Petes Linkedin Blog

   This blog post is Unfiltered    Dependency Scanning relies on the GitLab Vulnerability Database (called gemnasium-db ) to provide it with the latest advisory data (i.e. CVEs). Dependency Scanning docker images are built and released with the latest version of the database and in addition, the analyzers update this database to the latest version at the time of a scan. However, starting with version 2.8.1 of the Dependency Scanning analyzer called gemnasium, the vulnerability database was not updating itself at scan time . Versions between v2.8.1 (released 2020-03-30) and v2.28.0 (released 2021-02-03) are affected by this bug. As a result, since the introduction of the bug, scan results would only be able to identify advisories published on or before the analyzer image release date. In some cases this meant that the advisories' Dependency Scanning analyzers were outdated by several weeks (relying only on the database checked out at image build time). We are con...

   This blog post is Unfiltered    Last week, I attended the Crucial Conversations training . Since joining the GitLab Learning and Development team back in October of 2020, requests for support in having difficult conversations with team members have been a recurring theme from people leaders. I completed this training as the first step in a two-part training that will enable myself and other members of the Learning and Development team to be certified to train the GitLab team in having crucial conversations. In this post, I'll outline a few key takeaways from the course, share how crucial conversations look in an all-remote work environment, and explain how crucial conversations connect to our CREDIT values . What are crucial conversations? When a conversation turns crucial, emotions and stressors are running high. Crucial conversations can occur any day, at any time, with any person. They can be planned or they can come out of a casual conversation. Crucial ...

At GitLab, we believe giving and receiving useful feedback is an important way to grow as a company and as individuals . Feedback comes in many forms through synchronous and asynchronous communication channels. Giving feedback can be scary because we fear we might damage a relationship, lose face or hurt someone we work with regularly. We focus on our sub-value of kindness when we give and receive feedback to reduce this fear and share ways to improve. Kindness demonstrates that we care for people by challenging them directly and delivering feedback. We reinforce this sub-value to ensure team members are kind in providing feedback by doing the following: If its hard feedback, do it in a small group Make the feedback specific Feedback should be improvement oriented Don't give feedback when you're upset or having a bad day! We do our best to practice Radical Candor at GitLab , to care personally and challenge directly. To help build trust, we start by offering feedback on...

We’re sharing details on a vulnerability that caused CI jobs containing masked CI variables to be revealed. We’re communicating here to ensure affected users are aware and take action as well as to uphold our transparency value . Am I affected? If you have masked variables on Gitlab.com, you could be affected. These variables could be at either the project or group level. If you ran a CI pipeline between February 11th 13:00 through Feb 16 01:16am UTC on GitLab.com shared runners that output masked variables, you are affected. If you are a self-managed customer who has deployed runner version 13.9.0-rc1, pipelines that are run by that runner which output masked variables are affected. How could my masked variables be printed in the build logs? Any mechanism that show the variable would have been done in an unmasked state while using runner version 13.9.0-rc1. Example commands include: echo $variable_name echo $variable_name > variable.txt; cat variable.txt some-command $...

Most people know GitLab is a solid tool in today's DevOps workflows, with code reviews, CI/CD, and project management all available for users in a single application. But there are always ways to be more efficient. Since we use GitLab to develop GitLab, everyone has their own habits and hidden gems to speed things up. We chatted about GitLab efficiency tips after seeing new quick actions releases in GitLab 13.8 , and decided to share some of our favorite tips with GitLab users. We share our typical day-to-day workflows as an engineering manager (Roman) and a developer (Michael) to show how quick actions make teams more productive and efficient. Roman: Engineering manager starts planning I am an engineering manager on the Create: Editor team at GitLab. One of my responsibilities is capacity planning with product managers. Planning happens every month for the next GitLab release . GitLab uses the milestone feature to keep everything organized for the release. As planning goes on...

Kali Linux is a well-loved Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. We sat down with Ben Wilson ( @g0tmi1k ), senior developer at Kali, to hear more about why Kali Linux moved to GitLab and see if they've noticed any changes to their project since adopting GitLab as their DevOps solution. Why did you decide to move to GitLab? We decided to move from Gitolite to GitLab around April 2019 to make it possible for our community to contribute to Kali. Our previous setup didn't allow anyone to sign up, so the community couldn't help out. Another complication was using a mixture of services such as Google Docs and Phabricator, and we wanted to condense our tool stack. We love that GitLab is a single platform for the whole software development lifecycle. One thing that was important for us is that we didn't want to reinvent the wheel. We tried to choose something open-source with advanced functionality, an active communi...

As the working world embraces the reality that we aren't going back to old ways of working, a growing chorus of leaders are forecasting a hybrid-remote future. While the allure of this concept is understandable — it seems to present the best of two worlds on paper — a great deal of nuance lurks. Sorry to break it to all of the remote-only people, but I think offices will make a comeback. — Allison Barr Allen (@abarrallen) January 14, 2021 In fact, without great deliberation, care, and intentionality, hybrid can deliver the worst of both worlds. If you're charging down this road, you'll want to consider and plan for the points below to minimize dysfunction and the toxic friction of a two-tier work environment . Only some days in the office Companies that mandate or encourage one or more days per week in-office should be mindful of three important factors: This inhibits team members from considering drastically different living locales, because they still need to b...