efficiently through the development workflow, particularly for GitHub Enterprise customers. Sentry's releases now unlock a broader experience for users who previously had limited use of the tool, offering features such as resolving issues via commit in the command line and identifying suspect commits that likely introduced errors. The new sign-on functionality allows users to log into Sentry using their existing GitHub credentials, reducing setup time and minimizing dependencies on usernames and passwords lists.

Sentry is enhancing its integration with Atlassian's Jira and Bitbucket platforms by introducing two-way sync, org-level settings, and improved core functionality such as creating or linking to existing Jira issues directly from Sentry. These updates aim to increase observability into applications and reduce setup time for developers using both products in their workflow. The new integrations also enable team members to track projects on the development layer in real-time using their preferred interface, saving time and overhead costs. Additionally, users can apply settings for Sentry's Jira integration at an organizational level, eliminating the need to duplicate efforts configuring rules multiple times for various projects.

Welcome Hannah Katz` Sentry - Join us in welcoming Hannah to the team. She went to RISD for illustration and her background is mostly in games, more recently for Family Guy and Futurama. She came to the Bay Area just several days after graduating with the hopes of finding a job in art, and made her start working on mobile bingo games with lots of cats in them. Hannah will be working on illustration and sarcastic banter in her role at Sentry. In her free time, she enjoys drawing around Lake Merritt, dancing, and trying to sketch while eating. She is passionate about art, comics, cartoons, and finding good food deals.

Sentry has released new integrations with several tools, including GitHub, Jira, Bitbucket, Azure DevOps, and GitHub Enterprise, focusing on two-way sync, Suspect Commits feature enhancements, login simplification, and organization-wide setup. The updates aim to provide a more holistic view of projects, streamline workflows, and reduce duplicate work across platforms. Two-way sync ensures key information remains synced between Sentry and these apps, while Suspect Commits ties errors to specific commits, suggesting the problematic commit's author as the issue owner. Organization-wide setup allows for configuration of settings at an organization level, reducing repetitive setup on a per-project basis. These updates are available to customers on certain plans, with some features currently only available to early adopters.

There are nearly two billion websites live at this very moment, exposing data to potential theft and malware distribution. The Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting and other code injection attacks by enforcing browser vendors' policies. Sentry supports capturing CSP violations using the standard reporting hooks, allowing users to integrate their project with the system and receive notifications when new or spike violations occur. To start, web servers should be configured to return the Content-Security-Policy HTTP header with a policy that states from which origins to permit content. The policy can then be customized to only allow certain types of content from safe sources.