标签：#EVs

Modern applications depend on secrets. Every application requires: Database Passwords API Keys SSH Keys TLS Certificates Cloud Credentials OAuth Tokens Service Account Keys The biggest question is: Where should we store them securely? Unfortunately many organizations still store secrets in: Git Repository Docker Image Application Config Files Environment Variables Shared Documents Excel Sheets This creates a massive security risk. This is why Secret Management platforms like HashiCorp Vault became critical in modern cloud-native environments. 🔗 Resources ** Support the Journey on GitHub: If you're following along, consider starring and forking the repo:** https://github.com/17J/30-Days-Cloud-DevSecOps-Journey What is a Secret? A secret is any sensitive piece of information used to authenticate or authorize access. Examples: Database Password AWS Access Key JWT Signing Key API Token TLS Certificate Private Key OAuth Secret If a secret gets exposed: Attacker ↓ Application Access ↓ Database Access ↓ Infrastructure Compromise What is Secrets Management? Secrets Management is the process of: Store Protect Rotate Control Audit sensitive credentials securely. A modern secrets management platform provides: Centralized storage Encryption Access control Secret rotation Audit logs Dynamic credentials Why Secrets Management Matters Imagine this scenario: database : username : admin password : Password123 committed into GitHub. Result: Developer Pushes Code ↓ GitHub Repository ↓ Credential Leak ↓ Database Breach This happens more often than people realize. The Problem with Traditional Secret Storage Many teams use: .env Files Kubernetes Secrets Configuration Files Hardcoded Passwords Problems: Difficult rotation No audit trail Poor access control Risk of accidental exposure Compliance failures What is HashiCorp Vault? HashiCorp Vault is a centralized secrets management platform designed to securely store, access, and manage secrets. Think of Vault as: Central Secret Bank for you

Static Application Security Testing (SAST) is a critical practice in modern DevSecOps. While tools like SonarQube, Snyk, and Veracode are popular, this article focuses on GitHub CodeQL – a semantic code analysis engine that treats code as a database. We will apply it to a vulnerable Java Spring Boot application to detect SQL Injection and Path Traversal. 🤔 Why CodeQL? Unlike pattern-based scanners, CodeQL builds a relational database of your code, including abstract syntax trees, control flow graphs, and data flow graphs. This allows it to track tainted data across functions, classes, and files, drastically reducing false positives. 🚨 Target Application (Vulnerable Java App) Let's look at a simple REST API with two vulnerable endpoints. File: UserController.java package com.demo.controller ; import com.demo.model.User ; import org.springframework.beans.factory.annotation.Autowired ; import org.springframework.jdbc.core.JdbcTemplate ; import org.springframework.web.bind.annotation.* ; import java.nio.file.Files ; import java.nio.file.Paths ; import java.util.List ; @RestController @RequestMapping ( "/api" ) public class UserController { @Autowired private JdbcTemplate jdbcTemplate ; // Vulnerability 1: SQL Injection @GetMapping ( "/users" ) public List < User > getUsers ( @RequestParam ( "id" ) String userId ) { String sql = "SELECT * FROM users WHERE id = " + userId ; // Dangerous concatenation return jdbcTemplate . query ( sql , ( rs , rowNum ) -> new User ( rs . getString ( "id" ), rs . getString ( "name" ))); } // Vulnerability 2: Path Traversal @GetMapping ( "/file" ) public String readFile ( @RequestParam ( "filename" ) String filename ) throws Exception { return new String ( Files . readAllBytes ( Paths . get ( "/var/data/" + filename ))); } } 🛠️ Installing and Configuring CodeQL CLI You can run CodeQL locally to analyze your code before pushing it to a repository. 1. Download CodeQL from GitHub releases: wget [ https://github.com/github/codeql-cli-binaries/re

Lectric, which says the U.S. market is ripe for competition and choice, has launched three new brands in the past six months.

TL;DR: Non-human identities (service accounts, API keys, workload identities, certificates, OAuth apps, machine-to-machine access) now outnumber humans over 1:1 in most cloud-native orgs. The biggest security risks are unmanaged lifecycle, overprivileged access, and exposed credentials across SDLC and cloud environments, not just secret storage. The best NHI security tools in 2026 fall into four major categories: Secrets Detection and Exposure Prevention NHI Lifecycle and Governance Platforms Machine Identity and Certificate Management Vault and Authorization Extensions Most enterprises require layered coverage across detection, governance, and lifecycle automation. Adopting this multi-layered strategy enables organizations not only to find leaks but also to close the structural gaps that allow them to occur. Why Non-Human Identities Are the Fastest-Growing Attack Surface in 2026 In 2026, attackers rarely try to " hack passwords ". Instead, they exploit the massive, often unmonitored web of non-human identities (NHIs) that power modern automation. They specifically look for hardcoded API keys, overprivileged service accounts, stale OAuth tokens, misconfigured workload identities, unrotated certificates, and shadow SaaS integrations that slip through the cracks of traditional security programs. This is a problem because machine identities far outnumber human users. However, most security programs rely on frameworks designed for human-centric access. IAM Strategy for CISOs: Securing Non-Human Identities Thankfully, top non-human identity protection tools help secure this critical attack surface. By understanding the categories of enterprise NHI security solutions, you can build a strategy that provides complete visibility and robust security controls across your entire infrastructure. What Do Non-Human Identities (NHIs) Include Today? Non-human identities are the digital identities used by machines, services, and applications to authenticate and communicate with other

The company announced a deal with B2U Storage Solutions to repurpose the battery packs as Waymo pulls them off the road.

Tenho aproveitado meu tempo sem trabalhar pra estudar, enfim a vida de quem trabalha com tecnologia né? E um dos meus maiores focos tem sido IA, seus usos, como ela entra e pode ser aplicada em áreas diferentes, e todas as novidades que saem todos os dias. Hoje vim compartilhar uma coisa bem legal que aprendi no curso AI-Native Engineering Foundations do Addy Osmani , o problema dos 70%. Existe um padrão claro que tenho observado na prática ao acompanhar dezenas de equipes de engenharia: a Inteligência Artificial resolve com impressionante eficiência 70% de quase qualquer tarefa técnica. Falo daquela camada previsível, repetitiva e baseada em padrões exaustivamente documentados na internet. Coisas como código boilerplate, arquivos de configuração, implementações de CRUDs simples, conversão de sintaxe entre linguagens e a escrita de testes unitários básicos. A IA já "viu" milhões de exemplos disso em repositórios públicos e consegue reproduzir o padrão em segundos. Para essa fatia do trabalho, ela é uma aceleradora fantástica. O grande problema, e o motivo pelo qual muitos projetos com IA começam bem mas falham no meio, é que os outros 30% são justamente os que sustentam o software. É nesses 30% que entram as decisões que inteligência nenhuma consegue tomar sozinha: Contexto de Negócio: A IA não sabe por que aquela feature está sendo construída ou como ela impacta o usuário final. Arquitetura e Manutenibilidade: Escrever código que funciona hoje é fácil; escrever código que outra pessoa consegue alterar daqui a seis meses sem quebrar o sistema é outra história. Casos de Borda e Segurança: A IA tende a gerar o "caminho feliz". Tratar falhas de concorrência, vazamento de memória e vulnerabilidades específicas do seu ecossistema exige malícia técnica. Essas questões não se resolvem apenas digitando linhas de código, elas exigem contexto, experiência, histórico de dores passadas e, acima de tudo, julgamento humano. E é exatamente aqui que a IA ainda não entrega. O Parado

BYD is giving its self-driving tech a big vote of confidence.

They're more secure than you might think.

Rivian is sending out invites and planning the first deliveries for its R2 electric SUV for June 9.

The Bezos-backed EV startup has yet to announce final pricing for its vehicle, which is supposed to start shipping by the end of this year.

Pre-orders are opening up for Slate, the Spirit Airlines of EV trucks

Waymo is debuting Ojai, its first purpose-built robotaxi

The Bezos-backed EV startup has yet to announce final pricing for its vehicle, which is supposed to start shipping by the end of this year.

At least two owners have lost control of their vehicles after a critical suspension component broke. In both cases, the vehicles had been previously serviced.

When you build a PowerApps Component Framework (PCF) component that will be used across multiple geographies, need to serve labels, button captions, validation messages, and tooltips in the user's preferred language. PCF has a built-in answer based on .resx resource files, the same format used by .NET applications. The mechanism is elegant in production — but surprisingly tricky during local development. This walkthrough takes you through the full setup, step by step, and then explains a problem that arises while locally debugging your PCF. Step 1 — Create the strings folder and your first .resx file PCF expects your localized strings to live in a folder (the conventional name is strings ) inside your component directory. Each language gets its own file, named with the pattern: <ComponentName>.<LCID>.resx The <LCID> part is the numeric Locale ID , not the textual code ( en-US , it-IT ). The framework relies on this naming convention to identify which file to load for a given user. Common LCIDs: Language LCID English (en-US) 1033 Italian (it-IT) 1040 German (de-DE) 1031 French (fr-FR) 1036 Spanish (es-ES) 3082 Japanese (ja-JP) 1041 Chinese Simplified (zh-CN) 2052 Portuguese (pt-BR) 1046 For a component called EquipmentGrid , the structure looks like this: EquipmentGrid/ ├── ControlManifest.Input.xml ├── index.ts └── strings/ ├── EquipmentGrid.1033.resx ├── EquipmentGrid.1040.resx └── EquipmentGrid.1031.resx Tip: Always include 1033.resx (English). The PCF runtime falls back to the first <resx> declared in the manifest when the user's preferred language isn't available, and English is the safest default. Step 2 — Author the resource file content A .resx file is just XML. Here's a minimal Italian version ( EquipmentGrid.1040.resx ): <?xml version="1.0" encoding="utf-8"?> <root> <resheader name= "resmimetype" > <value> text/microsoft-resx </value> </resheader> <resheader name= "version" > <value> 2.0 </value> </resheader> <resheader name= "reader" > <value> System.Resou

The company has finally set a date for the first customer deliveries of what CEO RJ Scaringe has said is "maybe the most important thing we’ve launched to date."

Our first look at a complete version of Ferrari's upcoming luxury EV that was designed by LoveFrom.

Fiz um curso de devweb e achei que tinha aprendido JavaScript O problema Fiz um curso de...

It will be available on all Rivian Gen 1 and Gen 2 vehicles, as well as on the R2 when it launches.

It's part of yet another ambitious pivot for the UK car maker.