Recent Blog Posts

This is a speaker blog post for a DevOps World | Jenkins World 2019 talk in Lisbon, Portugal and has been posted in line with NCC Group responsible disclosure policy. Related Jenkins security advisories: 2017-11-08, 2017-11-16, 2018-06-25, 2018-07-30, 2018-09-25, 2019-02-19, 2019-03-06, 2019-03-25, 2019-04-03, 2019-04-17, 2019-08-07, 2019-09-12, 2019-10-01, 2019-10-16, 2019-10-23. Some of the vulnerabilities have been announced without a fix, see Jenkins Security Spring Cleaning 2019. The most of the announced vulnerabilities are fixed at the moment of this blogpost publishing. Come join us at DevOps World | Jenkins World 2019 for " The Story, the Findings and the Fixes Behind More than 100 Jenkins Plugins Vulnerabilities ", a talk about the most common vulnerabilities found during research in more than 100 plugins. We’ll review how to prevent these vulnerabilities during plugin development so that a more secure Jenkins CI and CD environment can be built. When I first began familiarising myself with Jenkins, I found myself almost overwhelmed by the amount of plugins to choose from. Most of these plugins are developed by third party developers or companies and can assist the user in a range of ways. They can extend the core functions, they can offer solutions to repetitive tasks or they can help with using a service. For example, they could help with publishing to an artifact store or spinning up cloud instances. However, before a plugin can use a network based service that requires credentials to connect, those credentials have to be typed in and saved somewhere. This raises the question, are those credentials stored securely? Or not? When I started looking at different plugins this was one of the first areas I investigated. I found a Jenkins security advisory describing this issue and came to the conclusion that this could be a problem in some plugins, albeit one that could be fixed easily. I found an example of weakly stored credentials in the Publish Over Dropbox Plugin; this plugin used a simple web form with a textbox element to display the token in the plugin’s settings page. This token was stored in plaintext: The following Jelly code was behind the web form and shows that a password field wasn’t used: The related plugin .xml file contained the secret key in plaintext: GLOBAL woodspeed lYD2VnNz lYD2VnNz Jenkins offers at least two ways to store credentials in an encrypted format: Using a Secret type offered by Jenkins Third party plugin called Credentials Plugin The first case is the easiest solution, because Jenkins will automatically handle the encryption and decryption. Developers should also use the password field tag instead of the textbox field, as shown in the following Jelly control example: If you would like to know what other vulnerabilities I discovered and how to fix them, come and join us for the presentation in Lisbon! In case you are unable to attend the conference, you can read more at Story of a Hundred Vulnerable Jenkins Plugins.

DevOps World | Jenkins World San Francisco was August 12 - 15, 2019. The event was delivered in vivid colors starting with flowing banners hung from street lamp posts to the big screens in breakout rooms, to the expo hall. The energy and enthusiasm in the Moscone convention center made the colors even more vibrant, thanks to the people attending the conference. Here’s a recap of the conference in pictures: DevOps World | Jenkins World 2019 - San Francisco Keynote - Evolution of the Continuous Delivery Foundation Tracy Miranda opened the keynote explaining the evolution of the Continuous Delivery Foundation. Keynote - Evolution of the Continuous Delivery Foundation Influencers, Creators, and Members The influencers, creators, and members of the CD Foundation: Tracy Miranda (far left), Andy Glover (Netflix), Tara Hernandez (Google), Chris Aniszczyk (Linux Foundation), Dave Stanke (Google), Kohsuke Kawaguchi (Jenkins creator), Jayne Groll (DevOps Institute), James Strachan (Jenkins X creator). “We want to help set Jenkins up for success, into the next decade”, Tyler Croy (not in picture). Influencers, Creators, and Members of the Continuous Delivery Foundation Contributor Summit The inaugural Continuous Delivery Foundation Contributor Summit and it was a full house! Continous Delivery Foudnation Contributor Summit 15 Years of Jenkins A remarkable milestone for the Jenkins project, a celebration of Jenkins turning 15…​cake included! Fifteen Years of Jenkins Bee Diverse Luncheon Interactive and engaging luncheon celebrating diversity Bee Diverse Luncheon Entrance Bee Diverse Luncheon Leading Voices Bee Diverse Luncheon Group Discussions Jenkins Contributors and Experts Jenkins contributors and experts on hand to educate and share lightning talks and provide one on one Jenkins support. Jenkins Lightning Talks Jenkins Experts Answering Questions Jenkins Experts Discussing and Helping Jenkins Experts Gathered DevOps Superheroes Even though the conference offered endless learning and networking possibilities, and major milestones worth celebrating, I felt the true highlight of the conference was the celebration of each individual, “You”. “You” are the super hero, the driving force behind the incredible innovations to advance technology to where it is today. Here’s celebrating the super heros in all of YOU! DevOps Superheroes Superheroes and the Wookie Four Superheroes Kohsuke Kawaguchi - Founding Superhero A DevOps League of Superheroes Crowd of Superheroes This party will be coming to Lisbon, Portugal on December 3-5, 2019. We hope to see our EU Jenkins fans at DevOps World | Jenkins World Lisbon. Use JWFOSS for a 30% discount off your pass. Hope to see you in Lisbon!

This is a speaker blogpost for a DevOps World | Jenkins World 2019 talk in Lisbon, Portugal With Halloween upon us, there’s no better time to discuss Jenkinstein! Are you suffering from Jenkins performance issues? Are users complaining about a slow UI or even scarier, is Jenkins going down frequently? Come join me at DevOps World | Jenkins World 2019 for " Jenkins Performance: Avoiding Pitfalls, Diagnosing Issues, and Scaling for Growth ", a talk about JVM administration and best practices from the front lines of supporting thousands of Jenkins installations worldwide. During this talk we’ll cover how to prevent your Jenkins instance from becoming a Jenkinstein! Topics we will be discussing: JVM administration best practices Horizontal scaling Analyzing thread dumps, GC logs, and heap dumps Real world data showing 3500% performance increases Garbage collection We’ll be discussing how you can forecast for growth, and baseline using key performance indicators like application throughput and latency, by analyzing spooky data like Garbage Collection logs! Come join me for the presentation in Lisbon! There will be candy! Slides

This is a speaker blogpost for a DevOps World | Jenkins World 2019 talk in Lisbon, Portugal Come join us at DevOps World | Jenkins World 2019 for " Thinking about Jenkins Security ", a talk about securing your Jenkins server. We’ll review the layers that secure Jenkins and describe techniques that you can use to protect your Jenkins server. Topics will include: The secure by default configuration that Jenkins provides Risks associated with reducing default security settings Authentication and authorization alternatives Using " least privilege" principles Jenkins credentials and trusted access to resources Software updates and Jenkins project security notices We’ll intermix descriptions of good practices with some security horror stories. The horror stories remind us of our mistakes; we will discuss how to detect them and how to prevent them. Come join us for the presentation in Lisbon! Slides

Jenkins turns 15 years old! Jenkins World brings together DevOps thought leaders, IT executives, continuous delivery practitioners and the Jenkins community and ecosystem in one global event, providing attendees with the opportunity to learn, explore, network face-to-face and help shape the next evolution of Jenkins development and solutions for DevOps. There is also the Jenkins Contributor Summit in San Francisco. The Jenkins Contributor Summit is the place where current and future contributors get together to discuss, learn and collaborate on the latest and greatest efforts within Jenkins project. The morning portion of the summit is a mix of presentations by the core contributors. The presentations highlight what each effort is about and what community members can do to help. In the afternoon breakout sessions with Birds of a Feather tables for in-depth discussion, and collaboration with sub-project contributors. I feel very honored to have been a part of this. Day 1 Day one started with the contributor summit. This was a chance for everyone to get together and talk about contributions and put faces to names. Most people I had only met via video chat or on gitter so I was super excited. We gathered to hear about the start of the Jenkins open source landscape. Next up was the BoF/Unconference. I was leading these sessions and I felt they went really well. We had fellow org admins Martin d’Anjou and Jeff Pearce give a talk about Google Summer of Code projects. Google Summer of Code student Natasha Stopa presented her project, Plugin Installation Manager Library/CLI Tool. This is a super cool project and very well received in the community. We closed out the session with a presentation from Steven Terrana from Booz Allen Hamilton and the awesome Jenkins Templating Engine. If you have not had a chance to try this, please make sure you do at https://github.com/boozallen/jenkins-templating-engine. Main Expo Hall Day two and onward saw me and other Jenkins org admins in the Ask the Expert booth for the Jenkins community. This was a really cool experience and gave me a chance to hear about things the community is working on and help with issues they are facing. There were a range of questions from Jenkins X to many of the plugins I maintain such and the Jenkins Prometheus and the Sysdig Secure Scanning plugins. There were also a lot of Kubernetes questions. There is a lot of marketing data regarding the increased usage of Kubernetes but I was seriously surprised by the massive interest in Jenkins on Kubernetes. Of course there were opportunities for selfie requests. Lunch time demos got underway and we had a busy schedule. First up was the awesome Mark Waite to talk about the Git plugin. A lot of people use git in Jenkins. Thank you so much for all that you do Mark. Jenkins org admin Martin d’Anjou was next on deck to talk about the Google Summer of Code. So amazing to think that the Google Summer of Code is also in its 15th year like Jenkins! Natasha Stopa is a Google Summer of Code student and she presented her project Plugin Installation Manager Library/CLI Tool. Natasha really put a lot of hard work in to this plugin and it was really awesome to see the turn out and support during her presentation. Finally there was me. I presented the Sysdig Secure Scanning Jenkins plugin which I am a maintainer of. I thank everyone who attended Right after the lunch time demos I also oversaw the Jenkins open space. This was an opportunity for the community to talk about items and let them flow organically. I really enjoyed this session and felt it was also well received. We closed out the day and the event with a picture of some of the Jenkins org admins and Google Summer of Code students. Missing from this photos are fellow org admins, Lloyd Chang and Oleg Nenashev Closing This was an amazing experience. Huge thanks to CloudBees, the Jenkins community, Google Summer of Code, Tracy Miranda, Alyssa Tong and my employer Sysdig. To think Jenkins is 15 years old is amazing! There has been so much accomplished and the future is so bright. I am so thankful for the opportunity to serve and be a part of the open source community. Here’s to 15 more years all! If you are interested in joining any one of the Jenkins open source special interest groups, look here. We can use your help: https://jenkins.io/sigs/ If you are interested in joining the Summer of Code, look here: https://jenkins.io/projects/gsoc/ If you want to chat with us, find us here: https://jenkins.io/chat/ Or if you want to email us, reach out at: https://jenkins.io/mailing-lists/ Some photos outtakes:

Last week I had the privilege of attending DevOps World - Jenkins World in San Francisco to present my Google Summer of Code project for plugin management. It was an amazing experience getting to meet people from all over world who are trying to make the development and release process easier and more efficient. I enjoyed learning more about industry tools, processes, and standards, and meeting CI/CD experts and contributors in the open source community. Below is a summary of my experience. Thank you to the Jenkins project and CloudBees for making my trip and attendance possible! Day 1 Monday was the Continuous Delivery Contributor Summit, which focused on projects under the CDF umbrella. After checking in and grabbing my badge, I was able to meet up with some of the Google Summer of Code org admins. It was great being able to actually meet them in person after talking to them over video conferencing and chats all summer! Tracy Miranda started the summit out by introducing the Continuous Delivery Foundation, which aims to provide a vendor neutral home to help and sustain open source projects focusing on all aspects of continuous delivery. Currently, Jenkins, Tekton, Spinnaker, and JenkinsX have joined the foundation. Project updates were given for Jenkins, Tekton, and JenkinsX. In the afternoon, attendees split into different groups for unconference sessions. I presented my project to the Jenkins group. Afterwards, there was free time to chat with other attendees about my project and the other Jenkins projects. Lastly, lightning talks were given before everyone headed to the contributor appreciation event to grab some food and drinks. Day 2 I attended the Jenkins Pipeline Fundamentals Short Course in the morning. Even though I’m working on a project for Jenkins, there’s still a lot I don’t know so I just wanted to try to learn more. A lot of the afternoon sessions filled up, so I spent the afternoon trying to meet other people at the conference, before heading to the keynote. The keynote talked more about the CDF and some of the backstory behind its origin. This year is also a big anniversary for Jenkins - it has now been around for 15 years. After the keynote, I checked out a Women in Tech mixer and the opening of the exibition hall. Probably my favorite swag I picked up was the "Will Code for Beer" stickers and a bottle of hot sauce. Day 3 The morning began with another keynote. Shawn Ahmed of CloudBees talked about the challenges of visibility into bottlenecks of the development process and Rajeev Mahajan discussed how HSBC tackled DevOps. The rest of the day I attended different sessions on container tooling, implementing CI/CD in a cloud native environment, running Jenkins on Jenkins, and database DevOps. After the sessions finished, I wandered around the expo until it closed, then joined some of the other conference attendees to have some fun at a ping pong bar nearby. Day 4 The final and last day of the conference was probably my favorite. The morning keynote revealed that Zhao Xiaojie had won an award for his work on Jenkins advocacy, some other DevOps award panelists talked about their approaches to different challenges, then David Stanke gave an enjoyable presentation about cloud native CI/CD. I was able to present my summer project and attend a few more sessions, including one about DevOps at scale, and another about use cases for machine learning in CI/CD pipelines. The last keynote given by James Governor was a thoughtful look into the current and future states of tech. How does tech look like it will scale in the coming years in the U.S. and across the world? How can we make tech more inclusive and accessible? What can we do to minimize our environmental footprint? In particular, his points on welcoming people from a non-traditional computer science background resonated with me since I’m currently undergoing my own career transition to tech. After the conference ended, I said goodbye to the remaining GSoC org admins before meeting an old friend for dinner and bringing along some new friends I met at the conference. I spent the remaining part of the night singing karaoke with them before heading out of San Francisco the next morning. Thanks again to everyone who supported me and encouraged me leading up to and during my presentation, patiently answered my questions as I tried to gather more context about CI/CD tools and practices, and made my first DevOps conference so enjoyable!