New CloudBees boss Stephen DeWitt wants to up the SaaS factor, wouldn't say no to IPO

Jenkins, an open-source automation server for continuous integration and delivery (CI/CD), has published 34 security advisories covering 25 plugins used to extend the software.

Eleven of the advisories are rated high severity, 14 are medium, and 9 are said to be low.

The vulnerabilities described include: cross-site scripting (XSS); passwords, API keys, secrets, and tokens stored in plaintext; cross-site request forgery (CSRF); and missing and incorrect permission checks.

GitLab believes the world is in the midst of a "generational disruption" where all companies will need to embrace modern software development practices, and reckons it can take advantage by positioning itself as the enterprise-grade alternative to homegrown DevOps point solutions.

In a bullish Q1 2023 earnings conference call, GitLab co-founder and CEO Sytse "Sid" Sijbrandij said the business need for digital transformations remains strong despite uncertain economic conditions. He added that GiLab believes all companies are becoming software-driven businesses and this will require an increasing number to build modern software development practices.

"In a world where software defines a speed of innovation, we believe every company has to become great at developing, securing and operating software to remain competitive," Sijbrandij said.

Kubernetes, despite being widely regarded as an important technology by IT leaders, continues to pose problems for those deploying it. And the problem, apparently, is us.

The open source container orchestration software, being used or evaluated by 96 per cent of organizations surveyed [PDF] last year by the Cloud Native Computing Foundation, has a reputation for complexity.

Witness the sarcasm: "Kubernetes is so easy to use that a company devoted solely to troubleshooting issues with it has raised $67 million," quipped Corey Quinn, chief cloud economist at IT consultancy The Duckbill Group, in a Twitter post on Monday referencing investment in a startup called Komodor. And the consequences of the software's complication can be seen in the difficulties reported by those using it.

By 2025, half of analytics will be developed by business users via a low-code or no-code modular assembly experience, according to Gartner.

Presenting its vision for trends in data and analytics, the global analyst said the future would put business users, rather than IT or data engineering, in the driving seat, at least in terms of applications.

GitHub has announced that it will require two factor authentication for users who contribute code on its service.

"The software supply chain starts with the developer," wrote GitHub chief security officer Mike Hanley on the company blog. "Developer accounts are frequent targets for social engineering and account takeover, and protecting developers from these types of attacks is the first and most critical step toward securing the supply chain."

Readers will doubtless recall that attacks on development supply chains have recently proven extremely nasty. Exhibit A: the Russian operatives that slipped malware into SolarWinds' Orion monitoring tool. That malware made it into over 18,000 companies, around 100 of which were infected and attacked. GitHub has also had its own problems, such as when access to npm was compromised.

Perforce, a Minnesota-based maker of DevOps software, on Monday announced the acquisition of Puppet, an Oregon-based maker of configuration management tools, for an undisclosed sum.

Puppet had been planning to go public in 2021 and announced management additions to help that happen in November, 2020. Ending up within the embrace of Perforce looks like Plan B, though CEO Yvonne Wassenaar in a rambling blog post makes the detour sound as if it had always been the destination.

"What began as a journey to address our customers' needs through increased investment in Puppet has emerged as a compelling opportunity to join forces with Perforce Software," Wassenaar wrote.

Puppet has emitted its seventh annual DevOps salary report, and there is good news: the gender wage gap appears to be narrowing.

The DevOps automation outfit surveyed over 2,600 technology pros and found that as well as some significant growth in the high-income wage brackets, women were also increasingly stepping into those well-paid positions.

Updated DevOps outfit CircleCI is suffering from performance issues that have been ongoing for most of the day, with developers left waiting for the platform to come back online.

The service keeps an eye on the likes of GitHub and Bitbucket and fires off a build when commits are made. It then tests builds and pings out notifications if things go wrong. The platform also features a managed cloud service.

However, today things went a bit awry. CircleCI described the issue as "degraded performance," which had begun with "database read/write delays." Meanwhile, over on Twitter, the firm promoted a Lego raffle as users became increasingly antsy.

Celonis has bought Process Analytics Factory (PAF), a firm that integrates its technology with Microsoft's Power BI platform, in a deal said to be worth $100m.

The two German companies claim the merger will help users on Microsoft's popular Power Platform benefit from output data from Celonis's process mining, automation, and collaboration tech.

Process mining is the analysis of application logs to figure out how people actually run processes across multiple applications – as opposed to how management think they run or how they were designed to run. The argument goes that a detailed understanding of processes is a vital element of application strategy and underpins modernization and workarounds like robotic process automation.

Enterprises need to create a more strategic alliance between their application security and cybersecurity teams if they are going to better protect themselves against cyberthreats.

Organizations can no longer wait for attacks to happen and then respond, according to Sean Wright, principal application security SME at Immersive Labs, creators of an enterprise platform that measures the cyber capabilities of their workforce. Instead, they need to embrace the shift-left mantra that calls for more security-related tasks – with testing being a big one – being performed earlier in the software development process, essentially weeding out potential flaws and vulnerabilities before they're compromised by attackers.

The end result should be to reduce the risk to the organization, Wright told The Register.