PERL,INGRES,PROGRAMMING

  RAMPART and Clarity are frameworks designed by Microsoft to evaluate the safety and security of agentic AI applications. RAMPART (Risk Assessment & Measurement Platform for Agentic Red Teaming), is built on top of Microsoft's PyRIT (Python Risk Identification Tool) primitives. Rather than treating AI safety as a one-time post-build review, it allows developers to write safety and security tests as repeatable code th https://www.i-programmer.info/news/105-artificial-intelligence/19001-rampart-and-clarity-secure-your-ai-agents.html

  Bumblebee is an open-source security tool developed by Perplexity AI to identify software supply chain vulnerabilities on developer workstations. https://www.i-programmer.info/news/90-tools/18945-perplexity-releases-the-bumblebee-supply-chain-security-scanner.html

  Vercel has launched Deepsec, an open-source security tool designed to find complex vulnerabilities in large codebases using autonomous AI agents. https://www.i-programmer.info/news/90-tools/18936-vercels-deepsec-scans-your-code-with-agentic-ai.html

  By using the expressiveness of the SQL language, TailPipe makes querying log files as easy as doing "select * from logs;". In  Steampipe - SQL For Everything  we discovered a tool that renders SQL as the main query language for more than purely databases, cloud infrastructure included. Steampipe's underlying notion is that SQL has been the data access standard for decades, it levels the playing field, easily integrates with other systems and accelerates delivery. So why not leverage it for things other than the database, like querying APIs and Cloud services? Tailpipe follows along the same lines, this time by enabling SQL to query log files.  https://www.i-programmer.info/news/90-tools/17992-tailpipe-the-log-interrogation-game-changer.html

  The Open Source Project Security Baseline, or OSPS Baseline for short, is a new initiative by OpenSSF in an attempt to bolster the security posture of open source software projects. https://www.i-programmer.info/news/136-open-source/17982-why-openssfs-baseline-security-for-open-source-projects-is-important.html

  Vanir is a new security patch validation tool made available for Android by the Google Open Source Security Team. In a sentence: Vanir gives Android platform developers the power to quickly and efficiently scan their custom platform code for missing security patches and identify applicable available patches. https://www.i-programmer.info/news/149-security/17802-patch-android-vulnerabilities-with-googles-vanir.html

  The talks from APISEC|CON, the largest event dedicated to API security, are now available up on Youtube, for free. The virtual event covered AI and LLM security, defending APIs, API sprawl, governance, testing, shift left, authentication attacks...it's all there. https://www.i-programmer.info/news/149-security/17327-apisec-conference-sessions-now-available-online-.html#google_vignette

 Chainguard, the co-creator of Sigstore, has just launched Wolfi, a community Linux (un)distribution that is built with the default security measures necessary for securing the software supply chain. wolfi1 The push for software supply chain integrity and transparency has left organizations struggling to build in software security measures like signatures, provenance, and SBOMs to legacy systems and existing Linux distributions. To that end, Sigstore is good but requires manual labor. There must be a better way of utilizing its facilities. And what better than package all the work in an immutable container? Chainguard’s new Linux (un)distribution and build toolchain, Wolfi, is doing exactly that. It produces container images that meet the requirements of the secure software supply chain; that is images already provided with signing and sensible defaults. Sensible defaults is certainly an answer to writing secure code. I discussed this notion when covering Semgrep, a tool that searc...

 A free course from security expert Corey Ball will teach you all the techniques necessary to hack your APIs.The ultimate goal is to learn how to protect them by first identifying any undiscovered vulnerabilities. Alongside the motto "Software is eating the world", I would add "APIs are eating the Internet". It is estimated that 83% of internet traffic comes from  interaction with APIs -  therefore learning how to protect them is of the utmost importance. But given the lack of expert cybersecurity personnel, knowledge has to be gained from other sources, like this course for instance. APIsec University is hosted by Corey Ball, a true cybersec expert and author of the new book Hacking APIs - Breaking Web Application Programming Interfaces, published by No Starch Press. In that book he teaches how to go about: full article on i-programmer: https://www.i-programmer.info/news/149-security/15703-learn-to-protect-your-apis-by-hacking-them.html

  Open Source Insights is a new project by Google that helps developers understand and visualize their applications' dependencies and therefore the vulnerabilities that come with them. Supply chain security is all the rage right now. We've taken a look at the implications as well as the ways of mitigation in " Does Sigstore Really Secure The Supply Chain? " the Linux Foundation's answer to supply chain attacks: full article on i-programmer.info

  The Open-Source Vulnerabilities, OSV, database is a new, open source,  project from Google that goes beyond the current state of CVE tracking. Avoiding the introduction of vulnerabilities in a project is nothing short of science. Most projects use SAST scanning at the final stage in order to find and fix them. One great tool used in this way is Semgrep which combines the convenience of grep with the correctness of syntactical and semantic search and can be categorized as something between grep and a SAST tool. For the lowdown check my detailed article  Semgrep - More Than Just a Glorified Grep . full article on i-programmer

The Open Source Security Foundation has recently launched three brand new and free courses on Secure Software Development, which are hosted on edX. Nowadays every company is a software house regardless of the business it is in be it finance, manufacturing or healthcare. To provide value, businesses have to communicate through software applications built in-house or by a third party. The problem is that cyberattackers will attack those applications, probing them to uncover vulnerabilities to exploit and get access to your internal networks, steal company and customer data or just create havoc. full article on i-programmer