Home Blog Page 424

ZAP Provides Automated Security Tests in Continuous Integration Pipelines

Commonly, a mixture of open source and expensive proprietary tools are shoehorned into a pipeline to perform tests on nightly as well as ad hoc builds. However, anyone who has used such tests soon realizes that the maturity of a smaller number of time-honored tests is sometimes much more valuable than the extra detail you get by shoehorning too many tests into the pipe then waiting three hours for a nightly build to complete. The maturity of your battle-hardened tests is key.

The tests you require might involve interrogating the quality of code from developers or checking code for licensing issues. A continuous testing strategy can be onerous to set up but brings unparalleled value to your end product, including improvements in uptime, performance, compliance, and security.

To make any of the tests you run within your pipeline useful, you should be able to integrate them with existing tools and fire them following simple event-based hooks or triggers.

Read more at ADMIN

Top 3 Linux Distributions That ‘Just Work’

Twenty years ago, when I first started using Linux, finding a distribution that worked, out of the box, was an impossible feat. Not only did the installation take some serious mental acuity, configuring the software and getting connected to the Internet was often a challenge users were reluctant to attempt.

Today, things are quite different. Linux now offers distributions that anyone can use, right out of the box. But, even among those distros that “just work,” some rise to the top to stand as the best in breed. These particular flavors of Linux are perfect for users hoping to migrate away from Windows or mac OS and who don’t want to spend hours getting up to speed on how the platform works, or (more importantly) making the system perform as expected.

In this article, I highlight the three distributions I believe are the best bets for anyone to use, without having to put in any extra “post install” time for configuration or problem solving.

So, without further ado, let’s take a look at those distributions that qualify as the best in the “just works” category.

Ubuntu

For the longest time, Ubuntu was considered the distribution for new users. It was also the single most popular distribution. But then Canonical abandoned GNOME for Unity, and things took a downward turn. Don’t get me wrong, I was a big fan of Unity (The HUD was well ahead of its time), but the average user … not so much. Ubuntu has now returned to GNOME, which should go a long way to winning back some of the users it lost with Unity.

One of the great things about the latest releases of GNOME (Figure 1), is that they just work. Of every desktop on the market, you’d be hard-pressed to find one more reliable and hassle-free than GNOME. Once you understand the components of the desktop, everything works without a hitch. GNOME development is among the strongest of any desktop, so issues are resolved very quickly and the resultant interface is incredibly stable. Since the release of GNOME 3.26, I’ve yet to experience a single issue. That’s impressive.

Figure 1: The GNOME Dash in action.

Desktop interface aside, one of the things that Ubuntu has enjoyed, for years, is some of the best hardware recognition of any distribution. Install Ubuntu and the odds are very high everything will work flawlessly: Wireless, sound, video … everything. Unless you’re looking at peripheral hardware designed for a specific operating system, chances are all will work under Ubuntu.

Ubuntu contains just the right amount of software (such as Firefox, Thunderbird, and Libreoffice) to help users get their work done. Should there be a title missing from the mix, the Ubuntu Software Center (a rebrand of GNOME Software) is there to help users find (and easily install) the tools they need.

Linux Mint

Out of the box, Linux Mint benefits from a Ubuntu base. Because of this, it enjoys the same level of hardware recognition. However, whereas Ubuntu defaults to GNOME, Mint defaults to the Cinnamon desktop (although you can download spins with Mate, Xfce, or KDE). For some, this is ideal, as it closely resembles a very familiar interface metaphor (think WIndows XP/7). The Cinnamon desktop (Figure 2) does a great job of making interacting with the operating system and installed applications easy. Although for some, the interface will seem a bit on the outdated side, it’s as straightforward a UI as you’ll find on a modern operating system.

Figure 2: Linux Mint running the Cinnamon desktop.

One area where Linux Mint improves over Ubuntu, is the software titles installed out of the box. Whereas Ubuntu keeps things on the minimal side, Linux Mint adds a few more titles that make it even easier for users to function without having to install third-party software. Linux Mint adds to the mix:

For me, the one glaring issue for Linux Mint is the addition of the Synaptic front end for the package manager. It’s not that Synaptic isn’t a solid tool … it is. But with the likes of the included Software Manager (which is more in line with something like GNOME Software, the addition of Synaptic is redundant. I understand why they might be including Synaptic (for those users who might prefer the flexibility of the older tool), but Software Manager is far more user-friendly and should be considered the only option. And considering some software managers (such as Elementary’s AppCenter) can do both installs and upgrades in one location, it would behoove the Mint team to fold that feature into Software Manager. As it stands, the install/update/upgrade process is handled in two tools, which isn’t nearly as efficient as it could be.

Elementary OS

And now we get to my personal desktop of choice, as well as my winner for best distribution for 2017 and 2018. Elementary OS is another distribution based on Ubuntu (sense a theme here), that makes Linux as easy to use as any operating system on the planet. Just as Elementary OS is an easy distribution to use, it works incredibly well. I’ve been working with Elementary OS as my daily driver for three years now, and have rarely experienced an issue. In fact, of every operating system I have used over the years, Elementary OS has been, hands down, the most trouble free.

Upon installation, Elementary OS includes everything you need to get your work done—with one caveat. Out of the box, Elementary uses the Epiphany Web Browser. The reason for defaulting to this particular browser is to keep things on the lighter side. However, any browser power user will understand that Epiphany simply doesn’t cut it for everyday usage.

That being said, the developers of Elementary OS have created their own app store (called the AppCenter) that makes installing Firefox Quantum (or any other piece of software) incredibly easy. In fact, Elementary’s AppCenter is, without question, on part with GNOME Software for ease of use and stability.

The true highlight of Elementary OS, however, is the Pantheon desktop. If you like the macOS interface, you’ll love Pantheon (Figure 3). It offers a similar layout as well as one of the most consistent design schemes to be found on a Linux desktop.

Figure 3: My personal Elementary OS desktop in action.

Elementary OS is a bit light on the out of the box software. Because of this, users will need to venture into the AppCenter to install the tools they need to work. Fortunately, the AppCenter is as user-friendly as they get. Open the tool, type office, then scroll down and click to install LibreOffice.

Elementary OS “just works” on every level, for every level of Linux user.

You be the judge

I’ve been using Linux for two decades now, and in that time I have never known a better crop of distributions to work right out of the box than you’ll find here. Unlike distros from back in the late 1990s and early 2000s, these choices make using the flagship open source platform both a breeze and a joy. If you’re looking for one of the best distributions to get started with, you cannot go wrong with these three.

Learn more about Linux through the free “Introduction to Linux” course from The Linux Foundation and edX.

‘Shift Left’: Codifying Intuition into Secure DevOps

Continuous delivery (CD) is becoming the cornerstone of modern software development, enabling organizations to ship — in small increments — new features and functionality to customers faster to meet market demands. CD is achieved by applying DevOps practices and principles (continuous integration and continuous deployment) from development to operations. There is no continuous delivery without implementing DevOps practices and principles. By that, I mean strong communication and collaboration across teams, and automation across testing, build, and deployment pipelines. But often achieving continuous delivery to meet market demands presents numerous challenges for security. 

While DevOps principles and practices acknowledge the need for security, many organizations struggle to find the right fit and speed for integrating security into DevOps. 

Read more at DarkReading

How to Install Software Applications on Linux

How do you install an application on Linux? As with many operating systems, there isn’t just one answer to that question. Applications can come from so many sources—it’s nearly impossible to count—and each development team may deliver their software whatever way they feel is best. Knowing how to install what you’re given is part of being a true power user of your OS.

Repositories

For well over a decade, Linux has used software repositories to distribute software. A “repository” in this context is a public server hosting installable software packages. A Linux distribution provides a command, and usually a graphical interface to that command, that pulls the software from the server and installs it onto your computer. 

Read more at OpenSource.com

This Week in Open Source News: CES 2018 Advances Crucial Tech Conversations Yet Again

This week in open source news, the Consumer Electronics Show has us looking forward to connected cars and smart cities. Read on to learn how AGL is helping steer the course. 

1) Automotive Grade Linux (AGL,) a Linux Foundation Project, makes a splash at CES 2018.

Here’s every company developing self-driving car tech at CES 2018– Digital Trends

Automotive Grade Linux Gets Support From Toyota and Amazon as It Eyes Autonomous Driving– TechCrunch driving

2) “The smart city sector is one of the hot topics at CES 2018, with nearly every major technology provider looking to jump into the connected ecosystem,” writes Natalie Gagliordi. We ask, how can open source help take this from “hot topic” to universal reality? 

CES 2018: CIOs Push Smart City Agendas Through Tech Partnerships, Outreach– ZDNet

3) New project, Medicalchain, aims to employ blockchain technology to improve health record storage and is built on Hyperledger. 

Can Blockchains Ignite a New Health Information Narrative?– Nasdaq

4) “The Linux Mint project has released a guide to address the Meltdown and Spectre bugs.”

Linux Mint Project Advises on Meltdown and Spectre– Neowin

Unix and Linux System Administration Handbook – Book Review

Computer programmers, website developers, and people learning the basics as production managers of Linux and Unix systems will be able to acquire new information from this handbook. After reading this book, I wanted to share some of the key points with advanced engineers, as well as people starting out like myself. 

One year ago I started attending DevOps meetings called Meetups in the Boulder area. I was able to expand my comfort zone past front-end development, and find out more on how system operations worked. The Meetups continue to be an excellent way for people to acquire new skills in networking and operations.

The first few chapters contained information and vocabulary that was over my head at times, but I found out that after reading and reviewing new terms, it expanded my ability to learn new information. I suggest you read the latest edition to stay up to date on Linux and Unix systems, as well as refresh yourself with the latest cloud computing trends.

Read more at Crescent Vale

Automated Compliance Testing with InSpec

Compliance is a valid tool for enabling or facilitating secure operation of any type of IT organization, which is what ISO 27001 [1], BSI Base Protection [2], and various other certification bodies claim for their customers. However, corporations often need to implement compliance rules for certification that are contrary to existing business practices. To keep the promises made to the certification authority, regular systems checks are needed. Thus, a corporation needs to verify whether the rules laid down in its statutes are in fact implemented on all relevant systems, as the instructions require. The question is, how can you implement this kind of check?

One way would be to employ admins who do nothing but handle this task, but that would be inefficient; moreover, it would cause a worrying situation in which regular administrators feel they are being watched. Infinitely preferable is automated compliance tests: InSpec to the rescue.

Read more at ADMIN Magazine

How the Kubernetes Certification Ensures Interoperability

Dan Kohn, executive director of the Cloud Native Computing Foundation, has called the launch of the new Kubernetes service provider certification programthe most significant announcement yet made by the Foundation around the open source container orchestration engine.

On this new episode of The New Stack Makers from KubeCon + CloudNativeCon 2017, we’ll learn more from Kohn and William Denniss, a product manager at Google, about how the program can help ensure interoperability and why that’s so important.

Denniss noted that avoiding vendor lock-in is a key reason people want to use Kubernetes, with a focus on abstracting away from the infrastructure they are using. 

Read more at The New Stack

What is DevSecOps? Developing More Secure Applications

The simple premise of DevSecOps is that everyone in the software development life cycle is responsible for security, in essence bringing operations and development together with security functions. DevSecOps aims to embed security in every part of the development process. It is about trying to automate core security tasks by embedding security controls and processes early in the DevOps workflow (rather than being bolted on at the end). For example, this could be the case when migrating to microservices, building out a CI/CD pipeline, compliance automation or simply testing cloud infrastructure.

The ability to deploy applications in the cloud has improved both scale and speed, the move to agile and DevOps methodologies (and with that, continuous delivery) making “big bang” application launches a thing of the past. In particular, DevOps — the principle of integrating development and IT operations under a “single automated umbrella” — has helped with everything from more frequent feature releases to increased application stability.

Read more at CSO Online

Working with Vi/Vim Editor: Advanced Concepts

Earlier we have discussed some basics about VI/VIM editor but VI & VIM are both very powerful editors and there are many other functionalities that can be used with these editors. In this tutorial, we are going to learn some advanced uses of VI/VIM editor.

To open multiple files, command would be same as is for a single file; we just add the file name for second file as well.

$ vi file1 file2 file 3

Now to browse to next file, we can use

$ :n

or we can also use

$ :e filename

Read more at Linux Tech Lab