Dependabot Automatically Creates GitHub PRs to Fix Your Vulnerabilities

Leveraging GitHub Security Advisory API, Dependabot aims to help developers track their dependencies, monitoring the security of their programs, and making sure any potential vulnerabilities are removed as easily as possible by automatically creating PRs to resolve them.

GitHub Draft Pull Requests Enable New Collaboration Workflows

GitHub has introduced draft pull requests to handle work-in-progress scenarios where you might want to open a PR or start a conversation with your teammates before your code is ready to be reviewed.

Mitigating Software Vulnerabilities at Microsoft over the Last 20+ Years

At BlueHat IL 2019, Microsoft engineer Matt Miller described how the software vulnerability landscape has evolved over the last 20+ years and the approach Microsoft has been taking to mitigate threats. Interestingly, among the major culprits of security bugs, says Miller, are memory safety issues, which account for 70% of total security bugs Microsoft has patched.

Google Researchers Say Spectre Will Haunt Us for Years

According to a paper by several Google researchers, speculative vulnerabilities currently defeat all programming-language-level means of enforcing information confidentiality. This would not be just an incidental property of how we build our systems, but rather the result of wrong mental models that led us to trade security for performance without knowing it.

Deliveroo Adopts Rust to Improve Performance in Core Service

Deliveroo reimplemented performance-critical components of their Dispatcher service in Rust, with an overall 4x performance improvement. InfoQ spoke with Deliveroo engineer Andrii Dmytrenko to learn more about the advantages they got from this rewrite and what it took to get there.