wp-plugin-hostgator
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source:https:\/\/techcrunch.com\/2023\/05\/10\/aws-open-sources-snapchange-and-cedar-sdk\/<\/a><\/br> Amazon Web Services (AWS) has launched two new open source projects today, a move designed in part to address concerns around software supply chain security.<\/p>\n The Amazon cloud computing subsidiary revealed that it\u2019s open sourcing a new fuzzing tool called SnapChange<\/a> and a recently launched authorization policy language and SDK called Cedar<\/a>.<\/p>\n With the likes of SolarWinds and Log4J<\/a> thrusting software supply chain security into the public consciousness these past few years, there has been a concerted effort to invest greater resources in protecting everyone from governments and hospitals to corporations and beyond from bad actors seeking to exploit weaknesses in the software they use.<\/p>\n In the U.S., President Biden issued an executive order back in 2021<\/a> outlining various measures designed to counter such threats, leading Big Tech to launch various initiatives to show that they\u2019re being at least a little proactive. For example, companies including Amazon, Google and Microsoft last year pledged $30 million<\/a> to bolster open source software security.<\/p>\n In the wake of this executive order, however, the U.S. National Institute of Standards and Technology (NIST) also issued guidelines for software verification<\/a> with so-called \u201cfuzzing\u201d recommended as part of its minimum standards<\/a> for software testing.<\/p>\n Fuzzing, or fuzz testing as it\u2019s also called, is a way of continuously testing software\u2019s robustness by throwing random or invalid data at a program to see how it responds. This can be an effective way of finding flaws automatically, before it can be exploited in the wild.<\/p>\n And it\u2019s against that backdrop that AWS is open sourcing SnapChange.<\/p>\n Announced at Open Source Summit North America<\/a> today, SnapChange is the first fruits of an internal team that AWS dubs Find & Fix<\/em>. <\/span><\/p>\n This team constitutes full-time security researchers tasked with finding and fixing bugs in critical open source software, who then share their findings with the relevant project maintainer. AWS says it can also work with the maintainers to provide working patches.\u00a0<\/span><\/p>\n SnapChange started as an experimental fuzzing tool, but now it\u2019s being made available for anyone to use via GitHub. While traditional fuzzers are effective at finding bugs in software, SnapChange is all about \u201csnapshot\u201d fuzzing, which is a more advanced incarnation that uses virtualization technologies such as emulators for more granular execution on hard-to-reach code.<\/span><\/p>\n This also echoes moves made by its cloud rivals including Google, which previously open sourced its ClusterFuzz<\/a> fuzzing tool followed by ClusterFuzzLite<\/a>. Microsoft also open sourced a fuzzing platform<\/a> called OneFuzz back in 2020.<\/p>\n Elsewhere, AWS recently created<\/a> a new authorization policy language called Cedar that\u2019s concerned with defining access permissions in software, allowing developers to write policies that stipulate permissions at a granular level. With Cedar, companies can control access to specific resources such as photos inside a photo-sharing app, or specific nodes in a microservices cluster.<\/p>\n As of today, the Cedar SDK is available on GitHub<\/a> with the promise of bringing transparency into Cedar development (\u201cthere\u2019s no security through obscurity\u201d), as well as allowing any third-party entity to make their own contributions.<\/p>\n<\/p><\/div>\n <\/br><\/br><\/br><\/p>\n
\nAWS open sources fuzzing tool SnapChange and policy-based access control language Cedar<\/br>
\n2023-05-10 22:40:08<\/br><\/p>\nSupply chain<\/h2>\n
Going open source<\/h2>\n