Trusting Your Ingredients - What Building Software And Cheesecake Have In Common

Trusting Your Ingredients
What Building Software And Cheesecake Have
In Common

27Number of ingredients in
this cake mix
Let’s talk about numbers!
@LeonStigter | Copyright © 2019 JFrog. All Rights Reserved

176Safety violations in
imported food to Japan in
2016
https://www.statista.com/statistics/797574/japan-imported-foods-safety-violations-standards-hazardous-substances-by-country/

976Number of packages installed
for @angular/cli

For three years in a row more than one billion
records have been exposed in the first quarter of
the year

• Developer Advocate
• Passionate about Serverless,
Containers, and all things
Cloud
• I love dadjokes, cheesecake
and APIs
Who am i?
@LeonStigter
Leon Stigter, Developer Advocate

Petyr the
Pastry Chef
Arya the
App Dev
Introducing our main characters

• Ingredients
• Recipe
• Kitchen stuff
(whisk, bowl,
spatula)
• Appliances
(oven, fridge)
• Fork
Making a cheesecake

• Ingredients
• Recipe
• Kitchen stuff
(whisk, bowl,
spatula)
• Appliances
(oven, fridge)
• Fork
• Libraries (Jars,
Modules, Gems…)
• Source code
• Dev tools (editor,
cli tools, vcs)
• Build tools (CI/CD
server)
• Runtime (K8s)
Building an app

Let’s start with ingredients

Will subpar ingredients
get me the best
cheesecake?
The best ingredients for the best cheesecake

Where do the vendors I
use get the ingredients
from?
Where do I get my ingredients from?

End-to-End
transparency
TRUST
Traceability
What matters for ingredients?

Where do my ingredients come from?

Trust, but verify…
Do you trust your colleagues?
I hope the answer is yes

Trust is built with consistency
Do you trust the rest of the world?

98%
of developers use
Open Source tools
at work
96%
of commercial
apps embed Open
Source
79%
of businesses use
Open Source for
key systems

3407 Number of security
vulnerabilities discovered and
reported in 2019
https://www.cvedetails.com/vulnerability-list/year-2019/vulnerabilities.html

I think it is safe to say that…
Having trust in where your ingredients come from
and who made them is important in both making
cheesecake and software

Let’s look at transparency

Kitchen brand
NEFF questioned
1,500 Brits
Only 7% thinks
it’s important to
follow recipes
Following the recipe, but add a little of yourself

Protecting your recipes

35 licenses
• 13 require you to publish
product sources
• 4 allow users to ask for
sources on hosted software
Open source licenses
Source: https://choosealicense.com/appendix/

Source code
Recipes in software
Developers programming in
DevSecOps environments
fix 11x faster than other
developers

Common faults
• Input Validation
• Memory Corruption
• Numeric Errors
• Cryptographic Issues
But what about
• Hardcoded Passwords,
• Missing Validation
• Backdoors
• Data Anomalies
Recipes in software: things to watch for

Choosing the right equipment

Providing visibility into your process
SECURITY
The philosophy of integrating security practices within the
DevOps process. #SecurityFirst culture!
How? Introducing security earlier in the life cycle of application
development

Tool selection
77%of developers have a say in which
tools their company uses
Source: State of the Developer Nation Q3’17

• DevSecOps aims to embed
security in every part of the
application lifecycle – run
time, build time and even
development time.
• It means developing more
secure applications faster
refusing to accept that the
two (secure & fast) are
mutually exclusive!
Shifting left…

Providing visibility into your process

Immutability and repeatability
The best way to guarantee issues is force push
Immutable dependencies
Who doesn’t remember left-pad with Node.js?
Lost Dependencies
Do you trust your suppliers enough?
Internet Issues

Making your cheesecake and having it too

Buildtime, Runtime, and real-time security

• Ingredients
• Recipe
• Kitchen stuff
(whisk, bowl,
spatula)
• Appliances
(oven, fridge)
• Fork
• Libraries (Jars,
Modules, Gems…)
• Source code
• Dev tools (editor,
cli tools, vcs)
• Build tools (CI/CD
server)
• Runtime (K8s)
recap

Trusting your
ingredients
Trusting your
suppliers
Transparency
in your
process
recap

Thank you!
Questions?

Trusting Your Ingredients - What Building Software And Cheesecake Have In Common

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Mehr von Leon Stigter

Mehr von Leon Stigter (14)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Trusting Your Ingredients - What Building Software And Cheesecake Have In Common