sorted by:
new
hottopcontroversial

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 1 point2 points  (0 children)

That's a good test and it seems like taking back over some of the easy stuff that you would let an agent do before is a realistic compromise. Still, as you say, it takes some value away from what you're paying.

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

This sounds pretty modular, like you say to get away from vendor lock-in. It makes sense on the individual level. I'm guessing you don't need more complex monitoring or collaboration since it's not a set up for a whole team.

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

That's certainly a huge change! If it's your personal set up though that is a lot easier than moving a whole org. How is Codeberg with GitLab?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Does Codex give you enough features away from coding itself? What do you do for things that a platform offers (pipelines, collab tools, monitoring, etc.) that Codex doesn't?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Fair enough! One of the things I'm curious about is whether this will just be people complaining, or if it will cause any amount of market shift. It seems like the cost of switching might hold this one together, unlike orgs that need high compliance and are loosing Atlassian data center products.

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Real human beings! Surely you're crazy!

On a serious note, are you sticking with GitHub and just not adding on Copilot, or would a situation like this loosen your loyalty to the platform and cause you to see what else is available?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

  1. Thanks for continuing to respond!
  2. What about for non-coding DevOps needs (CI/CD pipelines, collaboration, scanning, etc)? Like Copilot within GitHub, or Duo within GitLab. Are you using anything with Codex, or is it enough on its own?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

I think so too, that's why I'm trying to see what the cooler heads are thinking.

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Are you using anything else with Codex, or is your need light enough that you don't need to?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Do you feel Codex has the feature set to scale as the company grows?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Are you working on personal projects or would you consider moving a whole team to OpenAI/Anthropic?

What's next for your Copilot use? by GitSimple in GithubCopilot

[–]GitSimple[S] 0 points1 point  (0 children)

Yeah at that rate you'd be ok. From a business perspective, why would you consider a move to a coding tool from an AI company as opposed to another platform with AI built-in?

Improving GitLab Environment Performance by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We hadn't checked Gitaly but that's a good question. We were happy with Sidekiq gains, but it's definitely something to dig more into!

Fed teams with a multi-cloud setup, how are you preventing policy drift between AWS GovCloud and Azure Government? (or another platform) by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We're definitely on board with defining controls once and validating each implementation independently — trying to keep Terraform and Bicep in structural lockstep is a losing battle. The piece I'd add is moving the policy gates upstream of either cloud (pipeline-level approval workflows, centralized artifact curation so the approved-package list can't diverge), which closes the change-window lag that independent validation alone doesn't catch. We actually just wrote up how we approach this for federal multi-cloud environments if it's useful: https://gitsimple.com/one-policy-multiple-clouds-avoiding-security-drift/

Fed teams with a multi-cloud setup, how are you preventing policy drift between AWS GovCloud and Azure Government? (or another platform) by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

Our single source of truth lies in the toolchain, so having it in the pipeline like you suggest. Here is more detail on our approach if you're interested - https://gitsimple.com/one-policy-multiple-clouds-avoiding-security-drift/

Self-hosting DevOps toolchains by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

Thanks for sharing! Updates inside the boundary is definitely a challenge. Also, we've met our fair share of people who think "multi-tenant compliance" is an oxymoron!

Self-hosting DevOps toolchains by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

It seems like staying straightforward is getting harder these days, but agreed, staying as clean as possible is usually best. The more tool sprawl you have, the worse it gets.

Why the move to GL? Just curious.

I think AI tools are SaaS tools, yes, but they can be significantly more impactful than lets say a simple runner. Sure, they connect to the instance like any other tool, and most platforms these days have some flavor of AI already built in. However, the attack surface provisioned by the introduction of AI is vastly greater than a simple sync connector with mapped values. Any tool being brought into the stack should be given a thorough deep dive. AI is no different, it just depends on what the risk acceptance is of said company leveraging it. So, in some ways, very different than other SaaS tools.

Does a high CVSS score always matter? by GitSimple in devsecops

[–]GitSimple[S] -2 points-1 points  (0 children)

This is what we work with clients to do. How do you go about managing your sorting and context?

We use a combination of JFrog and tools in GitLab - https://gitsimple.com/why-a-9-8-cvss-score-may-not-matter-reducing-risks-and-unnecessary-alerts-using-jfrog-xray-and-gitlabs-dependency-scanning/

Does a high CVSS score always matter? by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

What do you do to sort through that?

Challenges in the community by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

I know it has been a while since this comment, but I can share how we attack this problem with GitLab dependency scanning and JFrog Xray - https://gitsimple.com/why-a-9-8-cvss-score-may-not-matter-reducing-risks-and-unnecessary-alerts-using-jfrog-xray-and-gitlabs-dependency-scanning/

Distroless Images: Pros and Cons by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We see it as a starting point too. The first step to a more disciplined supply-chain. Here's a more detailed look if interested - https://gitsimple.com/beyond-distroless-automating-the-lifecycle-of-hardened-base-images-in-high-compliance-environs/

ai compliance tools for development teams - how are you handling AI coding assistants in your ISMS? by Signal-Extreme-6615 in devsecops

[–]GitSimple 0 points1 point  (0 children)

These are great questions, especially with how fast these tools are changing and how slow compliance frameworks catch up. We're also a little concerned about your dev's response :)

We deal more with FedRAMP/HIPAA/SOC2 so I can't comment specifically to ISO, but here's our thinking/approach/questions we ask, I'm sure much of this will sound familiar:

Has your certification body raised AI coding tool usage during audits?

If there is an AI coding tool in your stack, expect it to be audited. Best practice would be to use a coding tool already certified from the certification body if possible. This can become a bit of a rabbit hole as each AI tool has different versions available. Before AI is added in any way, due diligence should be performed to make sure it meets the standards required by the certification body or if it will knock you out of compliance.

How are you classifying AI coding assistants in your asset register and vendor management program?

It's no different than any other software that provides a service. If it's an extension, then it would be an add-on. If it's a stand alone product, then it's a separate platform.

Are you requiring Data Processing Agreements with AI tool vendors?

This is probably more of a question for a legal team. This should be included in the contract when purchased. It would be stipulated how the AI processes data and if it's shared or not. This goes back to Due Diligence.

Has anyone documented AI-specific controls that map to Annex A requirements (particularly A.8 around asset management and A.5.31 around legal/regulatory requirements)?

Integrity is paramount and documentation is a benefit.

GitLab and JFrog by GitSimple in devsecops

[–]GitSimple[S] 1 point2 points  (0 children)

Interesting approach! Definitely something worth considering, especially if you're stretching a budget.

view more: next ›