This is the show by and for DevSecOps practitioners who are trying to survive information overload, get through marketing nonsense, do right technology bets, help their organizations to deliver value and last but not the least to have some fun. Tune in for talks about technology, ways of working and news from DevSecOps.
We created this podcast because we realized that we were not the only ones to struggle with security on a daily basis. It is also difficult to find information without marketing content or a product pitch. We don’t intend to sell anything, now or later.
This show is not sponsored by any technology vendor and we are trying to be as unbiased as possible. We talk like no one is listening. For good or bad 😉.
As DevOps improved the collaboration between developers (dev) and operations (ops), DevSecOps includes security aspects into the development and operation of applications. It adds the dimension of security to a DevOps culture.
Enjoy the talks and feel free to participate.
A compromised fridge can mean spoiled stock, while exposed SSH can give attackers a route into your infrastructure. Andrey Devyatkin and Mattias Hemmingsson connect those risks to practical defenses: private access, fewer container tools and automated rebuilds.
Has the fix reached production, does the container need a shell, and who can reach the service? Julien Bisconti joins a discussion that turns those checks into practical priorities for the next vulnerability response.
Internet-facing controllers and predictable passwords put connected equipment at risk. Andrey Devyatkin and Mattias Hemmingsson discuss refrigeration attacks, AI-assisted reverse engineering, regex-based security checks and concerns about remote access to solar inverters.
If AI writes the code, where do juniors learn to build software? Mattias Hemmingsson shares his dark factory workflow, sparking a debate about code review, practical learning and how books help engineers give clearer instructions to AI.
Is knowing one cloud platform enough when agents can fill in the syntax? This episode explores why industry knowledge, clear communication and experience with failure deserve a place in your learning plan.
Your AI agent has your credentials, but does it understand your limits? This episode examines accidental deployments, exposed data and why written guardrails need access controls behind them.
Could your broken pipeline look like suspicious activity to AWS? This episode examines an account block following repeated access denials, separates the observed outcome from the suspected cause, and explains how to respond to an abuse notice.
What changed in Docker while everyone was watching AI? The hosts review BuildKit, Buildx, security features, provenance, and the updates practitioners should know.
Are AI tools making software safer, or creating an endless patching treadmill? Mattias, Andrey, and Paulina discuss Dependabot, human review, and why teams should assume their software is already vulnerable.
CI changed how teams integrate code, but its core promise remains the same: integrate often and keep the mainline green. Andrey and Paulina trace its history and examine how Git, merge queues, and modern pipelines changed the mechanics.