I work with #FOSS IPR and licence check sometimes. Now, that #BlackDuck utilizes #AI extensively for assessing the open-source dependencies, the reliability of its reports dropped to be zero.

It hallucinates random Java, Python, RPM and other stuff as being your #go code's dependencies. 🤪 Also, you can get a random unmaintained helloworld repo as a project "you derived yours from" or an "unmarked dependency" because it is nothing but a single go file, two lock files and a README.md and your project happens to have last three out of that four making 75% mach. 🤦 Yes, the content is different, you may have 172 other files, but these 3 matches cannot be a coincidence...

https://chinstrap.community/is-it-a-liability-or-is-it-an-asset-and-a-coss-opportunity/

#blackduck #coss #cybersecurity #opensource #oss #ossra

Here's my latest article on Medium titled "Why You Need To Bake Security Into Your CI/CD Pipelines".

I hope you find it interesting! :)

#blackduck
#cicd
#cyberark
#dast
#devops
#devsecops
#github
#hashicorp #hashicorpvault
#iac
#mendio
#sast
#sca
#terraform
#vault
#vcs

https://medium.com/devops-by-nature/why-you-need-to-bake-security-into-your-ci-cd-pipelines-7c53a32d5c4d?sk=fe8f572583f8d49f192cf84644686db3

Slightly sweary rant on the worst thing I ever had to do as a software engineer: manually auditing and confirming the licences of 2500+ npm packages. …

Four Months of Software Licensing Hell https://aceade.net/2025/02/02/four-months-of-software-licensing-hell/

This is why I hate JavaScript development.

#BlackDuck #burnout #JavaScript #npm #SoftwareDevelopment #SoftwareLicencing #venting