onCommit @onCommit

DevSecOps evangelist and coach. Passionate about helping IT delivery teams to ship safer software sooner. Hartford, CT Joined May 2011

Tweets

3K
Followers

317
Following

220
Likes

1K

onCommit @onCommit

3 years ago

The SBOM forum has addressed the naming problem in vulnerability mapping space: darkreading.com/vulnerabilitie…

0 0 1 0 0

TDD is a development process, a discipline, a method if you like. It is not “writing tests” nor is the presence of tests “TDD” nor are the test themselves “TDDs.” Test-Driven is a way of writing code, not the automated test residue left behind.

7 45 155 0 3

NoelCaslerComedy @caslernoel

3 years ago

Are we not gonna talk about the sniffing in Trump's Hannity interview or is that my job? @GOP

789 3K 26K 0 109

Brian Tyler Cohen @briantylercohen

3 years ago

Just trying to imagine what Sean Hannity would say if Barack Obama stole hundreds of classified documents and went on his show and told him that it’s all good because he had already declassified everything in his mind.

937 6K 40K 0 174

onCommit @onCommit

3 years ago

This wins Twitter for today!

Ms Mary Kay ♥ @Watiri_bossbabe

3 years ago

This wins Twitter for today!

0 2 13 0 1

Download Image

0 0 0 0 0

onCommit @onCommit

3 years ago

This is handy!

Harshad shah @harshad_hacker

3 years ago

This is handy!

2 11 17 0 5

Download Image

0 0 1 0 0

onCommit @onCommit

3 years ago

Oh my!

Ioan Munteanu @MunteanuIoan13

3 years ago

Oh my!

1 15 31 0 3

0 0 1 0 0

onCommit @onCommit

3 years ago

I'm pretty sure most of this MUST GO BACK TO THE OFFICE is driven by a fear that commercial real estate is about to collapse in value. First retail stores disappeared and now offices so supply is way surpassing demand

0 0 1 0 0

onCommit @onCommit

3 years ago

I'm increasingly of the opinion that SBOMs come up short. I want the whole development container with the checked out version of code on it! Source + Tools = Product

0 0 1 0 0

onCommit @onCommit

3 years ago

Hot take on SBOM's Source + tools = product where 'tools' are public and private libraries along with the compiler/sdk. SBOMs will need to have all of that info and not just 3rd party libs.

0 0 0 0 0

onCommit @onCommit

4 years ago

FYI folks

USCYBERCOM Cybersecurity Alert @CNMF_CyberAlert

4 years ago

FYI folks

63 2K 3K 0 135

0 0 0 0 0

ShiftLeft @ShiftLeftInc

4 years ago

ShiftLeft enterprise customers have a 91.4% fix rate when performing scans at least weekly and using build rules. Read the latest AppSec Shift Left Progress Report: hubs.li/H0TmZPZ0 #appsec #shiftleft #devops

0 1 4 0 0

Download Image

ShiftLeft @ShiftLeftInc

4 years ago

Are you prepared to mitigate XStream Vulnerabilities? Learn more about our Intelligent Software Composition Analysis tool: hubs.li/H0Trf_D0 #sca #appsec #xstream

0 1 3 0 0

Download Image

onCommit @onCommit

4 years ago

Somewhat unsurprisingly it seems that teams who put SAST in their CI tend to fix most everything before it ships, who knew? ;-)

ShiftLeft @ShiftLeftInc

4 years ago

Somewhat unsurprisingly it seems that teams who put SAST in their CI tend to fix most everything before it ships, who knew? ;-)

0 4 7 0 0

Download Image

0 0 0 0 0

onCommit @onCommit

4 years ago

I’ve been finding these to be fun and insightful

Vickie Li @vickieli7

4 years ago

I’ve been finding these to be fun and insightful

0 27 74 0 19

Download Image

0 0 1 0 0

Vickie Li @vickieli7

4 years ago

The Secure Developer Challenge is back! This time, let's bust some misconceptions about HTTP security headers. Submit the answer correctly for some free snacks🍦go.shiftleft.io/developer-chal…

0 27 74 0 19

Download Image

onCommit @onCommit

4 years ago

Ten years ago I took up the onCommit handle to separate my 'professional' from the personal in part because companies frowned on their employees posting on social media. Subversion was the name of game back then ;-) #MyTwitterAnniversary

0 0 0 0 0

Download Image

onCommit @onCommit

4 years ago

Transparent benchmarking would be a huge improvement in this space where few folks can disambiguate a false positive from a false negative.

ShiftLeft @ShiftLeftInc

4 years ago

Transparent benchmarking would be a huge improvement in this space where few folks can disambiguate a false positive from a false negative.

0 1 2 0 0

Download Image

1 0 0 0 0

onCommit @onCommit

4 years ago

My favorite person at ShiftLeft has updated my favorite open source security tool! Be sure to check it out and don't spend money on similar commercial tools.