What’s the difference between “malware” and “software”?
In my opinion, it’s the human who labels the code that. Code is merely a mechanism to modify data. It has no emotions, intent, “inherent evil-ness”, etc. Do hammers enjoy being used to hammer nails?
A gun is an inert piece of metal. So is a screwdriver, or a hammer. You can use them to hunt for food and build a house, or to hurt other people. Are they “safe”? When are they not “safe”?
What are the questions that I should be asking myself when I’m thinking about how to automate security in a CICD pipeline?
What about a CICD pipeline without thinking about security?
These feel too general. These might be valuable to explore, but I think that making them more specific will be better.
The questions that I ask myself are important because they will determine the architecture of the pipeline. I feel like I’m starting to understand what 2 of my coworkers, Gil and Vishal, are talking about. If I start trying to design a CICD pipeline with an existing piece of automation, it’s not a good starting point. But if I start with the right principles in mind, building good ideas becomes easier.
I’m thinking about what the best way is to manage vulnerability scanning in the SDLC.
Sitting down and really thinking about this is a culmination of talking with coworkers about this for a while, and stuff that’s been happening at work.
Specifically, if the goal is to:
(Maybe as a bonus, we can also)