cloud, JavaScript

Export Violations From JFrog Xray to CSV

The trend of #DevSecOps is growing fast and it is no longer just part of your security team. More and more organizations wish to integrate their security team in all the phases of development and operations. To achieve it, there are cases where you need to export data from JFrog Xray (in our case to a CSV format) so you can ingest it to your current logging/monitoring system. 

What is Xray?

In a nutshell, JFrog Xray works with JFrog Artifactory to perform a deep analysis of binary components at any stage of the application lifecycle. It provides full transparency that leads to more trust in your software. 

By scanning binary components and their metadata, recursively going through dependencies at any level (think on the layers you have in any Docker container), JFrog Xray provides great visibility into issues lurking in components anywhere in your organization.

Xray API

One of the best parts is that JFrog Xray is also fully automated through a rich REST API. We will use it to create this Exporter. Please feel free to clone/fork the code below and use it, but remember you might need to add pagination and a watchdog for a real system.

Continue reading →
Standard
Business, life

Improve Your Decisions

I find the topic of decisions making to be a fascinating one.
In the past few years, I wrote about it several times and this is the post I keep returning as the ‘checklist’.
However, it’s great to have quick and simple rules that you can use.

Three rules to improve your decisions (that I ‘borrowed’ from @naval):

  • If you can’t decide, the answer is no – It might be a bit tricky in cases where you don’t have a Yes/No decision. However, the idea (IMHO) is that you should have a hunch on what will be the right path and if you can’t feel it, try to base the decision on the best data you can find.

  • If two equally difficult paths, choose the one more painful in the short term (pain avoidance is creating an illusion of equality) – This is a clever one, as it’s pointing you in the direction of
    ‘Easy choices → Hard life. Hard choices → Easy life’.
    I’m not sure, this rule will be valid in all cases, but even if it’s holding for 80% it’s a good one to remember.

  • Choose the path that leaves you calmer in the long term – Smart way to validate which is the better decision for a given challenge.

Also, it’s good to remember that
“It’s extremely hard to make good decisions in a poor environment.”

So do your best to improve the environment (e.g. company, friends) before taking important decisions.

The original tweet:

Have a great weekend.

Standard
cloud

Continuous Software Updates With JFrog Pipelines

“Liquid Software” release practices are rapidly becoming the standard in many companies. However, as software shapes digital transformation, DevOps teams are feeling challenged to manage their growing influence on corporations’ success or failure. In a talk I gave last week, we looked into the growing pains that most enterprises (many of them JFrog customers) face when adopting and consolidating DevOps at scale, and how these challenges are being mitigated with end-to-end platform solutions. We also wrap up with some DevOps best practices that will help you address emerging trends that your bosses’ bosses care about.

The slides

Continue reading →
Standard
life

What It Takes – Book Review

“What It Takes: Lessons in the Pursuit of Excellence” is a book I enjoyed in the last two flights. It’s a classic entrepreneurship story and half of the book is talking about his path in starting, building and expanding Blackstone. The other half is composed of stories in his life.

Who is Stephen Schwarzman?

Well, he manages over $500 billion as the co-founder/CEO of Blackstone.
He also wants to teach readers “how to grow organizations, and do positive things, and how to help their careers”. 

I felt through the book that there are some good lessons.

One lesson is around the same (more or less) rules that Buffet coined around:

  1. Don’t lose money.
  2. Go back to confirm you are executing rule #1

A few little details make the book fun to read. For example, when he explained how Angela Merkel raised her hands to imitate a locust and how he mimics her. Another good one is when he tells of why he earned the nickname “Farmer Blackstone” in China. It is because he promised that the company’s stock price was like a seed that would grow in time.

I also liked this suggestion:
“There is nothing more interesting to people than their problems. Think about what others are dealing with, and try to come up with ideas to help them. Almost anyone, however senior or important, is receptive to good ideas provided you are thoughtful.”

Continue reading →
Standard
books
life

2019 Favorite Books And Runs

In the past few years ( 2018, 2017, 2016, 2015, 2014, 2013) I’ve been summarizing the year both on sports events (running, biking, snowboarding, etc’) and on books.

This year is no different.

Let’s start with the books I’ve enjoyed most in 2019.

Books – Learning and thinking

  • Talking to Strangers: What We Should Know about the People We Don’t Know – Malcolm Gladwell
    This is another masterpiece from Gladwell. He knows how to tell a story and to take you from A to B in a fascinating way.
  • Grit: The Power of Passion and Perseverance – Angela Duckworth
    I enjoyed this one as it’s not ‘just’ talking about the importance of Grit but also on how to deal with the complexity of life.

  • 21 Lessons for the 21st Century – Yuval Noah Harari
    If you read the first two books you got the main ideas. However, it’s a great book with many good internal stories. I liked it a lot.
Continue reading →
Standard
cloud, JavaScript

How To Build An Integration With JFrog Xray?

The trend of DevSecOps is not new but it’s growing fast. More and more organizations wish to integrate their security team in all the phases of development and operation. 

Many security products keep your code safe from vulnerabilities at different stages (dev, test, qa and prod). However, JFrog Xray is unique in its capabilities to perform analysis of all the binaries you are consuming in your project.

JFrog Xray works with JFrog Artifactory to perform a deep analysis of binary components at any stage of the application lifecycle. It provides full transparency that leads to (more) trust in your software. By scanning binary components and their metadata, recursively going through dependencies at any level (think on the layers you have in any Docker container), JFrog Xray provides great visibility into issues lurking in components anywhere in your organization.

One of the best parts is that JFrog Xray is also fully automated through a rich REST API that lets it integrate with a CI/CD pipeline and allows other binary analysis tools to build on its unique capabilities.

Continue reading →
Standard
cloud

What is the JFrog Container Registry? And Why Will You Want One?

These days, where many developers are working with containers and all their ‘outcomes’ are bundled in a Docker container, it is becoming challenging to manage and control them.

Moreover, as more containers and Kubernetes enter the party, the job gets that much harder. Now, you have a tool that can help you jump to the next level. The JFrog Container Registry is a new Docker, Helm, and generic registry that is scalable and reliable. 

What’s even better? 
It’s free… and gives you some unique features you can’t find anywhere else.

Give it a try at: jfrog.com/container-registry and/or continue to read below.

Continue reading →
Standard
Business, life

Decisions And Intuition – Daniel Kahneman

Psychologist and Nobel laureate Daniel Kahneman reveals the actions we can take to overcome the biases. He talks in this podcast about the things that cripple our decision-making, damper our thinking, and limit our effectiveness.

Some gems from his conversion:

First one, is thought provoking as you take it to your personal or professional life.

“I think changing behavior is extremely difficult. There are a few guidelines about how to do that, but anybody who’s very optimistic about changing behavior is just deluded.”

The second is about incentives and it’s putting more light to Charlie’s perceptions.

Continue reading →
Standard
cloud

JFrog Artifactory REST API in 5min

A good API is like a classic car - You want to use it again and again.
A good API is like a classic car – You want to use it again and again.

Most of the interactions with Artifactory will be from your CI/CD tools. It might be your build engine or from your log aggregator. This powerful API can be invoked in any of the standard ways you like to work with any other RESTful APIs (e.g. curl, CLI, your source code, etc’).
In many cases, it’s the preferred ‘glue’ for developers when it comes to automation. The options are extensive and you can do many useful things with this API. However, in this short post, we will cover the most popular actions you ‘must have’.

Let’s start with the most common action: “upload/download binaries“. This action could run automatically from the build machine to Artifactory using:

Continue reading →
Standard
cloud

VP Of Technology At JFrog

At last SwampUP, I had the opportunity to talk with Alan Shimel, Founder and Editor at DevOps.com. We covered what I do at JFrog and spoke about the definition of the role “VP of Technology”. We also covered some interesting new products we offering these days to help developers move faster.

I told Alan that I define the role as “finding leverage points in (JFrog) technology to support the business”.

Continue reading →
Standard