Podcasts about snyk

Este episódio aborda os principais desafios em segurança de aplicações, incluindo a cultura organizacional, o alinhamento entre times de desenvolvimento e segurança, e o papel de líderes na transformação dessa cultura. Os convidados compartilham suas experiências na Nova 8 e reflexões sobre como empresas podem evoluir na gestão de vulnerabilidades e segurança de software.Tópicos que conversamos:A dinâmica entre times de segurança (APSEC) e desenvolvimento, e a evolução nas relações de trabalhoOs maiores desafios na adoção de ferramentas de AppSec no ambiente de clientesA importância do planejamento, priorização e cultura na gestão de vulnerabilidadesComo o aculturamento impacta a maturidade da segurança na organizaçãoOs papéis de "médico" e "pai" na gestão de vulnerabilidades e processos de segurançaA influência do alinhamento de do papel de lideranças de segurança e entendimento das metas organizacionaisComo lidar com ruídos e falsos positivos dos scanners de vulnerabilidadesA relação entre cultura, processos, e eficácia na implementação de segurança contínuaBecome a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

A maioria dos programas de AppSec está afogada em findings, dashboards, scanners, CVEs, SLAs e relatórios que ninguém aguenta mais ler. O problema não é falta de ferramenta. O problema é falta de contexto, correlação e inteligência para entender o que realmente importa. Neste episódio, eu apresento o M.A.R.I.A., o Management Application Risk Integrated Analysis, uma plataforma criada para atuar como uma camada de inteligência de risco em Segurança de Aplicações. O M.A.R.I.A. não nasceu para ser mais um scanner. Ele nasceu para responder perguntas que ferramentas tradicionais normalmente ignoram: qual aplicação está realmente em risco? Qual vulnerabilidade merece atenção agora? Qual time precisa de ajuda? Qual mudança aumentou o risco do ambiente? A proposta é simples e ambiciosa: conectar dados de SAST, DAST, SCA, IaC, Secret Scan, pipelines, repositórios, contexto de negócio e exposição real para transformar ruído em decisão. Porque no fim do dia, AppSec não deveria ser uma fábrica de tickets. Deveria ser um sistema de priorização inteligente para proteger o que importa. Neste episódio, falo sobre:Por que scanners sozinhos não resolvem AppSecO problema real por trás do excesso de vulnerabilidadesA diferença entre dashboard, ASPM e inteligência de riscoComo o M.A.R.I.A. pretende correlacionar contexto técnico e contexto de negócioOnde entram risco, exposição, criticidade, SLA, dívida de segurança e Security ChampionsPor que AppSec precisa sair do modo “lista de problemas” e entrar no modo “tomada de decisão”Um episódio para quem está cansado de medir segurança por quantidade de findings e quer começar a discutir risco de verdade.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs, to dig deep into the state of Java security in 2025 and beyond.Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.Together they cover how CVEs in the Java runtime are handled through coordinated disclosure, why Maven Central is safer than most ecosystems but not a silver bullet, and what insurance companies are starting to demand from organizations that haven't cleaned up their dependency trees. They also discuss practical steps any Java developer can take today, from generating an SBOM and running Snyk or Trivy, to adopting OpenRewrite and Renovate in your pipelines, and why vibe coding with AI tools may be quietly making your security posture worse if you are not reviewing the dependency choices being made for you.A candid, occasionally alarming, and ultimately optimistic conversation about a problem the Java community is well-positioned to lead on.Steve PooleLinkedInFoojay Author profileCrossing the River Styx: Spring Boot 3.5 and the Zombie Dependency ProblemWhy Java Developers Over-Trust AI SuggestionsDavid WelchLinkedInContent00:00 Introduction of topics and guests04:00 What are Zombie dependencies?05:36 What are CVEs?11:39 How Mythos and other AI tools are influencing the CVE reporting process16:53 How CVEs in the Java runtime are handled21:30 How the industry is looking at the increased security threats30:17 Developers need to make better decisions "the first time" and use the right tools31:42 Keep your OS, JVM, and dependencies up-to-date! Insurance companies will force you...44:48 How "safe" is Maven Central compared to other repository systems50:48 What you can do as a Java developer to make your apps safer59:01 Should we be scared for the following years and be careful with vibe coding?01:04:27 Conclusion

CJ turns the mic on the people behind Mostly Media for a special behind-the-scenes episode of Run the Numbers. Michelle, Callie, Sarah, Matthew, Ben, and Steve share what it's like building the company, scaling media, talent, sales, production, and operations, and dealing with CJ's scooter lore, calendar quirks, and chaos along the way.—SPONSORS:Rillet is an AI-native ERP built for modern finance teams that want to replace NetSuite and close faster. With revenue recognition, close management, multi-entity support, and native Stripe and Salesforce integrations, Rillet helps scaling companies run their finance stack in one place. Hundreds of teams, including Windsurf and Mercor, use Rillet to make the zero-day close real. Book a demo at https://www.rillet.com/cjEY works with high-growth tech companies to navigate the messy realities of scaling—from regulatory requirements to IPO readiness. By helping teams get it right early and often, EY lets founders stay focused on building while reducing risk as they grow. Learn more at https://www.ey.com/techstartupsSpendHound is a SaaS spend management platform built for finance and procurement teams that want visibility and leverage in every deal. By tracking all your software, benchmarking pricing across thousands of vendors, and surfacing contracts and renewals, SpendHound helps you stop overpaying and negotiate with confidence. Trusted by teams at ZoomInfo and Hootsuite. Get started at https://www.spendhound.com/cjBrex is an intelligent finance platform that combines corporate cards, built-in expense management, and AI agents to eliminate manual finance work. By automating expense reviews and reconciliations, Brex gives CFOs more time for the high-impact work that drives growth. Join 35,000+ companies like Anthropic, Coinbase, and DoorDash at https://www.brex.com/metricsAleph is a modern FP&A platform built for teams that want more than another planning tool. By connecting your ERP, CRM, and other systems into one trusted data layer with AI workflows, Aleph helps you move faster with real-time insights. Get a personalized demo at https://www.getaleph.com/runRightRev is an automated revenue recognition platform built for teams that have outgrown spreadsheets and billing tool workarounds. It handles high-volume subscriptions, usage-based contracts, and mid-cycle upgrades, so you can scale without scrambling at month-end. For RevRec that keeps your books clean, visit https://www.rightrev.com/CJ—LINKS: Mostly Talent: https://mostlymetrics.typeform.com/to/cLTxtAsNCJ: https://www.linkedin.com/in/cj-gustafson-13140948/Mostly metrics: https://www.mostlymetrics.com—TIMESTAMPS:0:00 Preview and intro2:44 Show intro: meet the Mostly Media team3:37 Michelle Finn: accounting and ops4:28 Parts Tech days: CJ's first CFO role7:21 How the newsletter convinced Michelle to join9:02 Sponsors — Rillet | EY | SpendHound12:11 Callie Spillane: talent director13:17 Callie's background: HubSpot, Sneak, Superhuman13:40 Why Callie was hard to hire15:37 Snyk hypergrowth: 150 to 1,500 people16:59 Zero to one vs. one to ten18:20 9 of 20 roles filled: how it's going23:24 Sponsors — Brex | Aleph | RightRev26:58 Sarah Bousquet: media op27:45 Stay at home mom to ops lead33:48 CJ's schedule: American Psycho34:43 Matthew Mozzocchi: sales and partnerships35:41 Going full time with a newborn36:20 Product market fit signal38:07 Fewer, bigger bets on creators41:00 Podcast is the air game, newsletter is the ground game43:56 Ben Hillman and Steve Cerasoli: production47:46 Media in service of a product vs. the product itself48:37 Run the Numbers vs. Mostly Growth51:25 Where are we in three years?52:40 Credits#RunTheNumbersPodcast #CreatorEconomy #MediaBusiness #Entrepreneurship #ContentBusiness

Todo mundo fala de DevSecOps. Todo mundo fala de IA. Mas quase ninguém conectou os pontos do jeito certo ainda. Neste episódio, a gente entra em um território que está começando a separar quem só usa ferramenta de quem realmente entende o jogo: SpecOps com IA. E não, isso não é sobre mais um YAML bonito ou documentação que ninguém lê. É sobre transformar especificações em algo vivo. Algo que define o sistema antes do código existir… e impede que ele saia da linha depois. A conversa passa por:por que “finding-based security” já não escala maiscomo a IA pode validar intenção, não só códigoo conflito direto entre vibe coding e governança realcomo specs podem virar enforcement automático no pipelinee o que muda quando segurança deixa de ser checklist e vira contratoA gente também traz isso para o mundo real:como integrar isso com pipelines atuaisonde ferramentas como SAST e SCA entram (e onde deixam de ser suficientes)e como esse modelo pode evoluir para algo muito mais próximo de risk-driven securitySe você ainda está medindo segurança só por quantidade de vulnerabilidades, esse episódio vai te incomodar. Do jeito certo.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Episódio 200. Não é só número redondo, é checkpoint de uma jornada que saiu de conversa técnica entre amigos e virou referência em AppSec e DevSecOps. Nesse especial, a mesa está completa. Desde a formação raiz com Balbino e Vini, passando pela evolução com Marcos e Ben-Hur, até chegar no comando firme do host de sempre, Cássio Pereira. É história, bastidores, opiniões afiadas e, claro, muita discussão que mistura experiência real com aquelas verdades que nem sempre agradam, mas todo mundo precisa ouvir. Não espere retrospectiva bonitinha. Aqui tem:o que deu certo e o que foi puro aprendizado na marracomo o AppSec mudou ao longo dos episódiosonde a galera errou feio e o que faria diferente hojeo que ninguém está falando sobre o futuro de segurançaE sim, tem zoeira. Porque depois de 200 episódios, se não tiver isso, tem algo errado. Dá o play. Porque se você chegou até aqui com a gente, esse episódio também é seu.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

No episódio de hoje, recebemos o time da CarameloSec para uma conversa sem firula sobre segurança de aplicações na vida real. Nada de teoria bonita que não sobrevive ao deploy. Falamos de como segurança é construída no dia a dia, os desafios de levar AppSec para dentro dos times e onde muita gente ainda está se enganando feio. Entramos em temas como cultura de segurança, o abismo entre ferramenta e resultado, e como iniciativas independentes como a CarameloSec estão ajudando a elevar o nível da comunidade. Tem provocação, tem experiência prática e tem alguns tapas de realidade que você provavelmente precisa ouvir. Se você trabalha com desenvolvimento, segurança ou está tentando não virar estatística no próximo incidente, esse episódio é obrigatório.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

A IA não vai “impactar” AppSec. Vai engolir quem estiver parado. Neste episódio, a conversa é direta: o que sobra para quem trabalha com Segurança de Aplicações quando a IA começa a escrever código, revisar pull request, gerar arquitetura e até corrigir vulnerabilidade sozinha? Spoiler: o jogo muda completamente. Falamos sobre o fim do AppSec operacional baseado em checklist e o nascimento de um novo perfil. Menos executor, mais estrategista. Menos ferramenta, mais contexto. Você vai entender como SAST, DAST e SCA perdem protagonismo isolados e passam a ser só sinais dentro de um sistema maior, orientado por risco real e decisão automatizada. Também exploramos o lado desconfortável: IA gerando vulnerabilidades em escala, pipelines cada vez mais opacos e o risco de confiar cegamente em “correções inteligentes” que ninguém revisou de verdade. Se você ainda está focado em rodar ferramenta e abrir ticket, esse episódio vai doer. E é exatamente por isso que você precisa ouvir. Você vai sair com uma visão clara de para onde a profissão está indo:O AppSec Engineer vira um “Risk Engineer”Modelagem de ameaças deixa de ser evento e vira fluxo contínuoSegurança passa a ser código, contexto e decisão em tempo realIA deixa de ser ferramenta e vira parte do problema e da soluçãoO futuro não precisa de mais gente rodando scan. Precisa de gente que entende o que realmente importa quando tudo começa a rodar sozinho.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

What does sharpening a knife over a case of onions have to do with incident response? For Myke Lyons, CISO at Cribl, the answer is everything. Myke trained at the Culinary Institute of America — learning speed and accuracy under the clock of a professional kitchen — before a summer IT job in Manhattan set him on an entirely different path. In this episode of The New CISO, host Steve Moore traces that journey and the surprising parallels between culinary craft and security leadership.The conversation moves through a career that evolved organically: a summer job moving refrigerator-sized printers in a Manhattan ad agency, a crash course in executive white-glove IT support, a breakthrough moment finally cracking subnetting, and a slow expansion from NOC operator to global security leader. Myke credits the kitchen — its insistence on precision and calm under fire — for instilling an operator's mindset that still defines how he leads through incidents today.Mentorship, both formal and accidental, threads through Myke's story. A curmudgeonly colleague who threatened to "replace him with a script" taught him the value of continuous improvement. A trusted mentor reframed the CISO's role with a single line about house fires and lock changes. And years in executive IT support gave Myke an early education in empathy and knowing when not to fix what wasn't asked.Myke and Steve examine a vendor incident where a product leader's dismissive response to a forensics question destroyed credibility with hundreds of customers. The lesson: saying "I don't know, but we'll find out" is not a weakness — it is the most powerful tool a leader has. The same insight applies to M&A due diligence, where reframing technical conversations as expectation-setting exercises turns adversarial interviews into collaborative ones.For Myke, the new CISO is defined by empathy and culture. Know your audience. Think like your customers. Communicate policy changes as explanations, not mandates. Find your internal advocates and invest in them before you need them. The recipe for great security leadership is less about technology than it is about people — and that lesson translates perfectly from the kitchen to the boardroom.Key Topics• Career pivots: from culinary school to IT and cybersecurity• Speed, accuracy, and craft — what kitchen discipline teaches security professionals• Building an operator's mindset and staying calm during security incidents• White-glove executive IT support and the patience, precision, and empathy it develops• Mentorship — formal and accidental — and the lessons that only land in retrospect• The dangers of filling silence with false confidence vs. the power of saying "I don't know"• Crisis communication best practices and what not to do during a vendor incident call• Managing M&A security due diligence with low-emotion, expectation-setting conversations• Building security culture through empathy, clear communication, and internal advocates• Telemetry, log management, and Cribl's role as the data engine for IT and security Guest BioMyke Lyons is the Chief Information Security Officer at Cribl, the AI platform for telemetry trusted by organizations worldwide — including half of the Fortune 100 — to manage IT and security data at any scale.He trained at the Culinary Institute of America with aspirations of becoming a food critic — until a summer IT job in Manhattan set him on an entirely different course. Myke went on to build expertise across networking, NOC operations, and log management, holding CISO positions at Snyk and Collibra before joining Cribl in 2024.Connect with Myke on LinkedIn and learn more about Cribl at cribl.io.GET A DEMO:

An airhacks.fm conversation with Brian Vermeer (@BrianVerm) about: growing up with a Commodore 64 and gaming, inheriting a 486 DX2 with Windows 3.1, first "enterprise" migration from Windows 3.1 to 3.11, early experiments with Turbo Pascal and Basic, curiosity-driven programming and disassembling electronics, building computers from parts in the early PC era, high school informatics classes and the transition from hobby to career, bachelor's degree in software engineering, master's degree at Utrecht University focusing on Formal methods and compiler construction, mathematical proofs of program correctness, abstract syntax trees and program analysis, Haskell and pure functional programming, recursion vs loops and thinking in different paradigms, the influence of functional programming on Java development, first professional Java job at a temperature sensor monitoring company, building systems for vaccine transport temperature verification, enterprise service-based architecture, JavaServer Faces for frontend development, transitioning to consultancy at Blue4IT working for banks and government, community involvement and knowledge sharing, joining Snyk as a hybrid engineer and developer advocate, Snyk's origins as an NPM dependency scanner, supply chain security and NPM package vulnerabilities, expansion from Node.js to Java and other ecosystems, static code analysis and container analysis and AI flow analysis, security as part of the development lifecycle not an afterthought, vibe coding and AI assistant security checks, MCP server toxic flow risks, Java vs python for scripting and automation, JBang for Java scripting, modern Java simplicity vs legacy enterprise verbosity, Java developers thinking about production from the start, Java and C# as the main languages for large backends, JVM optimization over time, Leslie Lamport and formal verification of concurrent programs, outsourcing expertise vs doing everything Brian Vermeer on twitter: @BrianVerm

Supply Chain Security deixou de ser teoria e virou problema real. Neste episódio, destrinchamos os casos recentes envolvendo ferramentas amplamente utilizadas como Trivy, KICS e a biblioteca Axios e o que eles expõem sobre a fragilidade da cadeia de dependências.Falamos sobre o risco invisível que roda dentro do seu pipeline, como ataques em ferramentas “confiáveis” mudam completamente o jogo e por que confiar cegamente em scanners e bibliotecas populares pode ser um erro caro. Não é só sobre vulnerabilidades conhecidas, é sobre confiança quebrada. Você vai sair com uma visão prática de como esses incidentes acontecem, onde estão os pontos cegos no seu processo e o que precisa mudar agora para não virar o próximo case.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Lo scanner di sicurezza più usato al mondo è stato compromesso. Trivy, il guardiano delle CI/CD pipeline, è diventato il cavallo di Troia di un attacco supply chain che ha infettato migliaia di ambienti cloud, avvelenato npm e Docker Hub, e scatenato un wiper contro l'Iran.Fonti e approfondimenti:- Ars Technica: https://arstechnica.com/security/2026/03/widely-used-trivy-scanner-compromised-in-ongoing-supply-chain-attack/- Bleeping Computer: https://www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/- Aqua Security: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/- Snyk: https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/- Eclipse Foundation: https://blogs.eclipse.org/post/mika%C3%ABl-barbero/stop-trusting-mutable-references-how-eclipse-foundation-projects-should-hardenLa mia app: https://play.google.com/store/apps/details?id=com.edodusi.coderoutine&hl=it-it00:00 Intro01:37 Trivy: il guardiano delle pipeline03:09 L'attacco: come hanno bucato lo scanner07:19 L'effetto domino: da Trivy al 36% del cloud10:58 Outro#trivy #supply-chain #cybersecurity #ci-cd #litellm #npm #docker #kubernetes #opensource

In this weeks' Scale Your Sales Podcast episode, my guest is Anna Bella. She is a Sales Leader with over 13 years of leadership experience, spending the last 7 building & scaling SDR teams across EMEA and APAC at high growth SaaS companies including Redis and Snyk. She drives measurable revenue impact through cross-functional collaboration, AI-powered outreach, accountbased strategies, and performance frameworks. She is a Board Member at Buckinghamshire Business School, member of the Women in Tech Forum and SDR Leaders of EMEA. In today's episode of Scale Your Sales podcast, Anna brings over a decade of experience building and scaling sales development teams across EMEA and APAC. They discuss leadership in an AI-driven landscape, focusing on the importance of empathy, accountability, coaching, and culture in enabling high-performing teams and retaining top talent. The conversation also addresses increasing female representation in sales and technology leadership, offering practical guidance on career development, AI adoption, networking, and mentorship. Welcome to Scale Your Sales Podcast, Anna Bella.   Timestamps: 00:00 Empathy-Driven Leadership and AI 05:16 Initiative and AI Super Users 08:29 Advocating Women in Tech Sales 13:58 Women's Empowerment in Leadership 17:21 Stretch, Challenge, and Change 20:51 Onboarding, Retention, and Growth 24:20 Culture: The Ultimate Differentiator 28:11 Coachable Team for Sales Success 29:29 Empathy and Accountability Leadership 32:56 Empathy Unlocks Team Potential   https://www.linkedin.com/in/annabella85/   About the Host Janice B Gordon is the award-winning Customer Growth Expert, founder of the Scale Your Sales Framework, and host of the Scale Your Sales Podcast. She helps CEOs, founders and revenue leaders grow sustainable revenue by aligning leadership, sales and customer experience through her North Star Leadership approach. Named one of LinkedIn Sales' Innovating Sales Influencers to Follow and a Top Global Thought Leader on Customer Experience, Janice works with organisations worldwide to rethink how revenue grows. Connect with Janice Book Janice to speak at your next sales or leadership event https://janicebgordon.com LinkedIn https://www.linkedin.com/janice-b-gordon/ Instagram https://www.instagram.com/janicebgordon Scale Your Sales Podcast https://scaleyoursales.co.uk/podcast Enjoy the episode? Share your takeaway in the comments and leave a review on Apple Podcasts to help more leaders discover the show.

Neste episódio do DevSecOps Podcast, mergulhamos em um tema frequentemente subestimado, mas absolutamente crítico para a segurança moderna: Log Modeling.Enquanto muita gente trata logs apenas como registros para troubleshooting, a realidade é outra. Logs bem pensados são sensores de segurança dentro da aplicação.Eles contam a história do que aconteceu, quem fez o quê e quando algo saiu do normal. Durante a conversa exploramos como o Log Modeling pode ser tratado como uma prática de Application Security, não apenas de observabilidade.Falamos sobre como modelar eventos relevantes de segurança desde o design da aplicação, quais tipos de ações precisam obrigatoriamente ser registradas, e como evitar logs inúteis que só geram ruído enquanto deixam passar atividades críticas sem rastreabilidade.Neste episódio você vai entender:• O que é Log Modeling e por que ele deveria fazer parte do seu AppSec Program• A diferença entre logs operacionais e logs de segurança• Quais eventos realmente precisam ser registrados em uma aplicação• Como logs ajudam em investigação de incidentes e detecção de ataques• Erros comuns que tornam logs inúteis quando mais precisamos delesSe segurança é sobre visibilidade, então logs bem projetados são uma das ferramentas mais poderosas para entender o comportamento real das suas aplicações em produção.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Miles Clements is a Partner @ Accel where he helps to lead their growth fund. At Accel, Miles has led or invested in Atlassian, Cursor, Linear, and more.  AGENDA:  03:38 Where is True Alpha and Value in a World of AI  05:10 Why it is Total BS that Cursor is Dead 07:55 Why Cursor Were Not Wrong to Build Their Own Models 09:38 What is the Upside When Investing in Cursor at $27BN? 15:12 Do Sub $10BN Outcomes Even Matter to a Fund the Size of Accel? 17:07 Losing ServiceTitan: Investing Lesson Learned… 19:55 Missing Rippling: What We Learned 27:20 What is Accel's Win Rate 30:22 How VCs Approach Ownership Has Changed 35:09 Does Miles Feel Happier or Sadder to be an Anthropic Investor Post Pentagon Debacle 36:45 What Happens to Companies Like Miro and Snyk with High Prices to Live Upto? 38:05 Why it is a Great Time to Be Thoma Bravo and Vista  38:36 Why Founder-Led Companies Are Always Better 41:12 Why Would Any Founder Go Public Today 43:48 When is the Right Time to Take Chips Off The Table? 45:24 Should VC Firms Have Evergreen Funds and Be Responsible for Public Positions 50:28 You Can Pick Any VC to Join Accel, Who Does Miles Choose…     

Neste episódio do DevSecOps Podcast, o papo gira em torno de um tema que muita gente na área de tecnologia sente na pele: a falta de formação realmente sólida em Application Security. Em vez de cursos superficiais ou conteúdos soltos pela internet, discutimos a ideia de uma Pós-graduação focada em AppSec e DevSecOps, pensada para quem quer sair da teoria genérica e mergulhar no que realmente acontece dentro das empresas. Ao longo do episódio, exploramos por que segurança de aplicações exige uma visão ampla que vai além de ferramentas. Falamos sobre arquitetura segura, modelagem de ameaças, revisão de código, segurança em pipelines de CI/CD, cloud, gestão de vulnerabilidades e cultura de segurança no desenvolvimento. A proposta da pós é justamente conectar esses pontos e formar profissionais capazes de pensar segurança dentro do ciclo completo de desenvolvimento. Se você é desenvolvedor, engenheiro de segurança, arquiteto ou líder técnico e quer entender como estruturar um aprendizado sério em AppSec, este episódio traz uma visão clara do que esperar de uma formação avançada na área. Neste episódio você vai encontrar: • Por que o mercado precisa de especialistas em Application Security• A diferença entre aprender ferramentas e aprender segurança de verdade• Os pilares de uma formação sólida em AppSec e DevSecOps• Como conectar desenvolvimento, cloud e segurança no mesmo modelo mental• O tipo de profissional que o mercado realmente está procurando hojeBecome a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Neste episódio do DevSecOps Podcast, fomos direto no ponto: SCA não é sinônimo de caçar CVE em biblioteca open source. Durante anos, muita empresa reduziu Software Composition Analysis a “rodar ferramenta e ver se tem vulnerabilidade no npm ou no Maven”. Só que o jogo ficou mais complexo. Hoje falamos de dependências transitivas invisíveis, pacotes abandonados, licenças incompatíveis, ataques à cadeia de suprimentos e componentes proprietários que ninguém inventaria no SBOM porque “não é open source”. Spoiler: risco não pergunta licença. Discutimos:Por que SCA precisa olhar além do GitHub e entender o ecossistema inteiro da aplicaçãoO papel real do SBOM e onde ele falha na práticaSupply chain attacks e o que mudou depois de casos como Log4ShellDependências internas, pacotes privados e artefatos binários esquecidosLicenciamento como risco jurídico, não só técnicoComo integrar SCA de forma estratégica no pipeline e não virar mais um relatório ignoradoSe AppSec é armadura, SCA é o exame de sangue do software. E não adianta medir só colesterol quando o problema pode estar no fígado. Esse episódio é para quem já rodou ferramenta, já viu dashboard bonito e percebeu que ainda assim algo está faltando. Porque está mesmo.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

IA é ferramenta. Poderosa. Rápida. Escalável. E completamente indiferente ao que é certo ou errado. Neste episódio do DevSecOps Podcast, mergulhamos nos perigos reais da Inteligência Artificial além do hype e além do medo irracional. Falamos sobre modelos que aprendem vieses humanos, automação de desinformação em escala industrial, geração de código vulnerável com confiança absurda e a falsa sensação de segurança quando “a IA revisou”. IA não é ética. Não é moral. Não é consciente. É estatística com GPU. Discutimos também o impacto prático no desenvolvimento de software e na segurança de aplicações. Devs usando copilots sem validar saída. Times confiando em respostas geradas como se fossem verdade revelada. Ataques potencializados por modelos generativos. Engenharia social turbinada. Deepfakes cada vez mais convincentes. A IA amplia o melhor e o pior de nós. No fim, a pergunta não é se a IA é perigosa. Toda tecnologia poderosa é. A pergunta é: estamos usando com criticidade ou com preguiça intelectual? Porque quando a máquina erra, ela erra em escala. E quando o humano delega o pensamento, ele terceiriza a responsabilidade. E responsabilidade, meu amigo, não dá para fazer deploy automático.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Nesse episódio a conversa foi direta e sem anestesia. Falamos sobre como empresas e profissionais de AppSec realmente evoluíram nos últimos anos, o que mudou de verdade e o que é só discurso bonito em slide corporativo. Spoiler: muita coisa avançou, mas muita gente ainda está brigando com problemas que já deveriam estar resolvidos há uma década. Também discutimos o descompasso clássico do mercado. Enquanto algumas organizações já deveriam estar olhando para o próximo nível de maturidade, automação real, decisões baseadas em risco e integração profunda com engenharia, outras ainda estão “começando AppSec” do zero. E aí vem a pergunta incômoda: isso é falta de tempo, de prioridade, de competência ou de coragem? Um episódio para quem quer entender onde estamos, onde deveríamos estar e por que maturidade em AppSec não é checklist, não é ferramenta e definitivamente não é cargo no LinkedIn.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Neste episódio do DevSecOps Podcast, usamos a armadura do Homem de Ferro como desculpa elegante para falar de coisa séria: como montar um programa de AppSec que funciona no mundo real. Aqui não tem magia, tem engenharia. Assim como Tony Stark não começa salvando o mundo no Mark L, um programa de AppSec não nasce maduro. Falamos de fundamentos, evolução incremental, decisões técnicas difíceis e da diferença brutal entre ter ferramentas… e ter capacidade real. Jarvis vira métrica, sensores viram telemetria, armaduras viram processos. Tudo com pé no chão e código na mesa. Você vai ouvir sobre:por onde começar sem travar o timecomo alinhar AppSec com negócio, produto e Devmaturidade progressiva, não big bang corporativoporque cultura pesa mais que ferramentae o erro clássico de tentar “comprar” segurançaSe o seu AppSec hoje parece mais cosplay do que armadura funcional, esse episódio é pra você. Menos marketing, mais engenharia. Segurança que voa porque foi bem montada, não porque alguém prometeu.Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support.Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

Shomik is the newest partner at Sierra Ventures! A longtime venture investor and an inception-focused fund backing technical founders at day zero. He supported companies like Cloudquery, Kiln AI, and Ask-Y, and played a role in many other early investments.Shomik was an investor at Top Tier Capital, where he focused on growth-stage companies including CircleCI, Anaplan, Remitly, Shape Security, and Snyk. His path into venture was anything but traditional, with early experience spanning tech M&A, venture debt, a failed startup, and fixed income sales and trading.Originally from New Jersey and a Pittsburgh alum, Shomik is an avid hiker, an aspiring guitarist—progress very much still in flight—and the proud dad of a one-and-a-half-year-old son who now takes up all of his spare time.✨ This episode is presented by Brex.Brex: brex.com/trailblazerspodThis episode is supported by RocketReach, Gusto, OpenPhone & Athena.RocketReach: rocketreach.co/trailblazersGusto: gusto.com/trailblazersQuo: Quo.com/trailblazersAthena: athenago.me/Erica-WengerFollow Us!Shomik Ghosh: @shomikghosh21@thetrailblazerspod: Instagram, YouTube, TikTokErica Wenger: @erica_wenger

De retour à cinq dans l'épisode, les cast codeurs démarrent cette année avec un gros épisode pleins de news et d'articles de fond. IA bien sûr, son impact sur les pratiques, Mockito qui tourne un page, du CSS (et oui), sur le (non) mapping d'APIs REST en MCP et d'une palanquée d'outils pour vous. Enregistré le 9 janvier 2026 Téléchargement de l'épisode LesCastCodeurs-Episode-335.mp3 ou en vidéo sur YouTube. News Langages 2026 sera-t'elle l'année de Java dans le terminal ? (j'ai ouïe dire que ça se pourrait bien…) https://xam.dk/blog/lets-make-2026-the-year-of-java-in-the-terminal/ 2026: Année de Java dans le terminal, pour rattraper son retard sur Python, Rust, Go et Node.js. Java est sous-estimé pour les applications CLI et les TUIs (interfaces utilisateur terminales) malgré ses capacités. Les anciennes excuses (démarrage lent, outillage lourd, verbosité, distribution complexe) sont obsolètes grâce aux avancées récentes : GraalVM Native Image pour un démarrage en millisecondes. JBang pour l'exécution simplifiée de scripts Java (fichiers uniques, dépendances) et de JARs. JReleaser pour l'automatisation de la distribution multi-plateforme (Homebrew, SDKMAN, Docker, images natives). Project Loom pour la concurrence facile avec les threads virtuels. PicoCLI pour la gestion des arguments. Le potentiel va au-delà des scripts : création de TUIs complètes et esthétiques (ex: dashboards, gestionnaires de fichiers, assistants IA). Excuses caduques : démarrage rapide (GraalVM), légèreté (JBang), distribution simple (JReleaser), concurrence (Loom). Potentiel : créer des applications TUI riches et esthétiques. Sortie de Ruby 4.0.0 https://www.ruby-lang.org/en/news/2025/12/25/ruby-4-0-0-released/ Ruby Box (expérimental) : Une nouvelle fonctionnalité permettant d'isoler les définitions (classes, modules, monkey patches) dans des boîtes séparées pour éviter les conflits globaux. ZJIT : Un nouveau compilateur JIT de nouvelle génération développé en Rust, visant à surpasser YJIT à terme (actuellement en phase expérimentale). Améliorations de Ractor : Introduction de Ractor::Port pour une meilleure communication entre Ractors et optimisation des structures internes pour réduire les contentions de verrou global. Changements syntaxiques : Les opérateurs logiques (||, &&, and, or) en début de ligne permettent désormais de continuer la ligne précédente, facilitant le style "fluent". Classes Core : Set et Pathname deviennent des classes intégrées (Core) au lieu d'être dans la bibliothèque standard. Diagnostics améliorés : Les erreurs d'arguments (ArgumentError) affichent désormais des extraits de code pour l'appelant ET la définition de la méthode. Performances : Optimisation de Class#new, accès plus rapide aux variables d'instance et améliorations significatives du ramasse-miettes (GC). Nettoyage : Suppression de comportements obsolètes (comme la création de processus via IO.open avec |) et mise à jour vers Unicode 17.0. Librairies Introduction pour créer une appli multi-tenant avec Quarkus et http://nip.io|nip.io https://www.the-main-thread.com/p/quarkus-multi-tenant-api-nipio-tutorial Construction d'une API REST multi-tenant en Quarkus avec isolation par sous-domaine Utilisation de http://nip.io|nip.io pour la résolution DNS automatique sans configuration locale Extraction du tenant depuis l'en-tête HTTP Host via un filtre JAX-RS Contexte tenant géré avec CDI en scope Request pour l'isolation des données Service applicatif gérant des données spécifiques par tenant avec Map concurrent Interface web HTML/JS pour visualiser et ajouter des données par tenant Configuration CORS nécessaire pour le développement local Pattern acme.127-0-0-1.nip.io résolu automatiquement vers localhost Code complet disponible sur GitHub avec exemples curl et tests navigateur Base idéale pour prototypage SaaS, tests multi-tenants Hibernate 7.2 avec quelques améliorations intéressantes https://docs.hibernate.org/orm/7.2/whats-new/%7Bhtml-meta-canonical-link%7D read only replica (experimental), crée deux session factories et swap au niveau jdbc si le driver le supporte et custom sinon. On ouvre une session en read only child statelesssession (partage le contexte transactionnel) hibernate vector module ajouter binary, float16 and sparse vectors Le SchemaManager peut resynchroniser les séquences par rapport aux données des tables Regexp dans HQL avec like Nouvelle version de Hibernate with Panache pour Quarkus https://quarkus.io/blog/hibernate-panache-next/ Nouvelle extension expérimentale qui unifie Hibernate ORM with Panache et Hibernate Reactive with Panache Les entités peuvent désormais fonctionner en mode bloquant ou réactif sans changer de type de base Support des sessions sans état (StatelessSession) en plus des entités gérées traditionnelles Intégration de Jakarta Data pour des requêtes type-safe vérifiées à la compilation Les opérations sont définies dans des repositories imbriqués plutôt que des méthodes statiques Possibilité de définir plusieurs repositories pour différents modes d'opération sur une même entité Accès aux différents modes (bloquant/réactif, géré/sans état) via des méthodes de supertype Support des annotations @Find et @HQL pour générer des requêtes type-safe Accès au repository via injection ou via le métamodèle généré Extension disponible dans la branche main, feedback demandé sur Zulip ou GitHub Spring Shell 4.0.0 GA publié - https://spring.io/blog/2025/12/30/spring-shell-4-0-0-ga-released Sortie de la version finale de Spring Shell 4.0.0 disponible sur Maven Central Compatible avec les dernières versions de Spring Framework et Spring Boot Modèle de commandes revu pour simplifier la création d'applications CLI interactives Intégration de jSpecify pour améliorer la sécurité contre les NullPointerException Architecture plus modulaire permettant meilleure personnalisation et extension Documentation et exemples entièrement mis à jour pour faciliter la prise en main Guide de migration vers la v4 disponible sur le wiki du projet Corrections de bugs pour améliorer la stabilité et la fiabilité Permet de créer des applications Java autonomes exécutables avec java -jar ou GraalVM native Approche opinionnée du développement CLI tout en restant flexible pour les besoins spécifiques Une nouvelle version de la librairie qui implémenter des gatherers supplémentaires à ceux du JDK https://github.com/tginsberg/gatherers4j/releases/tag/v0.13.0 gatherers4j v0.13.0. Nouveaux gatherers : uniquelyOccurringBy(), moving/runningMedian(), moving/runningMax/Min(). Changement : les gatherers "moving" incluent désormais par défaut les valeurs partielles (utiliser excludePartialValues() pour désactiver). LangChain4j 1.10.0 https://github.com/langchain4j/langchain4j/releases/tag/1.10.0 Introduction d'un catalogue de modèles pour Anthropic, Gemini, OpenAI et Mistral. Ajout de capacités d'observabilité et de monitoring pour les agents. Support des sorties structurées, des outils avancés et de l'analyse de PDF via URL pour Anthropic. Support des services de transcription pour OpenAI. Possibilité de passer des paramètres de configuration de chat en argument des méthodes. Nouveau garde-fou de modération pour les messages entrants. Support du contenu de raisonnement pour les modèles. Introduction de la recherche hybride. Améliorations du client MCP. Départ du lead de mockito après 10 ans https://github.com/mockito/mockito/issues/3777 Tim van der Lippe, mainteneur majeur de Mockito, annonce son départ pour mars 2026, marquant une décennie de contribution au projet. L'une des raisons principales est l'épuisement lié aux changements récents dans la JVM (JVM 22+) concernant les agents, imposant des contraintes techniques lourdes sans alternative simple proposée par les mainteneurs du JDK. Il pointe du doigt le manque de soutien et la pression exercée sur les bénévoles de l'open source lors de ces transitions technologiques majeures. La complexité croissante pour supporter Kotlin, qui utilise la JVM de manière spécifique, rend la base de code de Mockito plus difficile à maintenir et moins agréable à faire évoluer selon lui. Il exprime une perte de plaisir et préfère désormais consacrer son temps libre à d'autres projets comme Servo, un moteur web écrit en Rust. Une période de transition est prévue jusqu'en mars pour assurer la passation de la maintenance à de nouveaux contributeurs. Infrastructure Le premier intérêt de Kubernetes n'est pas le scaling - https://mcorbin.fr/posts/2025-12-29-kubernetes-scale/ Avant Kubernetes, gérer des applications en production nécessitait de multiples outils complexes (Ansible, Puppet, Chef) avec beaucoup de configuration manuelle Le load balancing se faisait avec HAProxy et Keepalived en actif/passif, nécessitant des mises à jour manuelles de configuration à chaque changement d'instance Le service discovery et les rollouts étaient orchestrés manuellement, instance par instance, sans automatisation de la réconciliation Chaque stack (Java, Python, Ruby) avait sa propre méthode de déploiement, sans standardisation (rpm, deb, tar.gz, jar) La gestion des ressources était manuelle avec souvent une application par machine, créant du gaspillage et complexifiant la maintenance Kubernetes standardise tout en quelques ressources YAML (Deployment, Service, Ingress, ConfigMap, Secret) avec un format déclaratif simple Toutes les fonctionnalités critiques sont intégrées : service discovery, load balancing, scaling, stockage, firewalling, logging, tolérance aux pannes La complexité des centaines de scripts shell et playbooks Ansible maintenus avant était supérieure à celle de Kubernetes Kubernetes devient pertinent dès qu'on commence à reconstruire manuellement ces fonctionnalités, ce qui arrive très rapidement La technologie est flexible et peut gérer aussi bien des applications modernes que des monolithes legacy avec des contraintes spécifiques Mole https://github.com/tw93/Mole Un outil en ligne de commande (CLI) tout-en-un pour nettoyer et optimiser macOS. Combine les fonctionnalités de logiciels populaires comme CleanMyMac, AppCleaner, DaisyDisk et iStat Menus. Analyse et supprime en profondeur les caches, les fichiers logs et les résidus de navigateurs. Désinstallateur intelligent qui retire proprement les applications et leurs fichiers cachés (Launch Agents, préférences). Analyseur d'espace disque interactif pour visualiser l'occupation des fichiers et gérer les documents volumineux. Tableau de bord temps réel (mo status) pour surveiller le CPU, le GPU, la mémoire et le réseau. Fonction de purge spécifique pour les développeurs permettant de supprimer les artefacts de build (node_modules, target, etc.). Intégration possible avec Raycast ou Alfred pour un lancement rapide des commandes. Installation simple via Homebrew ou un script curl. Des images Docker sécurisées pour chaque développeur https://www.docker.com/blog/docker-hardened-images-for-every-developer/ Docker rend ses "Hardened Images" (DHI) gratuites et open source (licence Apache 2.0) pour tous les développeurs. Ces images sont conçues pour être minimales, prêtes pour la production et sécurisées dès le départ afin de lutter contre l'explosion des attaques sur la chaîne logistique logicielle. Elles s'appuient sur des bases familières comme Alpine et Debian, garantissant une compatibilité élevée et une migration facile. Chaque image inclut un SBOM (Software Bill of Materials) complet et vérifiable, ainsi qu'une provenance SLSA de niveau 3 pour une transparence totale. L'utilisation de ces images permet de réduire considérablement le nombre de vulnérabilités (CVE) et la taille des images (jusqu'à 95 % plus petites). Docker étend cette approche sécurisée aux graphiques Helm et aux serveurs MCP (Mongo, Grafana, GitHub, etc.). Des offres commerciales (DHI Enterprise) restent disponibles pour des besoins spécifiques : correctifs critiques sous 7 jours, support FIPS/FedRAMP ou support à cycle de vie étendu (ELS). Un assistant IA expérimental de Docker peut analyser les conteneurs existants pour recommander l'adoption des versions sécurisées correspondantes. L'initiative est soutenue par des partenaires majeurs tels que Google, MongoDB, Snyk et la CNCF. Web La maçonnerie ("masonry") arrive dans la spécification des CSS et commence à être implémentée par les navigateurs https://webkit.org/blog/17660/introducing-css-grid-lanes/ Permet de mettre en colonne des éléments HTML les uns à la suite des autres. D'abord sur la première ligne, et quand la première ligne est remplie, le prochain élément se trouvera dans la colonne où il pourra être le plus haut possible, et ainsi de suite. après la plomberie du middleware, la maçonnerie du front :laughing: Data et Intelligence Artificielle On ne devrait pas faire un mapping 1:1 entre API REST et MCP https://nordicapis.com/why-mcp-shouldnt-wrap-an-api-one-to-one/ Problématique : Envelopper une API telle quelle dans le protocole MCP (Model Context Protocol) est un anti-pattern. Objectif du MCP : Conçu pour les agents d'IA, il doit servir d'interface d'intention, non de miroir d'API. Les agents comprennent les tâches, pas la logique complexe des API (authentification, pagination, orchestration). Conséquences du mappage un-à-un : Confusion des agents, erreurs, hallucinations. Difficulté à gérer les orchestrations complexes (plusieurs appels pour une seule action). Exposition des faiblesses de l'API (schéma lourd, endpoints obsolètes). Maintenance accrue lors des changements d'API. Meilleure approche : Construire des outils MCP comme des SDK pour agents, encapsulant la logique nécessaire pour accomplir une tâche spécifique. Pratiques recommandées : Concevoir autour des intentions/actions utilisateur (ex. : "créer un projet", "résumer un document"). Regrouper les appels en workflows ou actions uniques. Utiliser un langage naturel pour les définitions et les noms. Limiter la surface d'exposition de l'API pour la sécurité et la clarté. Appliquer des schémas d'entrée/sortie stricts pour guider l'agent et réduire l'ambiguïté. Des agents en production avec AWS - https://blog.ippon.fr/2025/12/22/des-agents-en-production-avec-aws/ AWS re:Invent 2025 a massivement mis en avant l'IA générative et les agents IA Un agent IA combine un LLM, une boucle d'appel et des outils invocables Strands Agents SDK facilite le prototypage avec boucles ReAct intégrées et gestion de la mémoire Managed MLflow permet de tracer les expérimentations et définir des métriques de performance Nova Forge optimise les modèles par réentraînement sur données spécifiques pour réduire coûts et latence Bedrock Agent Core industrialise le déploiement avec runtime serverless et auto-scaling Agent Core propose neuf piliers dont observabilité, authentification, code interpreter et browser managé Le protocole MCP d'Anthropic standardise la fourniture d'outils aux agents SageMaker AI et Bedrock centralisent l'accès aux modèles closed source et open source via API unique AWS mise sur l'évolution des chatbots vers des systèmes agentiques optimisés avec modèles plus frugaux Debezium 3.4 amène plusieurs améliorations intéressantes https://debezium.io/blog/2025/12/16/debezium-3-4-final-released/ Correction du problème de calcul du low watermark Oracle qui causait des pertes de performance Correction de l'émission des événements heartbeat dans le connecteur Oracle avec les requêtes CTE Amélioration des logs pour comprendre les transactions actives dans le connecteur Oracle Memory guards pour protéger contre les schémas de base de données de grande taille Support de la transformation des coordonnées géométriques pour une meilleure gestion des données spatiales Extension Quarkus DevServices permettant de démarrer automatiquement une base de données et Debezium en dev Intégration OpenLineage pour tracer la lignée des données et suivre leur flux à travers les pipelines Compatibilité testée avec Kafka Connect 4.1 et Kafka brokers 4.1 Infinispan 16.0.4 et .5 https://infinispan.org/blog/2025/12/17/infinispan-16-0-4 Spring Boot 4 et Spring 7 supportés Evolution dans les metriques Deux bugs de serialisation Construire un agent de recherche en Java avec l'API Interactions https://glaforge.dev/posts/2026/01/03/building-a-research-assistant-with-the-interactions-api-in-java/ Assistant de recherche IA Java (API Interactions Gemini), test du SDK implémenté par Guillaume. Workflow en 4 phases : Planification : Gemini Flash + Google Search. Recherche : Modèle "Deep Research" (tâche de fond). Synthèse : Gemini Pro (rapport exécutif). Infographie : Nano Banana Pro (à partir de la synthèse). API Interactions : gestion d'état serveur, tâches en arrière-plan, réponses multimodales (images). Appréciation : gestion d'état de l'API (vs LLM sans état). Validation : efficacité du SDK Java pour cas complexes. Stephan Janssen (le papa de Devoxx) a créé un serveur MCP (Model Context Protocol) basé sur LSP (Language Server Protocol) pour que les assistants de code analysent le code en le comprenant vraiment plutôt qu'en faisant des grep https://github.com/stephanj/LSP4J-MCP Le problème identifié : Les assistants IA utilisent souvent la recherche textuelle (type grep) pour naviguer dans le code, ce qui manque de contexte sémantique, génère du bruit (faux positifs) et consomme énormément de tokens inutilement. La solution LSP4J-MCP : Une approche "standalone" (autonome) qui encapsule le serveur de langage Eclipse (JDTLS) via le protocole MCP (Model Context Protocol). Avantage principal : Offre une compréhension sémantique profonde du code Java (types, hiérarchies, références) sans nécessiter l'ouverture d'un IDE lourd comme IntelliJ. Comparaison des méthodes : AST : Trop léger (pas de compréhension inter-fichiers). IntelliJ MCP : Puissant mais exige que l'IDE soit ouvert (gourmand en ressources). LSP4J-MCP : Le meilleur des deux mondes pour les workflows en terminal, à distance (SSH) ou CI/CD. Fonctionnalités clés : Expose 5 outils pour l'IA (find_symbols, find_references, find_definition, document_symbols, find_interfaces_with_method). Résultats : Une réduction de 100x des tokens utilisés pour la navigation et une précision accrue (distinction des surcharges, des scopes, etc.). Disponibilité : Le projet est open source et disponible sur GitHub pour intégration immédiate (ex: avec Claude Code, Gemini CLI, etc). A noter l'ajout dans claude code 2.0.74 d'un tool pour supporter LSP ( https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#2074 ) Awesome (GitHub) Copilot https://github.com/github/awesome-copilot Une collection communautaire d'instructions, de prompts et de configurations pour optimiser l'utilisation de GitHub Copilot. Propose des "Agents" spécialisés qui s'intègrent aux serveurs MCP pour améliorer les flux de travail spécifiques. Inclut des prompts ciblés pour la génération de code, la documentation et la résolution de problèmes complexes. Fournit des instructions détaillées sur les standards de codage et les meilleures pratiques applicables à divers frameworks. Propose des "Skills" (compétences) sous forme de dossiers contenant des ressources pour des tâches techniques spécialisées. (les skills sont dispo dans copilot depuis un mois : https://github.blog/changelog/2025-12-18-github-copilot-now-supports-agent-skills/ ) Permet une installation facile via un serveur MCP dédié, compatible avec VS Code et Visual Studio. Encourage la contribution communautaire pour enrichir les bibliothèques de prompts et d'agents. Aide à augmenter la productivité en offrant des solutions pré-configurées pour de nombreux langages et domaines. Garanti par une licence MIT et maintenu activement par des contributeurs du monde entier. IA et productivité : bilan de l'année 2025 (Laura Tacho - DX)) https://newsletter.getdx.com/p/ai-and-productivity-year-in-review?aid=recNfypKAanQrKszT En 2025, l'ingénierie assistée par l'IA est devenue la norme : environ 90 % des développeurs utilisent des outils d'IA mensuellement, et plus de 40 % quotidiennement. Les chercheurs (Microsoft, Google, GitHub) soulignent que le nombre de lignes de code (LOC) reste un mauvais indicateur d'impact, car l'IA génère beaucoup de code sans forcément garantir une valeur métier supérieure. Si l'IA améliore l'efficacité individuelle, elle pourrait nuire à la collaboration à long terme, car les développeurs passent plus de temps à "parler" à l'IA qu'à leurs collègues. L'identité du développeur évolue : il passe de "producteur de code" à un rôle de "metteur en scène" qui délègue, valide et exerce son jugement stratégique. L'IA pourrait accélérer la montée en compétences des développeurs juniors en les forçant à gérer des projets et à déléguer plus tôt, agissant comme un "accélérateur" plutôt que de les rendre obsolètes. L'accent est mis sur la créativité plutôt que sur la simple automatisation, afin de réimaginer la manière de travailler et d'obtenir des résultats plus impactants. Le succès en 2026 dépendra de la capacité des entreprises à cibler les goulots d'étranglement réels (dette technique, documentation, conformité) plutôt que de tester simplement chaque nouveau modèle d'IA. La newsletter avertit que les titres de presse simplifient souvent à l'excès les recherches sur l'IA, masquant parfois les nuances cruciales des études réelles. Un développeur décrit dans un article sur Twitter son utilisation avancée de Claude Code pour le développement, avec des sous-agents, des slash-commands, comment optimiser le contexte, etc. https://x.com/AureaLibe/status/2008958120878330329?s=20 Outillage IntelliJ IDEA, thread dumps et project Loom (virtual threads) - https://blog.jetbrains.com/idea/2025/12/thread-dumps-and-project-loom-virtual-threads/ Les virtual threads Java améliorent l'utilisation du matériel pour les opérations I/O parallèles avec peu de changements de code Un serveur peut maintenant gérer des millions de threads au lieu de quelques centaines Les outils existants peinent à afficher et analyser des millions de threads simultanément Le débogage asynchrone est complexe car le scheduler et le worker s'exécutent dans des threads différents Les thread dumps restent essentiels pour diagnostiquer deadlocks, UI bloquées et fuites de threads Netflix a découvert un deadlock lié aux virtual threads en analysant un heap dump, bug corrigé dans Java 25. Mais c'était de la haute voltige IntelliJ IDEA supporte nativement les virtual threads dès leur sortie avec affichage des locks acquis IntelliJ IDEA peut ouvrir des thread dumps générés par d'autres outils comme jcmd Le support s'étend aussi aux coroutines Kotlin en plus des virtual threads Quelques infos sur IntelliJ IDEA 2025.3 https://blog.jetbrains.com/idea/2025/12/intellij-idea-2025-3/ Distribution unifiée regroupant davantage de fonctionnalités gratuites Amélioration de la complétion des commandes dans l'IDE Nouvelles fonctionnalités pour le débogueur Spring Thème Islands devient le thème par défaut Support complet de Spring Boot 4 et Spring Framework 7 Compatibilité avec Java 25 Prise en charge de Spring Data JDBC et Vitest 4 Support natif de Junie et Claude Agent pour l'IA Quota d'IA transparent et option Bring Your Own Key à venir Corrections de stabilité, performance et expérience utilisateur Plein de petits outils en ligne pour le développeur https://blgardner.github.io/prism.tools/ génération de mot de passe, de gradient CSS, de QR code encodage décodage de Base64, JWT formattage de JSON, etc. resumectl - Votre CV en tant que code https://juhnny5.github.io/resumectl/ Un outil en ligne de commande (CLI) écrit en Go pour générer un CV à partir d'un fichier YAML. Permet l'exportation vers plusieurs formats : PDF, HTML, ou un affichage direct dans le terminal. Propose 5 thèmes intégrés (Modern, Classic, Minimal, Elegant, Tech) personnalisables avec des couleurs spécifiques. Fonctionnalité d'initialisation (resumectl init) permettant d'importer automatiquement des données depuis LinkedIn et GitHub (projets les plus étoilés). Supporte l'ajout de photos avec des options de filtre noir et blanc ou de forme (rond/carré). Inclut un mode "serveur" (resumectl serve) pour prévisualiser les modifications en temps réel via un navigateur local. Fonctionne comme un binaire unique sans dépendances externes complexes pour les modèles. mactop - Un moniteur "top" pour Apple Silicon https://github.com/metaspartan/mactop Un outil de surveillance en ligne de commande (TUI) conçu spécifiquement pour les puces Apple Silicon (M1, M2, M3, M4, M5). Permet de suivre en temps réel l'utilisation du CPU (E-cores et P-cores), du GPU et de l'ANE (Neural Engine). Affiche la consommation électrique (wattage) du système, du CPU, du GPU et de la DRAM. Fournit des données sur les températures du SoC, les fréquences du GPU et l'état thermique global. Surveille l'utilisation de la mémoire vive, de la swap, ainsi que l'activité réseau et disque (E/S). Propose 10 mises en page (layouts) différentes et plusieurs thèmes de couleurs personnalisables. Ne nécessite pas l'utilisation de sudo car il s'appuie sur les API natives d'Apple (SMC, IOReport, IOKit). Inclut une liste de processus détaillée (similaire à htop) avec la possibilité de tuer des processus directement depuis l'interface. Offre un mode "headless" pour exporter les métriques au format JSON et un serveur optionnel pour Prometheus. Développé en Go avec des composants en CGO et Objective-C. Adieu direnv, Bonjour misehttps://codeka.io/2025/12/19/adieu-direnv-bonjour-mise/ L'auteur remplace ses outils habituels (direnv, asdf, task, just) par un seul outil polyvalent écrit en Rust : mise. mise propose trois fonctions principales : gestionnaire de paquets (langages et outils), gestionnaire de variables d'environnement et exécuteur de tâches. Contrairement à direnv, il permet de gérer des alias et utilise un fichier de configuration structuré (mise.toml) plutôt que du scripting shell. La configuration est hiérarchique, permettant de surcharger les paramètres selon les répertoires, avec un système de "trust" pour la sécurité. Une "killer-feature" soulignée est la gestion des secrets : mise s'intègre avec age pour chiffrer des secrets (via clés SSH) directement dans le fichier de configuration. L'outil supporte une vaste liste de langages et d'outils via un registre interne et des plugins (compatibilité avec l'écosystème asdf). Il simplifie le workflow de développement en regroupant l'installation des outils et l'automatisation des tâches au sein d'un même fichier. L'auteur conclut sur la puissance, la flexibilité et les excellentes performances de l'outil après quelques heures de test. Claude Code v2.1.0 https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#210 Rechargement à chaud des "skills" : Les modifications apportées aux compétences dans ~/.claude/skills sont désormais appliquées instantanément sans redémarrer la session. Sous-agents et forks : Support de l'exécution de compétences et de commandes slash dans un contexte de sous-agent forké via context: fork. Réglages linguistiques : Ajout d'un paramètre language pour configurer la langue de réponse par défaut (ex: language: "french"). Améliorations du terminal : Shift+Enter fonctionne désormais nativement dans plusieurs terminaux (iTerm2, WezTerm, Ghostty, Kitty) sans configuration manuelle. Sécurité et correction de bugs : Correction d'une faille où des données sensibles (clés API, tokens OAuth) pouvaient apparaître dans les logs de débogage. Nouvelles commandes slash : Ajout de /teleport et /remote-env pour les abonnés claude.ai afin de gérer des sessions distantes. Mode Plan : Le raccourci /plan permet d'activer le mode plan directement depuis le prompt, et la demande de permission à l'entrée de ce mode a été supprimée. Vim et navigation : Ajout de nombreux mouvements Vim (text objects, répétitions de mouvements f/F/t/T, indentations, etc.). Performance : Optimisation du temps de démarrage et du rendu terminal pour les caractères Unicode/Emoji. Gestion du gitignore : Support du réglage respectGitignore dans settings.json pour contrôler le comportement du sélecteur de fichiers @-mention. Méthodologies 200 déploiements en production par jour, même le vendredi : retours d'expérience https://mcorbin.fr/posts/2025-03-21-deploy-200/ Le déploiement fréquent, y compris le vendredi, est un indicateur de maturité technique et augmente la productivité globale. L'excellence technique est un atout stratégique indispensable pour livrer rapidement des produits de qualité. Une architecture pragmatique orientée services (SOA) facilite les déploiements indépendants et réduit la charge cognitive. L'isolation des services est cruciale : un développeur doit pouvoir tester son service localement sans dépendre de toute l'infrastructure. L'automatisation via Kubernetes et l'approche GitOps avec ArgoCD permettent des déploiements continus et sécurisés. Les feature flags et un système de permissions solide permettent de découpler le déploiement technique de l'activation fonctionnelle pour les utilisateurs. L'autonomie des développeurs est renforcée par des outils en self-service (CLI maison) pour gérer l'infrastructure et diagnostiquer les incidents sans goulot d'étranglement. Une culture d'observabilité intégrée dès la conception permet de détecter et de réagir rapidement aux anomalies en production. Accepter l'échec comme inévitable permet de concevoir des systèmes plus résilients capables de se rétablir automatiquement. "Vibe Coding" vs "Prompt Engineering" : l'IA et le futur du développement logiciel https://www.romenrg.com/blog/2025/12/25/vibe-coding-vs-prompt-engineering-ai-and-the-future-of-software-development/ L'IA est passée du statut d'expérimentation à celui d'infrastructure essentielle pour le développement de logiciels en 2025. L'IA ne remplace pas les ingénieurs, mais agit comme un amplificateur de leurs compétences, de leur jugement et de la qualité de leur réflexion. Distinction entre le "Vibe Coding" (rapide, intuitif, idéal pour les prototypes) et le "Prompt Engineering" (délibéré, contraint, nécessaire pour les systèmes maintenables). L'importance cruciale du contexte ("Context Engineering") : l'IA devient réellement puissante lorsqu'elle est connectée aux systèmes réels (GitHub, Jira, etc.) via des protocoles comme le MCP. Utilisation d'agents spécialisés (écriture de RFC, revue de code, architecture) plutôt que de modèles génériques pour obtenir de meilleurs résultats. Émergence de l'ingénieur "Technical Product Manager" capable d'abattre seul le travail d'une petite équipe grâce à l'IA, à condition de maîtriser les fondamentaux techniques. Le risque majeur : l'IA permet d'aller très vite dans la mauvaise direction si le jugement humain et l'expérience font défaut. Le niveau d'exigence global augmente : les bases techniques solides deviennent plus importantes que jamais pour éviter l'accumulation de dette technique rapide. Une revue de code en solo (Kent Beck) ! https://tidyfirst.substack.com/p/party-of-one-for-code-review?r=64ov3&utm_campaign=post&utm_medium=web&triedRedirect=true La revue de code traditionnelle, héritée des inspections formelles d'IBM, s'essouffle car elle est devenue trop lente et asynchrone par rapport au rythme du développement moderne. Avec l'arrivée de l'IA ("le génie"), la vitesse de production du code dépasse la capacité de relecture humaine, créant un goulot d'étranglement majeur. La revue de code doit évoluer vers deux nouveaux objectifs prioritaires : un "sanity check" pour vérifier que l'IA a bien fait ce qu'on lui demandait, et le contrôle de la dérive structurelle de la base de code. Maintenir une structure saine est crucial non seulement pour les futurs développeurs humains, mais aussi pour que l'IA puisse continuer à comprendre et modifier le code efficacement sans perdre le contexte. Kent Beck expérimente des outils automatisés (comme CodeRabbit) pour obtenir des résumés et des schémas d'architecture afin de garder une conscience globale des changements rapides. Même si les outils automatisés sont utiles, le "Pair Programming" reste irremplaçable pour la richesse des échanges et la pression sociale bénéfique qu'il impose à la réflexion. La revue de code solo n'est pas une fin en soi, mais une adaptation nécessaire lorsque l'on travaille seul avec des outils de génération de code augmentés. Loi, société et organisation Lego lance les Lego Smart Play, avec des Brique, des Smart Tags et des Smart Figurines pour faire de nouvelles constructions interactives avec des Legos https://www.lego.com/fr-fr/smart-play LEGO SMART Play : technologie réactive au jeu des enfants. Trois éléments clés : SMART Brique : Brique LEGO 2x4 "cerveau". Accéléromètre, lumières réactives, détecteur de couleurs, synthétiseur sonore. Réagit aux mouvements (tenir, tourner, taper). SMART Tags : Petites pièces intelligentes. Indiquent à la SMART Brique son rôle (ex: hélicoptère, voiture) et les sons à produire. Activent sons, mini-jeux, missions secrètes. SMART Minifigurines : Activées près d'une SMART Brique. Révèlent des personnalités uniques (sons, humeurs, réactions) via la SMART Brique. Encouragent l'imagination. Fonctionnement : SMART Brique détecte SMART Tags et SMART Minifigurines. Réagit aux mouvements avec lumières et sons dynamiques. Compatibilité : S'assemble avec les briques LEGO classiques. Objectif : Créer des expériences de jeu interactives, uniques et illimitées. Conférences La liste des conférences provenant de Developers Conferences Agenda/List par Aurélie Vache et contributeurs : 14-17 janvier 2026 : SnowCamp 2026 - Grenoble (France) 22 janvier 2026 : DevCon #26 : sécurité / post-quantique / hacking - Paris (France) 28 janvier 2026 : Software Heritage Symposium - Paris (France) 29-31 janvier 2026 : Epitech Summit 2026 - Paris - Paris (France) 2-5 février 2026 : Epitech Summit 2026 - Moulins - Moulins (France) 3 février 2026 : Cloud Native Days France 2026 - Paris (France) 3-4 février 2026 : Epitech Summit 2026 - Lille - Lille (France) 3-4 février 2026 : Epitech Summit 2026 - Mulhouse - Mulhouse (France) 3-4 février 2026 : Epitech Summit 2026 - Nancy - Nancy (France) 3-4 février 2026 : Epitech Summit 2026 - Nantes - Nantes (France) 3-4 février 2026 : Epitech Summit 2026 - Marseille - Marseille (France) 3-4 février 2026 : Epitech Summit 2026 - Rennes - Rennes (France) 3-4 février 2026 : Epitech Summit 2026 - Montpellier - Montpellier (France) 3-4 février 2026 : Epitech Summit 2026 - Strasbourg - Strasbourg (France) 3-4 février 2026 : Epitech Summit 2026 - Toulouse - Toulouse (France) 4-5 février 2026 : Epitech Summit 2026 - Bordeaux - Bordeaux (France) 4-5 février 2026 : Epitech Summit 2026 - Lyon - Lyon (France) 4-6 février 2026 : Epitech Summit 2026 - Nice - Nice (France) 5 février 2026 : Web Days Convention - Aix-en-Provence (France) 12 février 2026 : Strasbourg Craft #1 - Strasbourg (France) 12-13 février 2026 : Touraine Tech #26 - Tours (France) 19 février 2026 : ObservabilityCON on the Road - Paris (France) 6 mars 2026 : WordCamp Nice 2026 - Nice (France) 18-19 mars 2026 : Agile Niort 2026 - Niort (France) 20 mars 2026 : Atlantique Day 2026 - Nantes (France) 26 mars 2026 : Data Days Lille - Lille (France) 26-27 mars 2026 : SymfonyLive Paris 2026 - Paris (France) 26-27 mars 2026 : REACT PARIS - Paris (France) 27-29 mars 2026 : Shift - Nantes (France) 31 mars 2026 : ParisTestConf - Paris (France) 1 avril 2026 : AWS Summit Paris - Paris (France) 2 avril 2026 : Pragma Cannes 2026 - Cannes (France) 9-10 avril 2026 : AndroidMakers by droidcon - Paris (France) 16-17 avril 2026 : MiXiT 2026 - Lyon (France) 22-24 avril 2026 : Devoxx France 2026 - Paris (France) 23-25 avril 2026 : Devoxx Greece - Athens (Greece) 24-25 avril 2026 : Faiseuses du Web 5 - Dinan (France) 6-7 mai 2026 : Devoxx UK 2026 - London (UK) 22 mai 2026 : AFUP Day 2026 Lille - Lille (France) 22 mai 2026 : AFUP Day 2026 Paris - Paris (France) 22 mai 2026 : AFUP Day 2026 Bordeaux - Bordeaux (France) 22 mai 2026 : AFUP Day 2026 Lyon - Lyon (France) 29 mai 2026 : NG Baguette Conf 2026 - Paris (France) 5 juin 2026 : TechReady - Nantes (France) 5 juin 2026 : Fork it! - Rouen - Rouen (France) 6 juin 2026 : Polycloud - Montpellier (France) 11-12 juin 2026 : DevQuest Niort - Niort (France) 11-12 juin 2026 : DevLille 2026 - Lille (France) 12 juin 2026 : Tech F'Est 2026 - Nancy (France) 17-19 juin 2026 : Devoxx Poland - Krakow (Poland) 17-20 juin 2026 : VivaTech - Paris (France) 2 juillet 2026 : Azur Tech Summer 2026 - Valbonne (France) 2-3 juillet 2026 : Sunny Tech - Montpellier (France) 3 juillet 2026 : Agile Lyon 2026 - Lyon (France) 2 août 2026 : 4th Tech Summit on Artificial Intelligence & Robotics - Paris (France) 4 septembre 2026 : JUG Summer Camp 2026 - La Rochelle (France) 17-18 septembre 2026 : API Platform Conference 2026 - Lille (France) 24 septembre 2026 : PlatformCon Live Day Paris 2026 - Paris (France) 1 octobre 2026 : WAX 2026 - Marseille (France) 1-2 octobre 2026 : Volcamp - Clermont-Ferrand (France) 5-9 octobre 2026 : Devoxx Belgium - Antwerp (Belgium) Nous contacter Pour réagir à cet épisode, venez discuter sur le groupe Google https://groups.google.com/group/lescastcodeurs Contactez-nous via X/twitter https://twitter.com/lescastcodeurs ou Bluesky https://bsky.app/profile/lescastcodeurs.com Faire un crowdcast ou une crowdquestion Soutenez Les Cast Codeurs sur Patreon https://www.patreon.com/LesCastCodeurs Tous les épisodes et toutes les infos sur https://lescastcodeurs.com/

In this episode, Seth and Ken debate OpenAI's Atlas browser, which embeds AI into web browsing. Ken views it as a major privacy concern, potentially accelerating invasive data collection and surveillance. Seth noted that new browsers historically have critical flaws. They acknowledged that AI is very useful for generic and technical internet searches. They discussed the Co-Fish attack, a phishing vulnerability in Microsoft Copilot Studio that could exfiltrate access tokens via a seemingly valid Microsoft URL. Finally, they noted that big companies like Snyk and Black Duck are moving toward agentic AI capabilities, confirming the industry trend.

It's State from SNYK with Eru from @Diehardknickspc, back with another Die Hard State Of Mind Episode!The Knicks fall 115-107 to the Miami Heat, and we're breaking it all down — the good, the bad, and everything in between. We take a deep dive into the team's performance, the numbers that stand out, and who showed up on the court.Jalen Brunson was my Player of the Game — we talk about his impact, his stats, and why he continues to carry this squad.We also get into the recent NBA gambling scandal, what it means for the league and the players, and wrap up with a real conversation Is Jalen Brunson a superstar?

Guy spent 2 years and $4M building Snyk to $100K ARR. Thousands of developers loved the product. They just wouldn't pay.Then he figured out the problem: he had product-user fit, but not product-buyer fit. Developers loved Snyk. Security teams (the actual buyers) didn't care about it. The distance between user and buyer was killing him.So Guy spent a year building governance features, reporting, and enterprise capabilities—all the stuff developers didn't care about but security teams needed to write checks. Four months later, Snyk hit $650K ARR. A year after that, $4.5M. Then $19M. Today it's over $300M ARR.This episode breaks down the brutal reality of PLG when your user isn't your buyer, why Guy thinks the worst outcome for a founder is getting stuck (not failing), and how he's now raising $125M for his next company Tessl.If you're building PLG, selling to enterprise, or wondering why your users love you but won't pay—this is required listening.Why You Should Listen:Learn why thousands of users loving your product means nothing if they won't payDiscover the difference between product-user fit and product-buyer fitUnderstand why the worst outcome isn't failure—it's getting stuck in the grey zoneMaster the art of anchoring in the future instead of just filling today's gapsKeywords:startup podcast, startup podcast for founders, product market fit, PLG strategy, product-user fit vs product-buyer fit, developer tools, security startup, enterprise sales, bottoms-up GTM, Snyk founderChapters:(00:00:00) Intro(00:01:37) The first start up :Blaze.io"(00:06:16) The Beginning & Concept of Skyk(00:15:27) Why use Snyk(00:23:41) The Product Led Growth for Snyk(00:33:08) Raising for Snyk(00:38:58) The Beginning & Concept of TESL(00:46:39) Raising for TESL(00:48:52) Finding PMF(00:49:26) One Piece of AdviceSend me a message to let me know what you think!

F5 discloses long-term breach tied to nation-state actors. PowerSchool hacker receives a four-year prison sentence. Senator scrutinizes Cisco critical firewall vulnerabilities. Phishing campaign impersonates LastPass and Bitwarden. Credential phishing with Google Careers. Reduce effort, reuse past breaches, recycle into new breach. Qilin announces new victims. Manoj Nair, from Snyk, joins us to explore the future of AI security and the emerging risks shaping this rapidly evolving landscape. And AI faces the facts. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Manoj Nair, Chief Innovation Officer at Snyk, joins us to explore the future of AI security and the emerging risks shaping this rapidly evolving landscape. In light of the recent high-severity vulnerability in Cursor, Manoj discusses how threats like tool poisoning, toxic flows, and MCP vulnerabilities are redefining what secure AI-driven development means—and why organizations must move faster to keep up. Selected Reading F5 disclosures breach tied to nation-state threat actor (CyberScoop) CISA Directs Federal Agencies to Mitigate Vulnerabilities in F5 Devices (CISA) ED 26-01: Mitigate Vulnerabilities in F5 Devices (CISA)  PowerSchool hacker sentenced to 4 years in prison (The Record)  Cisco faces Senate scrutiny over firewall flaws (The Register) Fake LastPass, Bitwarden breach alerts lead to PC hijacks (Bleeping Computer)  Google Careers impersonation credential phishing scam with endless variation (Sublime Security)  Elasticsearch Leak Exposes 6 Billion Records from Scraping, Old and New Breaches (HackRead)  Qilin Ransomware announced new victims (Security Affairs)  When Face Recognition Doesn't Know Your Face Is a Face (WIRED) Semperis Announces Midnight in the War Room: A Groundbreaking Cyberwar Documentary Featuring the World's Leading Defenders and Reformed Hackers (PR Newswire) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Send us a textThe enterprise software landscape in 2025 continues to evolve at a breakneck pace, marked by a surge of strategic acquisitions, partnerships, and AI-driven innovations. Acumatica's acquisition by Vista Equity Partners signals a new phase of investment and potential scaling for the mid-market ERP leader. Meanwhile, alliances like Capgemini's expanded collaboration with Mistral AI and SAP, and SAP's new partnership with Alibaba Group, underscore the growing importance of regional and AI-native synergies. On the AI front, DataRobot's open-source framework for agentic workflows and Deloitte's launch of a Global Agentic Network both highlight the race to operationalize autonomous digital workforces. Product innovation also remains intense: Snyk's AI Trust Platform, Gainsight's Atlas, and Similarweb's AI Agent collections illustrate how vendors are embedding intelligence across ecosystems. Complementing this trend, Invoca's acquisition of Symbl.ai and Salesforce's plan to acquire Informatica show how data and conversational intelligence are becoming central to customer engagement strategies. Even digital service providers like TELUS Digital are doubling down on CRM-centric growth through the acquisition of Gerent, reflecting how every layer of the enterprise stack is being redefined by AI and data infrastructure convergence.In today's episode, we invited a panel of industry analysts for a live discussion on LinkedIn to analyze current enterprise software stories. We covered many grounds including the direction and roadmaps of each enterprise software vendors. Finally, we analyzed future trends and how they might shape the enterprise software industry.Background Soundtrack: Away From You – Mauro SommFor more information on growth strategies for SMBs using ERP and digital transformation, visit our community at wbs. rocks or elevatiq.com. To ensure that you never miss an episode of the WBS podcast, subscribe on your favorite podcasting platform. 

Send us a textIn this episode of the ABM Done Right Podcast, Eric Gruber (CEO of Personal ABM) talks to Rachel Donner at Snyk about their ABM programs in relation to their customer success programs. You will hear:1. How true ABM belongs closer to sales and CS than marketing, and why the CRO and CCO should own it.2.  What true 1:1 ABM is - and how Snyk is using it to drive adoption, retention, and account expansion. 4.  The 1:1 ABM content that is needed to protect and expand accounts.  

Alex is joined by Guy Podjarny, serial entrepreneur and Founder and CEO at Tessl (and Founder of Snyk). In the episode, they discuss Guy's incredible journey from founding Snyk (valued at $8.5B at its peak) to leaving the unicorn he built to tackle the next frontier: reimagining software development for the AI era. Guy reveals why he believes software development will evolve from code-centric to spec-centric, how Tessl raised $125M to build this vision, and the lessons he's learned about scaling AI-native companies in this ‘gold rush' environment. He discusses the challenges of building for an unknown future, managing high-caliber teams, and why he's already rebuilt his product three times. Guest links: LinkedIn: https://www.linkedin.com/in/guypo/ Website: https://tessl.io/ Hear more from Guy on stage at SaaStock Europe. https://saastock-europe.com/tickets/       Check out the other ways SaaStock is helping SaaS founders move their business forward: 

Plex urges users to immediately update their Media Server due to an undisclosed security flaw. Cisco warns of a critical remote code execution flaw in their Secure Firewall Management Center software.Rockwell Automation discloses multiple critical and high-severity flaws. Hackers breached a Canadian House of Commons database. Active law enforcement and government email accounts are sold online for as little as $40. Telecom giant Colt Technology Services suffers a cyber incident disrupting its customer portal. Taiwan launches new measures to boost hospital cybersecurity after ransomware attacks.  NIST has released a concept paper proposing control overlays for securing AI systems. A date with an AI chatbot ends in tragedy. Our guest is Randall Degges, Snyk's Head of Developer and Security Relations, to discuss how underqualified or outsourced coding support can open doors for nation-state threats. Dutch speed cameras are stuck in a cyber-induced siesta. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Randall Degges, Snyk's Head of Developer and Security Relations, to discuss how underqualified or outsourced coding support can open doors for nation-state threats. Selected Reading Plex warns users to patch security vulnerability immediately (Bleeping Computer) Cisco Discloses Critical RCE Flaw in Firewall Management Software (Infosecurity Magazine) Critical Flaws Patched in Rockwell FactoryTalk, Micro800, ControlLogix Products (SecurityWeek) CISA Releases Thirty-Two Industrial Control Systems Advisories (CISA.gov) Hackers Breach Canadian Government Via Microsoft Exploit (Bank Infosecurity) Compromised Government and Police Email Accounts on the Dark Web (Abnormal.AI) Telco giant Colt suffers attack, takes systems offline (The Register) Taiwan announces measures to protect hospitals from hackers (Focus Taiwan) New NIST Concept Paper Outlines AI-Specific Cybersecurity Framework (Hack Read) A flirty Meta AI bot invited a retiree to meet. He never made it home. (Reuters) Dutch prosecution service attack keeps speed cameras offline (The Register) Audience Survey Complete our annual audience survey before August 31. Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Episode SummaryWill AI replace developers? In this episode, Snyk CTO Danny Allan chats with Michael Grinich, the founder and CEO of WorkOS, about the evolving landscape of software development in the age of AI. Michael shares a fascinating analogy, comparing the shift in software engineering to the historical evolution of music, from every family having a piano to the modern era of digital creation with tools like GarageBand. They explore the concept of "vibe coding," the future of development frameworks, and how lessons from the browser wars—specifically the advent of sandboxing—can inform how we build secure AI-driven applications.Show NotesIn this episode, Danny Allan, CTO at Snyk, is joined by Michael Grinich, Founder and CEO of WorkOS, to explore the profound impact of AI on the world of software development. Michael discusses WorkOS's mission to enhance developer joy by providing robust, enterprise-ready features like authentication, user management, and security, allowing developers to remain in a creative flow state. The conversation kicks off with the provocative question of whether AI will replace developers. Michael offers a compelling analogy, comparing the current shift to the historical evolution of music, from a time when a piano was a household staple to the modern era where tools like GarageBand and Ableton have democratized music creation. He argues that while the role of a software engineer will fundamentally change, it won't disappear; rather, it will enable more people to create software in entirely new ways.The discussion then moves into the practical and security implications of this new paradigm, including the concept of "vibe coding," where applications can be generated on the fly based on a user's description. Michael cautions that you can't "vibe code" your security infrastructure, drawing a parallel to the early, vulnerable days of web browsers before sandboxing became a standard. He predicts that a similar evolution is necessary for the AI world, requiring new frameworks with tightly defined security boundaries to contain potentially buggy, AI-generated code.Looking to the future, Michael shares his optimism for the emergence of open standards in the AI space, highlighting the collaborative development around the Model Context Protocol (MCP) by companies like Anthropic, OpenAI, Cloudflare, and Microsoft. He believes this trend toward openness, much like the open standards of the web (HTML, HTTP), will prevent a winner-take-all scenario and foster a more innovative and accessible ecosystem. The episode wraps up with a look at the incredible energy in the developer community and how the challenge of the next decade will be distributing this powerful new technology to every industry in a safe, secure, and trustworthy manner.LinksWorkOS - Your app, enterprise readyWorkOS on YouTubeMITMCP Night 2025Snyk - The Developer Security Company Follow UsOur WebsiteOur LinkedIn

Are you building a sales org from scratch? Or rebuilding one in the middle of an AI boom? If so, this episode is your field guide. CJ sits down with Ethan Schechter, SVP of Global Sales and Customer Success at Qodo (and the guy who helped take Snyk from $0 to $100M+ in revenue), to talk about the wild days of early-stage sales leadership. Ethan shares how he navigates “basecamp” moments and the “smile” and “cry” days of year one. He explains his approach to hiring for a new org, building internal trust while over-communicating, designing incentive structures for the early days, trading dollars for speed through discounting, and staying competitive in the fast-changing era of AI. The episode ends with an entertaining roast of LinkedIn's cringe posts, from fake ARR math to self-given nicknames and beyond.—LINKS:Ethan Schechter on LinkedIn: https://www.linkedin.com/in/ethanschechterQodo: https://www.qodo.aiCJ on X (@cjgustafson222): https://x.com/cjgustafson222Mostly metrics: RELATED EPISODES:A CFO's Guide to Understanding Sales Teams, featuring Snyk's Ethan Schechter — —TIMESTAMPS:(00:00) Preview and Intro(02:07) Sponsor – Navan | Rillet | Pulley(06:10) Ethan's Career as an Early-Stage Sales Leader and Understanding Equity(10:04) The “Basecamp” Mindset and Restarting Strong(12:33) Building Out Your Rules of Engagement(14:25) Sponsor – Brex | Aleph | RightRev(18:45) Navigating the “Smile and Cry” Days of Year One(24:03) Ethan's Approach to Hiring for a New Org(27:38) Building Trust With Founders as a New Sales Leader(30:19) Incentives: Creating a Commission Plan for the Early Days(34:10) Why You “Can't Divide Zero”: Handling Deal Splits(35:52) Other Early-Stage-Isms or Philosophies(38:52) Discounting at an Early-Stage Company(41:17) Selling in Today's Environment: Competitive Trap-Setting(44:47) Budgets for AI Products: Experimental ARR(45:50) Monthly Deals and Decision Cycles in the Current Environment(47:33) Remaining Competitive in the Era of AI(51:08) The Lighter (and Cringier) Side of LinkedIn(1:03:01) Wrap—SPONSORS:Navan is the all-in-one travel and expense solution that helps finance teams streamline reconciliation, enforce policies automatically, and gain real-time visibility. It connects to your existing cards and makes closing the books faster and smarter. Visit https://navan.com/runthenumbers for your demo.Rillet is the AI-native ERP modern finance teams are switching to because it's faster, simpler, and 100% built for how teams operate today. See how fast your team can move. Book a demo at https://www.rillet.com/metrics.Pulley is the cap table management platform built for CFOs and finance leaders who need reliable, audit-ready data and intuitive workflows, without the hidden fees or unreliable support. Switch in as little as 5 days and get 25% off your first year: https://pulley.com/mostlymetrics.Brex offers the world's smartest corporate card on a full-stack global platform that is everything CFOs need to manage their finances on an elite level. Plus, they offer modern banking and treasury as well as intuitive expenses and accounting automation, bill pay, and travel. Find out more at https://www.brex.com/metricsAleph automates 90% of manual, error-prone busywork, so you can focus on the strategic work you were hired to do. Minimize busywork and maximize impact with the power of a web app, the flexibility of spreadsheets, and the magic of AI. Get a personalised demo at https://www.getaleph.com/runRightRev automates the revenue recognition process from end to end, gives you real-time insights, and ensures ASC 606 / IFRS 15 compliance—all while closing books faster. For RevRec that auditors actually trust, visit https://www.rightrev.com and schedule a demo.#SalesLeadership #StartupSales #SalesStrategy #SalesCompensation #discounting This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.mostlymetrics.com

Join us every Friday as we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

The current phase of software development is probably the most insecure era ever — there's so much more application and code that's vulnerable, according to Snyk CEO Peter McKay. “It was a struggle for security teams to keep up with the pace of software development prior to generative AI, and now with generative and copilot and Windsurf and all the tools that are out there, you know, they're moving even faster and security is struggling to keep up.” McKay joins Bloomberg Intelligence's head of technology research, Mandeep Singh, to discuss the application of large-language models for securing the use of tools, including Cursor and Github copilots. He also talks about the addressable market for DevSecOps (the development, security and operations approach), potential automation driven by AI and Snyk's acquisitions for both talent and product features as the attack surface expands in cybersecurity.

Send us a text00:00 - Intro00:53 - Harvey Eyes $5B Primary Valuation Amid Legal AI Surge01:58 - Wealthfront Preps IPO After Strong $290M Revenue02:42 - Snyk Acquires Invariant to Secure AI Risks03:47 - PlayAI In Acquisition Talks With Meta04:46 - OpenAI and Microsoft Clash Over AGI Clause06:12 - Kalshi Hits $2B Primary Valuation Amid Legal Wins07:00 - Polymarket Nears $1B Valuation With $200M Raise07:49 - Melio Acquired by Xero at $2.5B

Connect to John Gilroy on LinkedIn   https://www.linkedin.com/in/john-gilroy/ Want to listen to other episodes? www.Federaltechpodcast.com There is a whirlwind of change in federal technology. For example, Federal News Network has reported that 25% of the IRS technology staff have left. Additionally, funding has been reduced, data stores are increasing, and we are all trying to understand the impact of Artificial Intelligence. Today, we sat down with Phoebe Nerdahl and Sayed Said from SNYK. They offer solutions to address the challenges of changing technology in this environment. The approach from SNYK is to start at the beginning of the code development process, what is called a shift left. They discussed the need for a secure framework for AI adoption, leveraging Snyk's proprietary database and security research team to enhance code security. The conversation also touches on the evolving definition of AI and its integration into various applications. Snyk's AI Trust Platform aims to protect against insecure AI-generated code, emphasizing continuous security monitoring and automation. They have a vulnerability database, which enables them to review code for potential issues. Further, their platform can automate this needed remediation.

In this episode of Change Fluency, Jay Kiew speaks with Ashley Miller, Senior Manager, Global Workplace at Snyk , who draws on her career journey at Snyk, WeWork, Nike, UnderArmour, and Wayfair to provide insights into workplace experiences. They discuss the valuable skills gained from retail and hospitality, the evolution of workspaces in a hybrid environment, and the importance of creating community and connection among employees. Ashley shares her thoughts on leveraging technology to enhance the workplace experience and the need for bold moves in shaping the future of work.You can find Ashley at https://www.linkedin.com/in/ashley-miller-75607a27/

On this episode of the Cybersecurity Defenders Podcast we speak with Filip Stojkovski, Staff Security Engineer at Snyk.Filip is a cybersecurity professional with over 15 years of experience. He began his career as a SOC analyst and now leads SecOps engineering at Snyk. Filip also advises organizations on SOAR, AI for SOC, and threat intelligence strategies. He holds multiple SANS certifications, including GSTRT, GCTI, and GCFA, and was recognized as “Threat Seeker of the Year.” He is the creator of the LEAD Threat Intelligence Framework and the Security Automation Development Life Cycle. Filip regularly shares his expertise through industry talks and on his blog: Cyber Security Automation and Orchestration

What does it mean to be a “day one partner” for founders—and how does that change in an era of AI-driven acceleration?On this episode of The Data Minute, Peter sits down with Ed Sim, founding partner of Boldstart Ventures and the voice behind “What's Hot

Large language models are helping developers move faster than ever. But behind the convenience of AI-generated code lies a security vulnerability: package hallucinations. In this episode, Ashok sits down with U.S. Army cybersecurity officer and PhD researcher Joe Spracklen to unpack new research on how hallucinated package names—fake libraries that don't yet exist—can be weaponized by attackers and quietly introduced into your software supply chain. Joe's recent academic study reveals how large language models like ChatGPT and Code Llama are frequently recommending software packages that don't actually exist—yet. These fake suggestions create the perfect opportunity for attackers to register malicious packages with those names, compromising developer machines and potentially entire corporate networks. Whether your team is deep into AI pair programming or just starting to experiment, this conversation surfaces key questions every tech leader should be asking before pushing AI-generated code to production. Unlock the full potential of your product team with Integral's player coaches, experts in lean, human-centered design. Visit integral.io/convergence for a free Product Success Lab workshop to gain clarity and confidence in tackling any product design or engineering challenge. Inside the episode... What "package hallucinations" are and why they matter How AI code assistants can introduce real vulnerabilities into your network Which models were most likely to hallucinate packages Why hallucinated package names are often persistent—not random How attackers could weaponize hallucinated names to spread malware What mitigation strategies were tested—and which ones failed Why simple retrieval-based techniques (like RAG) don't solve the problem Steps security-conscious teams can take today to protect their environments The importance of developer awareness as more non-traditional engineers enter the field Mentioned in this episode Python Package Index (PyPI) npm JavaScript package registry Snyk, Socket.dev, Phylum (dependency monitoring tools) Artifactory, Nexus, Verdaccio (private package registries) ChatGPT, Code Llama, DeepSeek (AI models tested) Subscribe to the Convergence podcast wherever you get podcasts including video episodes on YouTube at youtube.com/@convergencefmpodcast Learn something? Give us a 5 star review and like the podcast on YouTube. It's how we grow. Unlock the full potential of your product team with Integral's player coaches, experts in lean, human-centered design. Visit integral.io/convergence for a free Product Success Lab workshop to gain clarity and confidence in tackling any product design or engineering challenge. Subscribe to the Convergence podcast wherever you get podcasts including video episodes to get updated on the other crucial conversations that we'll post on YouTube at youtube.com/@convergencefmpodcast Learn something? Give us a 5 star review and like the podcast on YouTube. It's how we grow.   Follow the Pod Linkedin: https://www.linkedin.com/company/convergence-podcast/ X: https://twitter.com/podconvergence Instagram: @podconvergence

Gambian Government; Isle of Man Government; Passkeys for Normal People; The Have I Been Pwned Alpine Grand Tour ; Sponsored by Snyk https://www.troyhunt.com/weekly-update-451/See omnystudio.com/listener for privacy information.

Forecast = Prepare for scattered CVEs, rising bot storms, and real-time threat lightning. Keep your digital umbrellas handy! ‍ On this episode of Storm⚡️Watch, we're breaking down the latest shifts in the vulnerability tracking landscape, starting with the ongoing turbulence in the CVE program. As the MITRE-run CVE system faces funding uncertainty and a potential transition to nonprofit status, the global security community is rapidly adapting. New standards and databases are emerging to fill the gaps—Europe's ENISA is rolling out the EU Vulnerability Database to ensure regional control, while China continues to operate its own state-mandated systems. Meanwhile, the CVE ecosystem's chronic delays and the NVD's new “Deferred” status for tens of thousands of older vulnerabilities are pushing teams to look elsewhere for timely, enriched vulnerability data. Open-source projects like OSV.dev and commercial players such as VulnCheck and Snyk are stepping up, offering real-time enrichment, exploit intelligence, and predictive scoring to help organizations prioritize what matters most. The result is a fragmented but innovative patchwork of regional, decentralized, open-source, and commercial solutions, with hybrid approaches quickly becoming the norm for defenders worldwide. We're also diving into Imperva's 2024 Bad Bot Report, which reveals that nearly a third of all internet traffic last year came from malicious bots. These bots are getting more sophisticated—using residential proxies, mimicking human behavior, and bypassing traditional defenses. The report highlights a surge in account takeover attacks and shows that industries like entertainment and retail are especially hard hit, with bot traffic now outpacing human visitors in some sectors. The rise of simple bots, fueled by easy-to-use AI tools, is reshaping the threat landscape, while advanced and evasive bots continue to challenge even the best detection systems. On the threat intelligence front, GreyNoise has just launched its Global Observation Grid—now the largest deception sensor network in the world, with thousands of sensors in over 80 countries. This expansion enables real-time, verifiable intelligence on internet scanning and exploitation, helping defenders cut through the noise and focus on the threats that matter. GreyNoise's latest research shows attackers are exploiting vulnerabilities within hours of disclosure, with a significant portion of attacks targeting legacy flaws from years past. Their data-driven insights are empowering security teams to prioritize patching and response based on what's actually being exploited in the wild, not just theoretical risk. We're also spotlighting Censys and its tools for tracking botnets and advanced threats, including collaborative projects with GreyNoise and CursorAI. Their automated infrastructure mapping and pivoting capabilities are helping researchers quickly identify related malicious hosts and uncover the infrastructure behind large-scale attacks. Finally, VulnCheck continues to bridge the gap during the CVE program's uncertainty, offering autonomous enrichment, real-time exploit tracking, and comprehensive coverage—including for CVEs that NVD has deprioritized. Their Known Exploited Vulnerabilities catalog and enhanced NVD++ service are giving defenders a broader, faster view of the threat landscape, often surfacing critical exploitation activity weeks before it's reflected in official government feeds. As the vulnerability management ecosystem splinters and evolves, organizations are being forced to rethink their strategies—embracing a mix of regional, open-source, and commercial intelligence to maintain visibility and stay ahead of attackers. The days of relying on a single source of truth for vulnerability data are over, and the future is all about agility, automation, and real-time insight. Storm Watch Homepage >> Learn more about GreyNoise >>  

Tom Hulme is a General Partner @ GV and leads GV's European investing. He has led rounds in Monzo, Nothing, GoCardless, Lemonade, Snyk and is widely considered one of the best investors in Europe.  Stan Boland is one of the most successful and respected entrepreneurs in the UK.  In 1999, he co-founded Element 14 which was acquired by Broadcom in 2000 for $640 million. Following this, Boland co-founded Icera Inc. in 2002, a fabless semiconductor company which he sold to Nvidia for $367 million.  In Today's Discussion We Cover: 04:26 Is The UK's Biggest Problem a Talent Problem 09:50 Why We Need to Flood the UK With Venture Capital 10:38 What Europe Can Learn from Stripe and the Collisons 15:21 How the UK Can Use Visas to Retain the Best Talent 16:46 Why the Government Needs to Put 10x More Cash Into Fund of Funds 24:32 Is the London Stock Exchange F****** and Does it Matter? 34:38 What The UK Can Learn From Sequoia and the Norwegian Sovereign Wealth Fund 40:42 What is a “National Goal for Wealth Creation” & How Do We Implement It? 48:10 What are the Most Broken Elements of the UK Tax Regime 52:11 Is It Stupid to Remove the Non-Dom Tax Status 53:15 Why is Now the Time to Be Bullish on China 01:00:19 Biggest Lessons from Working with Jensen Huang 01:08:04 Quick Fire Round: Insights and Predictions    

Episode SummaryIn this episode of The Secure Developer, Danny Allan, CTO of Snyk, sits down with Wayne Chang, Founder and CEO of SpruceID, to explore the evolving landscape of digital identity and security. From self-sovereign identity to the role of AI in authentication, they discuss the future of identity management, the risks of centralized systems, and the benefits of decentralized approaches. They also dive into how policy, compliance, and emerging technologies like passkeys and zero-knowledge proofs are shaping the security ecosystem.Show NotesThe world of digital identity is changing fast, and in this episode of The Secure Developer, we explore how security professionals and developers can navigate this evolving space. Host Danny Allan is joined by Wayne Chang, Founder and CEO of SpruceID, to discuss key trends and challenges in identity management.Topics Discussed:Wayne's Background: From health tech to digital identity, how Wayne's early struggles with integrating health records led to his passion for self-sovereign identity.The Evolution of Digital Identity: Why usernames and passwords are no longer the gold standard, and how newer methods like passkeys and cryptographic credentials improve security.Decentralization vs. Centralization: The trade-offs between federated identity systems (like OAuth and SSO) and self-hosted identity wallets.The Role of AI in Identity Security: How AI is both a tool for improving security and a threat vector for identity fraud.Privacy and Compliance: How regulations like GDPR, CCPA, and emerging state-level laws influence digital identity strategies.The Future of Authentication: The move from multi-factor authentication to "myriad factor authentication," leveraging multiple signals for seamless and secure access.Wayne and Danny also discuss real-world use cases, including the development of mobile driver's licenses, emerging digital identity wallets, and the challenges of ensuring privacy and security while maintaining usability. The conversation highlights how organizations can stay ahead with better authentication practices and privacy-preserving architectures as fraud becomes more sophisticated.LinksSpruceID - Identity infrastructure for the digital worldNIST - The National Institute of Standards and TechnologyNIST SP 800-63 - Digital Identity GuidelinesACLU Digital ID State Legislative RecommendationsSnyk - The Developer Security Company Follow UsOur WebsiteOur LinkedIn

00:00 - PreShow Banter™ — Highest Rated Chalk04:14 - BHIS - Talkin' Bout [infosec] News 2025-01-2008:53 - Story # 1: Data From 15,000 Fortinet Firewalls Leaked by Hackers14:25 - Story # 2: China's Salt Typhoon spies spotted on US govt networks before telcos, CISA boss says16:29 - Story # 3: TikTok reportedly plans ‘immediate' Sunday shutdown in the US if it's banned25:47 - Story # 4: FBI forces Chinese malware to delete itself from thousands of US computers35:06 - WWHF Denver36:03 - BSides San Diego37:23 - Security Stadium38:22 - Story # 5: Exchange 2016 and 2019 reach end-of-life status later this year42:45 - Story # 6: Snyk security researcher deploys malicious NPM packages targeting Cursor.com46:17 - Story # 7: New UEFI Secure Boot flaw exposes systems to bootkits, patch now57:34 - Story # 8: Lawsuit: Allstate used GasBuddy and other apps to quietly track driving

The Biden administration is finalizing an executive order to bolster U.S. cybersecurity. Ivanti releases emergency updates to address a critical zero-day vulnerability. A critical vulnerability is discovered in Kerio Control firewall software. Palo Alto Networks patches multiple vulnerabilities in its retired migration tool. Fake exploits for Microsoft vulnerabilities lure security researchers. A medical billing company data breach affects over 360,000. A cyberattack disrupts the city of Winston-Salem. CrowdStrike identifies a phishing campaign exploiting its recruitment branding. Our guest is Danny Allen, CTO from Snyk, sharing how a balanced approach between AI and human oversight can strengthen cybersecurity. The worst of the worst from CES.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Our guest is Danny Allen, CTO from Snyk, sharing how a balanced approach between AI and human oversight can strengthen cybersecurity. Learn more in Snyk's AI Readiness Report about how some companies are still hesitant to adopt AI, despite its clear benefits in addressing human error and keeping up with fast-evolving technology. Selected Reading White House Rushes to Finish Cyber Order After China Hacks (Bloomberg) Zero-Day Patch Alert: Ivanti Connect Secure Under Attack (GovInfo Security) GFI KerioControl Firewall Vulnerability Exploited in the Wild (SecurityWeek)  Palo Alto Networks Patches High-Severity Vulnerability in Retired Migration Tool (SecurityWeek)  Security pros baited by fake Windows LDAP exploits (The Register) Major US medical billing firm breached, 360K+ customers' healthcare data leaked (Cybernews) Recruitment Phishing Scam Imitates CrowdStrike Hiring Process (CrowdStrike) Some Winston-Salem city services knocked offline by cyberattack (The Record) Excelsior Orthopaedics Data Breach Impacts 357,000 People (SecurityWeek)  The 'Worst in Show' CES Products Put Your Data at Risk and Cause Waste, Privacy Advocates Say (SecurityWeek) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Guy Podjarny founded Tessl, Snyk and Blaze. Tessl is reimagining software development for the AI era and shaping AI Native Development. Snyk created and leads the Developer Security category, and is now a multi-billion dollar company with over 1,000 employees. Guy was previously CTO at Akamai (following its acquisition of Blaze), is an active angel investor, and co-hosts of the AI Native Dev podcast. In Today's Episode with Guy Podjarny We Discuss:  03:02 Discussion on NVIDIA's Market Position 04:14 Will We See a Trough of Disillusionment in AI 07:36 The Future of AI Development and Specialized Models 10:17 Challenges and Opportunities in AI Dev Tools 17:41 Concerns About Closed vs. Open Development Platforms 21:27 Speculations on AI's Role in Application Layers 24:40 Google's Competitive Edge 25:28 IPO and M&A in the Trump Era 26:45 The Future Role of Software Developers 32:20 Security Challenges in AI Development 33:41 Spicy Questions and Charity Donations 36:05 Quickfire Round: Insights and Advice      

Timestamps: (0:00) Alex and Jason kick off the news show! (3:26) Overview of Harvard's AR glasses tech demo and club projects (10:09) Squarespace - Use offer code TWIST to save 10% off your first purchase of a website or domain at https://www.Squarespace.com/TWIST (11:35) Discussing responsible tech use, privacy, and entrepreneurial aspirations (18:30) Guests' academic focus and future in technology (19:41) LinkedIn Ads - Get a $100 LinkedIn ad credit at http://www.linkedin.com/thisweekinstartups (21:27) AR technology trends, practicality, and ethical considerations (26:10) AI advancements, deepfakes, and AR in healthcare (29:37) Washington Post - TWiST listeners can subscribe for just 50 cents per week for your first year at https://www.washingtonpost.com/twist (31:06) Insights on young founders and the podcast's live format evolution (31:58) Venture capital trends and Initialize Capital's restructuring (39:28) Founders Fund and CRV developments, returning capital to LPs (42:02) Analysis of scale insurgents and successful startup unicorns (46:39) Secondary market opportunities and fund exit strategies (53:00) New Twist 500 members: Snyk and Nym (59:56) TikTok's impact on the music industry and content creators (1:03:48) Investment discussions with Chef Reactions and TikTok creators * Subscribe to the TWiST500 newsletter: https://ticker.thisweekinstartups.com Check out the TWIST500: twist500.com Subscribe to This Week in Startups on Apple: https://rb.gy/v19fcp * Follow AnhPhu: X: https://x.com/AnhPhuNguyen1 LinkedIn: https://www.linkedin.com/in/anhphu5/ * Follow Caine: X: https://x.com/CaineArdayfio LinkedIn: https://www.linkedin.com/in/caine-ardayfio/ * Follow Alex: X: https://x.com/alex LinkedIn: ⁠https://www.linkedin.com/in/alexwilhelm * Follow Jason: X: https://twitter.com/Jason LinkedIn: https://www.linkedin.com/in/jasoncalacanis * Thank you to our partners: (10:09) Squarespace - Use offer code TWIST to save 10% off your first purchase of a website or domain at https://www.Squarespace.com/TWIST (19:41) LinkedIn Ads - Get a $100 LinkedIn ad credit at http://www.linkedin.com/thisweekinstartups (29:37) Washington Post - TWiST listeners can subscribe for just 50 cents per week for your first year at https://www.washingtonpost.com/twist * Great TWIST interviews: Will Guidara, Eoghan McCabe, Steve Huffman, Brian Chesky, Bob Moesta, Aaron Levie, Sophia Amoruso, Reid Hoffman, Frank Slootman, Billy McFarland * Check out Jason's suite of newsletters: https://substack.com/@calacanis * Follow TWiST: Twitter: https://twitter.com/TWiStartups YouTube: https://www.youtube.com/thisweekin Instagram: https://www.instagram.com/thisweekinstartups TikTok: https://www.tiktok.com/@thisweekinstartups Substack: https://twistartups.substack.com * Subscribe to the Founder University Podcast: https://www.youtube.com/@founderuniversity1916

Tamar Yehoshua is the president of product and technology at Glean. Prior to joining Glean, Tamar was chief product officer at Slack, where she led product, design, and research as the company scaled, including a 10x increase in revenue, its public listing, and an acquisition by Salesforce. She also led product and engineering teams at Google, working on search, identity, and privacy, and at A9.com, an Amazon company. Tamar has served on the board of directors for RetailMeNot, ServiceNow, Snyk, and Yext. In our conversation, we discuss:• Why you don't need to be a well-run company to win• The impact of AI on product management and the future of work• How to build strong cross-functional relationships, especially with engineers• Lessons learned from working with leaders like Jeff Bezos and Stewart Butterfield• Strategies for staying ahead in a rapidly evolving tech landscape• Much more—Brought to you by:• Explo—Embed customer-facing analytics in your product• Sprig⁠⁠—Build products for people, not data points• Sidebar—Accelerate your career by surrounding yourself with extraordinary peers—Find the transcript and show notes at: https://www.lennysnewsletter.com/p/you-dont-need-to-be-a-well-run-company-to-win-tamar-yehoshua—Where to find Tamar Yehoshua:• X: https://x.com/TYehoshua• LinkedIn: https://www.linkedin.com/in/tamar-yehoshua-886217/• Newsletter: https://tamaryehoshua.substack.com/—Where to find Lenny:• Newsletter: https://www.lennysnewsletter.com• X: https://twitter.com/lennysan• LinkedIn: https://www.linkedin.com/in/lennyrachitsky/—In this episode, we cover:(00:00) Tamar's background(02:09) Key advice for career success(06:54) Understanding people and motivations(09:33) The importance of impact(11:20) Navigating company chaos(18:40) Career planning: a different perspective(26:22) Lessons from industry leaders(37:59) Building stronger cross-functional relationships(42:00) Streamlining OKR reviews with async methods(45:26) Why you shouldn't worry so much about making users unhappy(47:50) The power of listening in leadership(52:34) How to leverage AI so you don't fall behind(01:06:39) Closing thoughts and lightning round—Production and marketing by https://penname.co/. For inquiries about sponsoring the podcast, email podcast@lennyrachitsky.com.—Lenny may be an investor in the companies discussed. Get full access to Lenny's Newsletter at www.lennysnewsletter.com/subscribe

The FBI and CISA dismiss false claims of compromised voter registration data. The State Department accuses RT of running global covert influence operations. Chinese hackers are suspected of targeting a Pacific Islands diplomatic organization. A look at Apple's Private Cloud Compute system. 23andMe will pay $30 million to settle a lawsuit over a 2023 data breach.  SolarWinds releases patches for vulnerabilities in its Access Rights Manager. Browser kiosk mode frustrates users into giving up credentials. Brian Krebs reveals the threat of growing online “harm communities.” Our guest is Elliot Ward, Senior Security Researcher at Snyk, sharing insights on prompt injection attacks. How theoretical is the Dead Internet Theory? Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Our guest is Elliot Ward, Senior Security Researcher at Snyk, sharing insights on their recent work "Agent Hijacking: the true impact of prompt injection attacks."  Selected Reading FBI tells public to ignore false claims of hacked voter data (Bleeping Computer) Russia's RT news agency has ‘cyber operational capabilities,' assists in military procurement, State Dept says (The Record) The Dark Nexus Between Harm Groups and ‘The Com' (Krebs on Security) China suspected of hacking diplomatic body for Pacific islands region (The Record) Apple Intelligence Promises Better AI Privacy. Here's How It Actually Works (WIRED) Apple seeks to drop its lawsuit against Israeli spyware pioneer NSO (Washington Post) 23andMe settles data breach lawsuit for $30 million (Reuters) SolarWinds Patches Critical Vulnerability in Access Rights Manager (SecurityWeek) Malware locks browser in kiosk mode to steal Google credentials (Bleeping Computer) Is anyone out there? (Prospect Magazine)  Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices