A better fire alarm is still a fire. Many SQL Server incidents I get called about were preventable with controls already available in the client’s environment. Here is the audit I wish had been run before the pager rang, complete with the T-SQL.I finished a root cause analysis recently that I was quietly proud of. It had everything a respectable incident document is supposed to have: a timeline to the second, the plan regression that started it, the parameter behind the regression, and the deployment three weeks earlier that changed the parameter.The document was accurate. That was the uncomfortable part.…
Author: drweb
HackerOne has added a remediation capability to its H1 Platform that reduces the amount of time required to remediate validated vulnerabilities and other weaknesses affecting specific lines of source code.Nidhi Aggarwal, chief product officer for HackerOne, said H1 Remediation combines artificial intelligence (AI) and crowdsourced research to identify the root cause of issues that are traced back to specific lines of code. Designed to integrate with existing issue tracking tools and AI coding agents via a Model Context Protocol (MCP) server, the goal is to better prioritize remediation efforts in a way that reduces the amount of exposure debt that…
AI coding assistants write code fast. Whether that code can be trusted is a separate question, and it’s becoming a more urgent one. Surveys this year put average developer trust in AI-generated output at just above the midpoint of a five-point scale, and more than half of developers admit they ship AI code without testing it first. Coverage numbers on AI-written code often look fine on paper, but plenty of that coverage turns out to be shallow: tests that check a result isn’t null and call it a day.Microsoft is trying to close that gap with a new open-source agent…
Product Engineer, Core & Connectivity (Laravel – Remote)
TL;DR — Key Takeaways A sprawling npm malware campaign has already pushed nearly 850 malicious packages by spreading them across hundreds of disposable accounts, making it far harder for defenders to identify and shut down the operation. Sonatype says the “Flooding Dropper” campaign uses stealthy, multi-stage malware with cross-platform payloads, DNS fallback delivery, persistence mechanisms, and in-memory execution to evade detection on Windows, Linux, and macOS. The campaign highlights a shift toward industrial-scale open source attacks, where attackers rely on automation, behavioral variation, and account churn—not just malicious code—to overwhelm registry moderation and signature-based defenses. Threat researchers at Sonatype are…
It’s been some time since I provided a car update, so I decided to showcase a few things I’ve learned about my cars since the last one. In this post:A Second EV: Lucid GravityEfficiency and Tires on the Tesla Model YSerendipity with a SuburbanThis is part of a series of thoughts on cars, just for fun. These are my thoughts and opinions based on my experiences.Our Second EV: Lucid GravityWe bought a Lucid Gravity after driving it one day. We’d driven a few other EVs and then stopped by the Lucid dealer because we had an hour and it was…
Amazon Web Services (AWS) this week at the Black Hat USA conference revealed it is working with both Anthropic and OpenAI to integrate their respective coding tools with a service it has developed that makes available artificial intelligence (AI) agents to help application developers write more secure code.Launched earlier this year, the AWS Continuum service provides access to AI agents that discover, validate and prioritize vulnerabilities and surface remediation recommendations. Currently available in preview, the integrations connect AWS Continuum with coding tools from Anthropic and OpenAI to create a tighter feedback loop for developers as they write code.At the same…
You’ve probably memorized networking definitions like “What is DNS?” or “What is a subnet?” for interviews. But real interviews often go a step further and ask troubleshooting questions to see how you’d solve problems on a live system. That’s exactly what these questions are designed to help you prepare for. Most people walk into a networking interview after memorizing definitions, but that’s usually not enough. Interviewers often move beyond questions like, “What is DNS?” and ask practical ones such as, “A user says the website is down, but you can ping the server’s IP address. What would you check next?”…
TL;DR — Key Takeaways Meta has launched Muse Code, its first AI coding agent, alongside the updated Muse Spark 1.2 coding model. Muse Code is designed to handle end-to-end software engineering workflows, including planning, writing code and validating results. Meta is competing partly on price, with token costs below those of many leading AI model providers. In an effort to catch up with OpenAI and Anthropic in one of AI’s fastest-growing markets, Meta has launched its first AI coding agent, Muse Code, alongside an updated coding-focused AI model.CEO Mark Zuckerberg announced the preview release of Muse Code, describing it as…
I had fun with the post about making a link to a random post in just HTML/CSS the other day. But I was almost certainly over-thinking it on the original. Using random() was kind of the point, so we can stick with that. One alternative is to think uni-directionally. Making it both rows and columns isn’t necessary out the gate. You can get vertical slices with flexbox easily, which is just as random really, and likely gives you a few hundred random posts as they can get down to 1px in width. An even simpler idea is to have all…