Ryan Day

Co-founder @atomist, former @github @vmware

[Ryan Day @jryanday]

@AORacingUSA @IMSA @pjhyett Congrats! @AORacingUSA @pjhyett

[sındnp uɐıʇsıɹɥɔ @cdupuis]

Don't just bindly use latest tag of any Docker image: e.g. the node:latest image has >600 packages installed with ~80 H & C CVEs. I bet you don't need all of those packages in your production environment. Choose your base image tag wisely. https://t.co/FLebPWgpP1

[Rod Johnson @springrod]

Your base container images can bring in unexpected vulnerabilities, which can differ hugely between versions of the same image. Free resource using Atomist's vulnerability database to help see whether you're on the safest image you can be: https://t.co/fGxg8TgXa0 @atomist

[sındnp uɐıʇsıɹɥɔ @cdupuis]

A #docker base image used to be a black box. By indexing all packages/CVEs of an image, grouping them by layers and linking to the Dockerfile line that produced a layer, I gained a much better understanding of what we run in production. #DevSecOps https://t.co/ctObYM0FkW

[Ryan Day @jryanday]

Ouch

[Rod Johnson @springrod]

If you're running these containers, you're likely at risk due to the log4j zero-day. More details - https://t.co/bvLud6srP2

At Atomist we're monitoring public images for vulnerabilities. We'll open up this feature next week.

[Ryan Day @jryanday]

It's fun working to make security info more relevant for developers. What do you love or hate about your security tools and process?

[Ryan Day @jryanday]

@danieljomphe @atomist Hi @danieljomphe, those are still available — see https://t.co/9vqWgwgFpW. We've increased our focus on DevSecOps, including Dockerfile linting and containerized application security more broadly. Which linters and other actions are of most interest to you?

[Rod Johnson @springrod]

I’d love to hear about your DevSecOps journey and share some ideas on a new approach we’re working on at @atomist. We'll donate $50 to a charity in appreciation for your time. Looking forward to chatting with you! https://t.co/YwInKmCCcT

[Ryan Day @jryanday]

There are many possible approaches to automate a task. @ddgenome illustrates tackling a scenario with Actions and Atomist Skills.

[Ryan Day @jryanday]

Leave no dependency behind. 🔍 Automatically remove unused dependencies and add undeclared dependencies. 🔒

[sındnp uɐıʇsıɹɥɔ @cdupuis]

Run depcheck from @rumpl as an @atomist skill to keep your #npm dependencies in check and receive PRs to fix issues.https://t.co/KLwtFVeXz8 - I absolutely love those every day helpers that make my dev life easier!

[Ryan Day @jryanday]

Let the npm audit fix + robots help make code security more 🌟

[Rod Johnson @springrod]

Often we want to apply consistent behavior to many repositories instead of editing CI files one by one. This is easy with Atomist skills. Take keeping license headers up to date everywhere they're needed. Eliminate drudgery and get it right every time. https://t.co/oO7VF8IpLo

[Ryan Day @jryanday]

Secret leak prevention requires a defense-in-depth solution. Tools like @github secret scanning and @atomist secret scanner help. https://t.co/UxGvrFe5Sl #DevSecOps

[Ryan Day @jryanday]

Review reminders and stale issue handling ftw

[sındnp uɐıʇsıɹɥɔ @cdupuis]

Two new @atomist skills to make your open source contributor life easier: manage stale issues https://t.co/iGavJb5x8z and pull request review reminders https://t.co/6GCAuybfoD. We use those every day!

[Ryan Day @jryanday]

Using slash commands like /pr right from a git commit to automate creating a PR (which you were gonna do manually on @github afterward anyway) 🙇 @slimslenders

[Jim Clark @slimslenders]

Doing More With Git Commit Messages https://t.co/nFQfvwaHWv

[Jim Clark @slimslenders]

Doing More With Git Commit Messages https://t.co/nFQfvwaHWv

[Ryan Day @jryanday]

Nice post on why you want to keep branches rebased automatically @radekhubner. 🙌 @atomist

[Radek Hubner @radekhubner]

Safe your time and start to rebase automatically.
https://t.co/AolAuhjgJA
#development #automate #github