From the Frog's mouth

Don’t let Prometheus Steal your Fire

October 12, 2021 Andrey Polkovnychenko and Shachar Menashe | 12 min read

Background Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations including Uber, Slack, Robinhood, and more. By scraping real-time metrics from various endpoints, Prometheus allows easy observation of a system's state in addition to observation of hardware and software metrics such as memory…

Proceed With Care: How to Use Approval Gates in Pipelines

October 7, 2021 Maharshi Patel | 5 min read

While DevOps automation aims to eliminate most human intervention in the CI/CD DevOps pipeline, you can’t always cut people completely out of the process. There are still times when you’ll want an expert, hands-on review to assure that everything is as it should be before allowing your pipeline to proceed further. That’s why JFrog Pipelines…

Get Cybersmart with JFrog This October

October 5, 2021 Michal Brenner, Product Marketing Manager, JFrog | 4 min read

We live in a world of increasingly connected devices - phones, digital assistants, smart watches, cars, thermostats, refrigerators, windmills, and more. More than 50% of the world’s population is now online and two-thirds own a mobile device, according to the World Economic Forum. Additionally, the codebase of today’s applications typically consists mainly of open source…

23andMe’s Yamale Python code injection, and properly sanitizing eval()

October 5, 2021 Andrey Polkovneychenko and Shachar Menashe | 5 min read

Background JFrog security research team (formerly Vdoo) has recently disclosed a code injection issue in Yamale, a popular schema validator for YAML that's used by over 200 repositories. The issue has been assigned to CVE-2021-38305. The injection issue An attacker that can control the contents of the schema file that's supplied to Yamale (-s/--schema command…

The Vulnerability Conundrum: Improving the Disclosure Process

October 4, 2021 Asaf Karas, Security CTO and VP, JFrog | 5 min read

The vulnerability disclosure process involves reporting security flaws in software or hardware, and can be complex. Cooperation between the organization responsible for the software or hardware, and the security researcher who discovers the vulnerability can be complicated. In this blog we’ll look at the vulnerability disclosure process, the parties involved and how they can collaborate…

Fold Your Repos Into PHP Composer v2 with Artifactory

October 1, 2021 Barak Hacham and Gianni Truzzi | 5 min read

If you’re among the nearly one in four professional developers using PHP (according to StackOverflow’s 2021 survey), then the maintainers of Composer would really like you to migrate from v1 of the PHP package manager to v2. On October 24 2020, Composer 2.0.0 was released with some major improvements.Since almost eight out of every ten…

The Importance of Prioritizing Product Security

September 30, 2021 Sarit Tager, VP Product, JFrog Security | 7 min read

Achieving comprehensive security for the products delivered and deployed by organizations is becoming more difficult, due to a variety of factors. A key one is the growing volume, variety and complexity of software and connected devices in use. Another is the overwhelming risk of inherited software supply chain exposures. The result: Companies struggle every day…

JFrog Xray + Splunk + SIEM: Towards Implementing a Complete DevSecOps Strategy

September 29, 2021 Ali Sardar, Senior Product Manager, JFrog | 3 min read

Making security an intrinsic part of a DevOps pipeline is a “must-have” for organizations looking to secure their applications earlier in the development process. The combination of JFrog Artifactory and JFrog Xray enables organizations to build security into all phases of their software development lifecycle, so they can proactively detect and mitigate open source software…

Conan Center Celebrates 1,000+ Recipes

September 28, 2021 Lori Lorusso | 2 min read

We’re delighted to thank the Conan community on reaching a major milestone, the public contribution of over 1,000 Conan recipes to Conan Center, the repository for hosting C/C++ packages! Conan recipes are Python-language files that describe how a Conan package is consumed. Each recipe is used to produce hundreds of C/C++packages, so this is an…

Welcome to the JFrog Blog

Latest:

GitLab vs JFrog: Who Has the Right Stuff?