I have archived this account after the new management changes that are very unpleasant.

Please find me somewhere else through my blog👇, @Rob_Bos@mstdn.social or LinkedIn: LinkedIn.com/in/bosrob

Very insightful post on attacking Source Control Management systems (SCM)!

medium.com/boostsecurity/…

Interesting read!
medium.com/bondora-engine…

The GitHub Silverware Drawer Dilemma, Or: Finding Active Repository Forks | Hackaday hackaday.com/2023/01/08/the…

I scanned every package on PyPi and found 57 live AWS keys tomforb.es/i-scanned-ever…

Devs urged to rotate secrets after CircleCI suffers security breach | The Daily Swig portswigger.net/daily-swig/dev…

10 software supply chain attacks you can learn from reversinglabs.com/blog/10-supply…

My best viewed blogposts created in 2022: Number 1 devopsjournal.io/blog/2022/01/0…

Explaining the different types of GitHub Access Tokens you can use to get access to GitHub

My top blogposts created in 2022: Number 2 devopsjournal.io/blog/2022/08/1…

Only created in August, but now my best viewed post on a monthly basis! Six reasons of why you workflow did not start and how to check them!

My top blogposts created in 2022: Number 3 devopsjournal.io/blog/2022/03/1…

About a much asked for approach to cleanup the notifications on GitHub

My top blogposts created in 2022: Number 4 devopsjournal.io/blog/2022/09/1…

About scanning the entire! GitHub Actions Marketplace for security issues in their dependencies!

My top blogposts created in 2022: Number 5 devopsjournal.io/blog/2022/01/1…

About detecting usage of the camera in Windows and triggering my Home Automation setup for that!

My top blogposts created in 2022: Number 6: devopsjournal.io/blog/2022/06/0…

My take on how I create a GitHub Action and where I start.

My top blogposts created in 2022: Number 7: Configuration as Code for the GitHub platform. There are lots of posts talking about this, but few with an actual implementation. I create one for inviting users and creating repos for them.

Read it here:
devopsjournal.io/blog/2022/03/1…

Finding the next Log4j – OpenSSF’s Brian Behlendorf on pivoting to a ‘risk-centred view’ of open source development. portswigger.net/daily-swig/fin…

So... I have enabled actionlint on 3 repos today, and fixed 2 workflows that had vulnerabilities or errors in them. And I am educating people on using GitHub Actions in a safe way for a couple of years now!

ActionLint: github.com/rhysd/actionli…

#BeSaferPeople #DevOps #GitHub

New blogpost! Adding the OSSF scorecard action to your repository:
devopsjournal.io/blog/2022/12/0…

This can help you improve the security in your repository, with actionable alerts (and super easy fixes for some!).

.NET 7 Networking Improvements devblogs.microsoft.com/dotnet/dotnet-…

These numbers are scary! (On the other hand: I will always have a job!).

Culture a Stumbling Block to DevOps, DevSecOps devops-com.cdn.ampproject.org/c/s/devops.com…

Dependabot now supports security updates for Dart and Flutter apps that use Pub packages github.blog/changelog/2022…