I have been asked many times about how the name “Data on Wheels” came to be. I decided that is a good topic to ramble about, so here goes.An origin storyBy the end of 2010, I had been presenting on technology for over four years including PASS Summits. While I was building out a decent reputation as a speaker, I didn’t have an online presence. I needed a blog.I decided to kick off a blog in December 2010. But I needed a name for my blog. Something cool. After looking at bunch of peers’ blogs and Twitter handles, I landed…
Author: drweb
TL;DR — Key Takeaways Separate dev, staging, UAT and production into individual AWS accounts, with a dedicated shared-services account hosting centralized ECR repositories. Use tightly scoped GitHub Actions OIDC roles, cross-account pull permissions and automatic image scanning to strengthen access control and vulnerability management. Promote the exact same container image through every environment by retagging rather than rebuilding, preserving traceability and supporting SOC 2 change-management controls. CI/CD pipelines make developers’ lives easier and let them ship changes to end users faster. However, they are also part of compliance frameworks such as SOC 2, which require careful design to satisfy specific…
TL;DR — Key Takeaways AI is dramatically increasing the volume of Terraform, Kubernetes and cloud configuration code, but only about 55% of AI code-generation tasks produce secure code by default. Infrastructure vulnerabilities can expose entire environments, making governance of AI-generated IaC a platform engineering responsibility rather than only an AppSec concern. Mature teams are moving controls upstream through policy as code, scoped agent permissions, automated drift correction and compliance validation during generation. AI agents and coding assistants now generate a growing share of the Terraform, Kubernetes and cloud configuration code running in production, but the security quality of that code…
TL;DR — Key Takeaways Coverity is moving closer to AI-native development workflows with a new MCP server that lets coding agents run local security and quality scans. Security prioritization gets sharper with a new impact lens designed to help teams focus on the issues that matter most for compliance. Black Duck is expanding vulnerability coverage with a new checker for Insecure Direct Object Reference (IDOR) flaws in JavaScript and TypeScript. Black Duck has updated its Coverity static analysis code scanning tool to provide deeper integrations with artificial intelligence (AI) tools along with updates to its user interface that make it…
Continuous software delivery in the digital age has come to depend on CI/CD pipelines. They enable engineering teams to rapidly develop, test, and deploy code while keeping it highly usable and consistent across environments. CI/CD pipelines, however, can themselves become a source of friction as systems start at a small scale and become more complex. Pipelines set up to work for small projects have difficulty scaling with ever more repositories, ever larger test suites, and ever larger development teams. Slow feedback cycles, increased infrastructure costs, and decreased developer productivity are some by-products of bad pipeline design.Here are 10 CI/CD pipeline…
Fabric’s inbound network protection gives you two tenant-level controls: Private Link, which routes traffic through your virtual network instead of the public internet, and Block Public Internet Access, which closes the public internet off entirely once Private Link is in place. Together they look like the obvious move if you’re trying to get a data platform off the public internet. Flip two settings, close off the internet, ship a more secure platform. That’s the pitch.As of July 2026, it isn’t that simple. Enabling them changes how a specific, and fairly long, list of Fabric features behaves. Some keep working but…
What does it take to secure AI agents without slowing developers down? A recent panel explored the answer I recently joined Zach Lloyd, founder and CEO of Warp; Gavriel Cohen, co-founder and CEO of NanoCo and creator of NanoClaw; and moderator Moriah Hara, founder of a community of more than 3,000 CISOs and a three-time Fortune 500 CISO, for a discussion on one of the biggest challenges facing enterprise security teams today: how to safely unlock the productivity of agentic AI. The rapid rise of agentic AI in the enterprise is putting CISOs in a tough spot. On one hand,…
Our basic Livewire search dropdown already works, but now we’ll make it faster and more polished. We’ll…
TL;DR — Key Takeaways Manual triage is becoming the slowest part of incident response as engineers struggle to connect alerts, telemetry, ownership data and recent changes. Automated triage shortens the gap between detection and action by assembling context, ranking likely causes and recommending safe next steps. The strongest approach combines reliable observability with progressive automation, keeping humans responsible for judgment and higher-risk decisions. Manual triage is becoming the slowest and most expensive part of modern incident response. In distributed systems, the problem is no longer detecting that something is wrong; the real problem is turning noisy alerts, scattered telemetry and…
We’ll take a basic notifications dropdown and make it feel alive. That means polling for new items,…