May 2020 Summaries

At Snyk, they recognize the importance of addressing the lack of women in tech and have implemented various initiatives to create a positive working environment for women, including flexible working policies that allow employees to balance work and personal life, career growth opportunities that encourage employees to take on new challenges, and a commitment to diversity and inclusion that fosters an open and transparent culture where everyone's opinions are valued. By promoting from within and providing learning budgets, they aim to retain and cultivate a happier workforce. Their efforts have had a positive impact on team members, who appreciate the flexibility, autonomy, and sense of belonging that comes with working at Snyk.

The Security Research Team at Snyk plays a crucial role in ensuring open source security, gathering and cultivating the Snyk Intel Vulnerability Database that powers scans and provides users with accurate and actionable information on vulnerabilities. The team employs various methods to stay up-to-date with community-powered databases, unstructured databases and advisories, and unpublished vulnerabilities. They also work closely with independent researchers, security personnel, and academic communities to disclose vulnerabilities. Additionally, the team conducts proprietary research to discover and responsibly disclose new vulnerabilities in the open source ecosystem, analyzing trends and identifying key characteristics of vulnerabilities. This hard work enables Snyk users to achieve four critical goals: timeliness, completeness, accuracy, and actionable information, giving them a dedicated team of security experts on their side to keep themselves and the rest of open source safe.

Using a version manager like tfenv makes it easier to manage multiple Terraform versions locally, allowing for quick switching between projects and ensuring the development environment is as close to production as possible. Explicitly setting required Terraform versions helps prevent issues caused by running the wrong version on specific machines, providing a clean error when trying to run an `apply` command with the incorrect environment. Setting module versions makes it easier to control changes to infrastructure components and enables progressive rollouts of module upgrades. Preventing local `apply` commands and encouraging a pull-request review process helps maintain a safer workflow, while securing Terraform code using tools like Snyk IaC can detect misconfigurations and provide guided fixes to prevent damage from breaches. Additionally, automating IaC security and compliance in workflows with Snyk can help protect infrastructure from the source.

Snyk has added support for Azure Repos Server, allowing developers to identify and fix security vulnerabilities and license issues in open source dependencies. The new integration complements existing Snyk integrations with the Microsoft Azure ecosystem, including Azure Pipelines, Azure Container Registry, and Azure Functions, enabling users to implement end-to-end DevSecOps across their software development lifecycle. With this integration, developers can detect existing vulnerabilities, prevent new ones from being introduced, fix identified issues, and continuously monitor for new vulnerabilities in their projects managed in Azure Repos Server. The integration is available for Snyk Pro and Enterprise plans and supports TFS v2018 Update 2 and above.

The Terraform state file is a JSON structure that represents the desired state of an infrastructure, working together with the Terraform code to declare this state. This state is declarative, meaning it describes what the user wants to achieve, and Terraform applies this to the cloud provider's API to spawn resources. The state file serves as a mirror of the last successful apply of the code, reflecting the reality of the deployment on the cloud provider's side. It can be stored in various locations, such as Amazon S3 buckets or Azure storage, with best practices including sharing it securely and using a lock file to prevent concurrent destructive actions. Terraform also provides a way to secure its code through tools like Snyk, which secures configurations as you code, tests for changes, and automates testing in build pipelines.

Mitigating clickjacking is a security issue where an attacker tricks users into clicking on malicious websites by embedding them inside iframes, but it can be easily prevented by setting the x-frame-options header in browser headers. To identify vulnerable endpoints, tools like OWASP AMASS and Security Headers Checker are used to scan for missing security headers, including x-frame-options. These tools can help automate the process of finding and fixing vulnerable endpoints, ensuring that all endpoints have the necessary security headers to prevent clickjacking attacks. The importance of having a bug bounty program and testing reproducing the issue to ensure it won't happen again is also highlighted in this case study.

Managing drift from manual changes in Terraform can be challenging, but there are different ways to handle it depending on the case. One option is to manually update the Terraform code to reflect the changes, which can be done by writing the missing code and pushing it, then applying it and letting the delta disappear. Another approach is to use a tool like Terraformer or Terraforming to reverse-terraform the new environment, creating valid Terraform code and a TFState file from scratch. Alternatively, specific parts of the new code can be imported using the Terraform import subcommand to ensure precision and control over what is added to the existing infrastructure repository. Ultimately, the recommended approach depends on the situation, with small changes handled automatically through reconciliation with the state file, while more complex cases require manual intervention or tool-assisted reverse-terraform.

Java has officially turned 25 years old, marking a quarter century since its release in 1995 by Sun Microsystems. Despite criticisms that it's old and outdated, Java remains one of the most popular languages, with other notable languages like JavaScript and Python also around the same age. The Java ecosystem, including the JVM and various languages such as Scala and Kotlin, continues to evolve rapidly, with new features and fixes emerging at a fast pace. The community behind Java is large and active, supporting distributions of the JDK and maintaining open-source libraries. However, developers often struggle to keep up with these changes, leading to outdated dependencies that can expose them to vulnerabilities. Nevertheless, Java's evolution and maturation are undeniable, making it a vibrant language that will likely continue to thrive in the future.

The Java Stream API provides an expressive and efficient way to perform basic operations such as summing a list of numbers, similar to the traditional loop-based approach or using the collect function with a reducing collector like `Collectors.summingInt()`. The stream API's `mapToInt()` function can also be used in combination with the `sum()` method to achieve this. Another option is to use the `reduce()` function, which takes a starting point and applies a BiFunction lambda expression to each element in the list. While there are multiple ways to solve this problem, the stream API's approach is often considered the most expressive and pure solution in Java.

The importance of mental health awareness in the workplace cannot be overstated, particularly for managers who want to build high-performance teams. The startup world's fast-paced nature can lead to burnout, procrastination, and imposter syndrome among team members. Managers must prioritize good mental health hygiene practices, recognizing signs of burnout early and encouraging their team to do the same. By doing so, they can help prevent these issues, foster a culture of kindness, and support their team's overall well-being.

Snyk has integrated its website security scanner with WebPageTest, providing a free security score for websites that run a speed test and performance metrics through this integration. The security score is calculated based on the presence of vulnerable JavaScript libraries and missing or recommended HTTP security headers, with scores ranging from A+ to F depending on the severity of the issues found. The Snyk website scanner assesses website security by checking for specific HTTP security headers and detecting vulnerabilities in JavaScript libraries, providing detailed results that help developers identify areas for improvement.

I've been thinking a lot about my own mental health lately, feeling privileged but also struggling with anxiety, sleeplessness, and demotivation amidst the COVID-19 pandemic. I recognize that I'm not alone in this struggle, as many people face similar challenges due to health anxieties, family worries, homeschooling, isolation, economic uncertainties, job losses, and role changes. As a result, it's essential for individuals to take a moment to step back, recharge, and prioritize their mental wellness. In fact, Snyk is taking this approach by declaring a Mental Health Day, where the company will shut down to provide disconnection and respite from daily pressures and digital interfaces.