Author: Craig Risi

On April 17, 2025, GitLab released version 17.11, introducing significant advancements in compliance management and DevSecOps integration. A standout feature of this release is the introduction of Custom Compliance Frameworks, designed to embed regulatory compliance directly into the software development lifecycle.

These frameworks allow organizations to define, implement, and enforce compliance standards within their GitLab environment. With over 50 out-of-the-box controls, teams can tailor frameworks to meet specific regulatory requirements such as HIPAA, GDPR, and SOC 2. These controls cover areas like separation of duties, security scanning, authentication protocols, and application configurations.

To create a custom compliance framework, as detailed in GitLab’s own post, users identify applicable regulations and map them to specific controls. Within GitLab’s Compliance Center, they can define new frameworks, add requirements, and select relevant controls. Once established, these frameworks can be applied to projects, ensuring consistent compliance across the organization.

Integrating compliance directly into the development workflow offers several key advantages. By automating compliance checks, teams can significantly reduce the manual effort typically required for tracking and documentation. This streamlining not only saves time but also ensures greater accuracy and consistency. Real-time monitoring of compliance status accelerates audit readiness, allowing organizations to respond quickly and efficiently to regulatory requirements. Furthermore, embedding compliance controls into every stage of development enhances the overall security posture, ensuring that security and regulatory standards are continuously enforced throughout the software delivery lifecycle.

With the release of Custom Compliance Frameworks, Ian Khor, a product manager at GitLab, highlighted the significance of this milestone, stating:

Big milestone moment – Custom Compliance Frameworks is now officially released in GitLab 17.11! This feature has been a long time coming, and I’m incredibly proud of the team that brought it to life.

Khor emphasized the collaborative effort across product, engineering, UX, and security teams to ensure that organizations can define, manage, and monitor compliance requirements effectively within GitLab.

Joel Krooswyk, CTO at GitLab, also expressed enthusiasm about the new features in GitLab 17.11, particularly the compliance frameworks.  

Psst – hey – did you hear? GitLab 17.11 dropped today, and there are 3 huge things I’m excited to share. 1. Compliance frameworks. 50 of them, ready to pull into your projects.

In addition to compliance enhancements, GitLab 17.11 introduces over 60 improvements, including more AI features on GitLab Duo Self-Hosted, custom epic, issue, and task fields, CI/CD pipeline inputs, and a new service accounts UI. These updates aim to streamline development workflows and enhance overall productivity.

In a recent blog post, Pinterest Engineering detailed its approach to addressing network throttling challenges encountered while operating on Amazon EC2 instances. As a platform serving over 550 million monthly active users, ensuring consistent performance is paramount, especially for critical services like their machine learning feature store, KVStore.

Pinterest observed increased latency and occasional service disruptions in KVStore, particularly during periods of high traffic. These issues often led to application timeouts and cascading failures, adversely affecting user engagement on features like the Homefeed. The root cause was traced to network performance limitations inherent in certain EC2 instance types, which offer “up to” a specified bandwidth. For example, an instance labeled with “up to 12.5 Gbps” might have a baseline bandwidth significantly lower, relying on burst capabilities that are not guaranteed. When network usage exceeded these baselines, packet delays and losses ensued, impacting application performance.

In 2024, Pinterest initiated a migration to AWS’s Nitro-based instance families, such as transitioning from i3 to i4i instances, aiming for improved performance. However, this shift introduced new challenges. During bulk data uploads from Amazon S3 to their wide-column databases, they observed significant performance degradation, particularly in read latencies, resulting in application timeouts. These findings prompted a temporary halt to the migration of over 20,000 instances.

​​With improved visibility into their network performance, Pinterest implemented several key strategies to mitigate EC2 network throttling. One of the primary approaches was selecting EC2 instances with higher baseline network bandwidth to better support their workloads, moving away from instances that only promised burstable performance. They also introduced traffic shaping techniques to regulate data flow and ensure network usage stayed within optimal thresholds.

In addition, Pinterest distributed workloads more evenly across multiple instances, reducing the risk of overloading any single resource. These combined efforts significantly enhanced the reliability and stability of their systems, effectively minimizing latency spikes and preventing the kind of service disruptions that had previously impacted user experience.

Pinterest’s experience underscores the importance of understanding the nuances of cloud infrastructure, particularly the implications of network bandwidth limitations on EC2 instances. By proactively monitoring and adjusting their infrastructure, they successfully navigated the challenges of network throttling, ensuring a smoother experience for their vast user base.

Cloudflare has unveiled thirteen new Model Context Protocol (MCP) servers, enhancing the integration of AI agents with its platform. These servers allow AI clients to interact with Cloudflare’s services through natural language, streamlining tasks such as debugging, data analysis, and security monitoring.

An MCP server is a specialized type of server introduced by Cloudflare as part of their infrastructure to support AI agents in executing, debugging, and managing tasks securely and efficiently.

The concept of MCP servers is built around the idea of giving AI agents (like those used in autonomous workflows or natural language interfaces) safe, controlled access to the tools and data they need to operate effectively. These servers don’t just run arbitrary workloads—they are tightly scoped, auditable environments that expose specific capabilities to AI models.

The new MCP servers from Cloudflare introduce several key features designed to enhance the capabilities of AI agents interfacing with cloud infrastructure. The thirteen new servers and what they do are described below, as detailed in Cloudflare’s blog post.

The Workers Observability Server provides valuable insights into application logs and errors. This feature is crucial for rapid debugging and optimizing performance, enabling AI agents and developers to diagnose issues more efficiently.

With the Radar Server, AI agents gain access to global internet traffic data. This allows for sophisticated analysis of network trends and detection of anomalies, supporting a wide range of use cases from cybersecurity to performance monitoring.

The Logpush Server plays a critical role in summarizing log data, making it easier to identify and troubleshoot issues in log delivery mechanisms. It helps ensure logs are reaching their intended destinations and maintains visibility over logging workflows.

The AI Gateway Server enables inspection of AI Gateway logs. This means agents can review prompt histories and model responses, allowing for better debugging, tuning, and understanding of AI behavior within applications.

The AutoRAG Server is particularly useful for enabling AI agents to search and retrieve information from documents. This boosts response accuracy by grounding AI outputs in reliable and relevant data sources.

The DNS Server allows AI agents to query and manage DNS records. By providing access to DNS configurations, agents can assist in tasks such as domain management, troubleshooting DNS issues, and ensuring proper routing of internet traffic.

The KV (Key-Value) server enables AI agents to interact with Cloudflare’s key-value storage system. This functionality is essential for managing configuration data, feature flags, and other dynamic settings that applications rely on for real-time operations.

Through the Pages server, AI agents can access and manage Cloudflare Pages deployments. This includes capabilities like monitoring deployment statuses, reviewing build logs, and initiating new deployments, thereby streamlining the continuous integration and deployment processes.

The Queues Server provides AI agents with the ability to interact with message queues. This is particularly useful for managing asynchronous tasks, processing background jobs, and ensuring reliable communication between different parts of an application.

AI agents can utilize the R2 Server to access Cloudflare’s object storage solution. This allows for operations such as uploading, retrieving, and managing large datasets or media files, which is crucial for applications that handle significant amounts of unstructured data.

The Turnstile Server enables AI agents to configure and monitor Cloudflare’s CAPTCHA alternative. By managing Turnstile settings, agents can help protect applications from automated abuse while ensuring a seamless user experience.

Finally, the Audit Logs Server facilitates querying of audit logs. This is essential for maintaining compliance and conducting thorough security audits, providing traceability of actions across systems that the AI interacts with.

These servers are accessible to any MCP client supporting remote connections, including platforms like Claude.ai. This development signifies a step towards more seamless integration between AI agents and cloud services, promoting efficiency and automation in various operational tasks.

HashiCorp has announced the general availability (GA) of HCP Vault Radar, a tool designed to help organizations detect and remediate unmanaged and leaked secrets across their environments. With the GA release, HCP Vault Radar introduces a new feature that allows users to import discovered secrets directly into HashiCorp Vault, streamlining the process of securing sensitive information.

HCP Vault Radar scans various data sources, including Git repositories, CI/CD platforms, collaboration tools like Confluence and JIRA, cloud storage services such as Amazon S3, and infrastructure as code tools like Terraform. By analyzing these sources, the tool identifies secrets like API keys, passwords, and tokens that may have been inadvertently exposed or hardcoded. The findings are then presented in a centralized dashboard, enabling security teams to prioritize and address potential vulnerabilities effectively.

One of the key enhancements in this GA release is the ability to import detected secrets into HashiCorp Vault. This integration facilitates the transition from identifying exposed secrets to securing them within a managed secrets store, allowing for actions such as rotation and revocation. By consolidating secret management, organizations can reduce the risk associated with secret sprawl and improve their overall security posture.

Since its initial Beta release, HCP Vault Radar has enhanced its features to minimize false positives and assist in risk assessment. It evaluates factors such as whether a secret was previously stored in Vault, its version history, and whether it is still active. These insights help security teams determine the severity of each finding and prioritize remediation efforts accordingly.

To support remediation workflows, HCP Vault Radar provides contextual guidance based on the type of secret detected. It also integrates with incident management tools like Slack, PagerDuty, Splunk, JIRA, and ServiceNow, enabling seamless communication and tracking of remediation tasks.

In a blog post on Medium, there is appreciation for Vault Radar’s capabilities in detecting and managing secrets. One user noted, “Vault Radar is a powerful tool for detecting and managing secrets sprawl in your organization,” emphasizing its role in enhancing security practices. 

However, some professionals have raised concerns about the complexity and cost associated with implementing such tools. In a Reddit discussion, a user commented on the challenges of navigating HashiCorp’s offerings, stating, “It’s been really confusing to say the least,” and highlighting concerns about the expense of certain features.

Despite these concerns, there is industry recognition for the importance of tools like HCP Vault Radar in proactively managing secrets and reducing the risk of breaches. As organizations continue to prioritize security, the adoption of comprehensive secrets management solutions is likely to grow.

In a move to enhance internet security, the CA/Browser Forum (CA/B Forum) has approved a proposal to reduce the maximum validity period of SSL/TLS certificates from the current 398 days to just 47 days by March 15, 2029. This decision, initially proposed by Apple and endorsed by major industry players including Google, Mozilla, and Sectigo, aims to mitigate risks associated with long-lived certificates and encourage automation in certificate management.

According to their proposal, the transition to shorter SSL/TLS certificate lifespans will take place gradually over several years. Starting on March 15, 2026, the maximum validity period for certificates will be reduced to 200 days. This will be followed by another reduction on March 15, 2027, bringing the limit down to 100 days. Finally, on March 15, 2029, the maximum lifespan will be shortened to just 47 days, marking a significant shift in how certificate management is handled across the industry.

Additionally, the period during which domain validation information can be reused will decrease from 398 days to 10 days by 2029, necessitating more frequent revalidation processes. 

The rationale behind this change is to enhance security by limiting the window during which a compromised certificate can be exploited. Shorter lifespans reduce reliance on certificate revocation mechanisms, which have historically been unreliable. ​

Some professionals express skepticism about the practicality and necessity of this change. For instance, Daniel V. Bailey questioned the lack of empirical evidence supporting the move, stating:

“Do…uh, we have hard data to show this is a good idea? I get the intent, for sure. Cert revocation checks just don’t work very well, and automated tools can help you renew your certificates automagically. It’s a pity that in practice, companies will have legacy systems and appliances where they can’t easily automate”.

Others highlight the potential operational challenges, particularly for organizations lacking automation capabilities. A Reddit user commented: 

“I think the cost, including to public sector entities, of having to automate all cert rotations – combined with the complete lack of actual evidence (attacks this would have prevented) to sell it as a ‘security’ measure – will result in the government taking a good, hard, overdue look at the influence and gatekeeper power wielded by the unaccountable CA/BF cabal, by the time these deadlines come to pass”.

​Proponents of reducing SSL/TLS certificate lifespans argue that shorter validity periods enhance security by limiting the window during which a compromised certificate can be exploited. As noted by Sectigo, shorter certificate validity periods reduce risks like private key compromise, misissuance, and revocation delays, thereby strengthening digital security. 

Additionally, the move towards shorter lifespans encourages the adoption of automated certificate management. According to AppViewX, short-lived certificates necessitate frequent renewals, which are best handled through automation to prevent certificate expiry and outages. Automated solutions ensure seamless certificate lifecycle management, bolstering compliance, operational efficiency, and digital trust.

As the industry adapts to these changes, organizations will need to assess their certificate management practices and implement automation where possible to maintain security and compliance in the evolving digital landscape.

Docker Desktop 4.40, released on March 31, 2025, introduces a suite of features aimed at enhancing AI development workflows and strengthening enterprise compliance capabilities. 

A notable addition is the Docker Model Runner, currently in beta for macOS with Apple Silicon. This feature allows developers to pull, run, and manage AI models directly from Docker Hub within Docker Desktop, streamlining the process of integrating AI models into containerized applications.

Traditionally, integrating AI models into applications has required manual setup, environment configuration, and often the use of external platforms or tools to run and test models. The Model Runner changes this by allowing developers to pull, run, and manage AI models as easily as they would run containers — directly from Docker Hub, using familiar Docker workflows.

This functionality is important because it bridges the gap between model development and application deployment. Developers can now test models in a controlled environment without needing to rely on cloud-based inference APIs or heavy local setups. This encourages more experimentation and tighter integration of AI into everyday development workflows, particularly useful for building AI-enhanced applications where models need to be embedded or fine-tuned locally.

The Model Runner supports popular model formats and can execute models with standard inputs, making it a general-purpose tool for running inference tasks. Whether it’s image recognition, text generation, or other predictive capabilities, developers can now treat models as first-class citizens in their toolchain. Over time, this could lead to more seamless AI integration across DevOps practices, from prototyping to deployment.

As part of the release, the Docker AI Agent has been upgraded to support the Model Context Protocol (MCP), enabling it to function both as a client and a server. This integration allows the AI Agent to interact seamlessly with external tools and data sources, enhancing its utility in various development scenarios. Developers can now perform tasks such as running shell commands, managing local files, and conducting Git operations directly through the AI Agent. 

Complementing the AI Agent’s capabilities, the new AI Tool Catalog extension in Docker Desktop provides a centralized platform for discovering and connecting to various MCP servers. This extension simplifies the process of integrating additional AI tools and models into the Docker ecosystem, promoting a more modular and customizable development environment. 

For enterprise users, Docker Desktop 4.40 introduces Settings Reporting, a feature that offers administrators comprehensive visibility into user compliance with assigned settings policies. This enhancement builds upon the Desktop Settings Management capabilities introduced in version 4.36, providing organizations with improved tools for enforcing compliance and security standards across development teams.

Overall, Docker Desktop 4.40 represents a step forward in integrating AI development tools into the Docker ecosystem while also addressing the compliance needs of enterprise users.

Edera has announced the general availability of Edera Protect 1.0, a Kubernetes security solution designed to enhance container isolation and address longstanding security challenges in cloud-native environments. Unlike traditional container security tools that focus on post-deployment detection, Edera Protect introduces a “zone”-based architecture, providing strong isolation between containers by default. This approach aims to eliminate entire classes of threats, such as container escapes and credential theft, by re-architecting the standard container runtime.​

Edera Protect integrates with existing Kubernetes infrastructure, allowing organizations to enhance their security posture without disrupting developer workflows. In the general availability release of Edera Protect 1.0, several technical enhancements have been introduced to support secure, scalable container isolation in Kubernetes environments. One of the most significant changes is improved scalability: the system now supports over 250 secure zones per node on hardware with 64 GB of RAM. This advancement enables denser multi-tenant workloads, a common requirement in enterprise Kubernetes clusters.

A key improvement in resource management comes with the introduction of memory ballooning. This feature allows zones to dynamically adjust their memory allocation based on real-time demand, helping reduce resource overprovisioning while maintaining strong isolation boundaries. To address performance concerns around container startup times, warm zones were introduced. This capability should reduce the time it takes to spin up containers, bringing performance levels closer to what teams expect from native Docker environments.

The release also broadens platform compatibility. Amazon Linux 2023 is now supported, and integration with the Cilium Container Network Interface (CNI) allows users to combine Edera’s security architecture with existing advanced networking and observability tools. These integrations aim to support a wider range of infrastructure setups without requiring major changes to existing environments.

The 1.0 release includes Prometheus metrics and health endpoints, making it easier for teams to monitor zone health, resource usage, and system behavior. Additionally, a Terraform module has been introduced for Amazon EKS, simplifying the process of deploying Edera Protect into AWS-based Kubernetes clusters.

The release of Edera Protect 1.0 represents a step towards addressing the inherent tension between platform velocity and security in Kubernetes environments. By providing strong isolation at the architectural level, Edera aims to reduce the reliance on complex, layered security tools and enable organizations to run secure, multi-tenant workloads more efficiently.

Looking ahead, Edera has said they plan to expand the capabilities of Protect by introducing support for defining security boundaries at the Kubernetes namespace layer and deeper integration with cloud provider security features. This continued development underscores Edera’s commitment to enhancing container security and supporting the evolving needs of cloud-native organizations.

In February 2025, researchers at Socket uncovered a significant supply chain attack within the Go programming ecosystem. A malicious package, named github.com/boltdb-go/bolt, was discovered impersonating the legitimate and widely-used BoltDB module. This backdoored package exploited the Go Module Proxy’s caching mechanism to persist undetected for years, underscoring vulnerabilities in module management systems.

​The Go Module Proxy is designed to cache modules indefinitely to ensure consistent and reliable builds. While this immutability offers benefits like reproducible builds and protection against upstream changes, it also presents a risk: once a malicious module is cached, it remains available to developers, even if the source repository is cleaned or altered. In this incident, the attacker leveraged this feature to maintain the presence of the backdoored package within the ecosystem, despite subsequent changes to the repository. 

This case is part of a broader trend where attackers exploit package management systems through techniques like typosquatting. Similar incidents have been observed in other ecosystems, such as npm and PyPI, where malicious packages mimic popular libraries to deceive developers. 

To reduce the risk of supply chain attacks, developers should carefully verify package names and sources before installation, ensuring they’re using trusted libraries. Regular audits of dependencies can help catch signs of tampering or malicious behavior early. Security tools that flag suspicious packages offer another layer of protection, and staying up to date with known vulnerabilities and ecosystem alerts is essential for maintaining safe development practices.

By adopting these practices, developers can enhance the security of their software supply chains and reduce the risk of introducing malicious code into their projects.

Many systems rely on precise and consistent timekeeping for coordination, logging, security, and distributed operations. Even a one-second discrepancy can cause failures in time-sensitive processes such as financial transactions, database replication, and scheduled tasks. For systems that require strict synchronization—like distributed databases, telemetry pipelines, or event-driven architectures—handling leap seconds incorrectly can lead to data loss, duplication, or inconsistencies. As such, managing leap seconds accurately ensures system reliability and consistency across environments that depend on high-precision time.

For those unfamiliar with the concept leap seconds are periodic adjustments added to Coordinated Universal Time (UTC) to account for irregularities in Earth’s rotation, ensuring that atomic time remains synchronized with astronomical time. While necessary for precise timekeeping, these adjustments can pose challenges for systems requiring high-precision synchronization, such as those utilizing the Precision Time Protocol (PTP). PTP is designed to synchronize clocks within a network to sub-microsecond accuracy, making the handling of leap seconds particularly critical.​

Traditional methods of handling leap seconds, such as smearing—where the extra second is spread over a period to minimize disruption—are often employed in Network Time Protocol (NTP) systems. However, applying similar techniques in PTP systems is problematic due to their higher precision requirements. Even minimal adjustments can lead to synchronization errors, violating the stringent accuracy standards PTP aims to maintain.

To address this, Meta has developed an algorithmic approach that is integrated into their PTP service. This method involves a self-smearing technique implemented through the fbclock library, which provides a “Window of Uncertainty” (WOU) by returning a tuple of time values representing the earliest and latest possible nanosecond timestamps. During a leap-second event, the library adjusts these values by shifting time by one nanosecond every 62.5 microseconds. This stateless and reproducible approach allows systems to handle leap seconds automatically without manual intervention. ​

This self-smearing strategy offers several benefits, including seamless handling of leap seconds and maintaining the high precision required by PTP systems. However, it also introduces trade-offs. For instance, discrepancies can arise when integrating with systems that use different smearing methods, such as NTP’s quadratic smearing, potentially leading to synchronization issues during the smearing period.

Managing leap seconds in high-precision environments like those utilizing PTP requires innovative solutions to maintain synchronization accuracy. Meta’s algorithmic approach exemplifies how tailored strategies can effectively address the challenges posed by leap seconds, ensuring the reliability and precision of time-sensitive systems.

Tracking developer productivity metrics is essential for understanding and improving the efficiency of software development workflows. In fast-paced engineering environments, small inefficiencies can accumulate, impacting overall delivery timelines and code quality. By leveraging precise metrics, organizations can identify bottlenecks, assess the impact of new tools, and make data-driven decisions to enhance developer experience. 

Now we can add another new metric to help track the development process better: Diff Authoring Time (DAT). DAT is a new metric developed by engineers at Meta to measure the duration required for developers to submit changes, known as “diffs,” to the codebase, which they shared in a recent Meta Tech Podcast. By tracking the time from the initiation of a code change to its submission, DAT offers insights into the efficiency of the development process and helps identify areas for improvement.

Implementing DAT involves integrating a privacy-aware telemetry system with version control systems, integrated development environments (IDEs), and operating systems. This setup allows for the precise measurement of the time developers spend authoring code changes without compromising privacy. The data collected through DAT enables Meta to conduct rigorous experiments aimed at enhancing developer productivity. ​

For instance, DAT has been instrumental in evaluating the impact of introducing a type-safe mocking framework in Hack, leading to a 14% improvement in authoring time. Additionally, the development of automatic memoization in the React compiler resulted in a 33% improvement, and efforts to promote code sharing have saved thousands of DAT hours annually, achieving over a 50% improvement. ​

The significance of DAT lies in its ability to provide a precise yet comprehensive measure of development productivity, facilitating data-driven decisions to enhance engineering efficiency. By aligning internal development workflows with an experiment-driven culture, DAT supports continuous improvement in software engineering practices. ​

As highlighted in the Meta Tech Podcast, engineers Sarita and Moritz discuss the challenges of measuring productivity, the implementation of DAT, and the new capabilities it unlocks for developers. Their insights underscore the importance of accurate productivity metrics in fostering an environment of continuous improvement within Meta’s engineering teams. ​

In summary, Diff Authoring Time serves as a tool for Meta to assess and enhance developer productivity, enabling the company to make informed decisions that streamline workflows and improve the overall efficiency of its engineering processes.