As requested by many attendees, you can download the slides right now. If you already have Jenkins (or Hudson) up and running, you might want to give it a try. The Insight for CI plugin is available in the plugin center and trivial to install and configure. Just add a post build step and configure it to scan e.g. your build output war file. The summary and component results are completely free and will give you a very good indication of the security and license issues (or better their absence) of your software. If you are using a different CI server, you should let us know so we can adjust our priorities. And we even got you covered for manual scans – have a try with Insight App Health Check.

Another thing we’ve been saying is that it is our responsibility, as developers, to start paying attention to security vulnerabilities, and if we don’t take responsibility for application-level security, someone else will impose this requirement on us…

…and that’s exactly what’s we’re seeing both in the EU’s reform of Data Protection Laws and as the US Congress responds to the latest data breach at LinkedIn. Now, who knows what sort of regulations we’re going to see in the coming months, but one thing is sure, the fact that lawmakers feel compelled to act is proof that we’re not doing enough as an industry to address security.

The best security is a layered approach: multiple levels of network security, security policies for production resources that limit access to individuals that need it, secure password policies, and application security. Sonatype’s focused on that last item, application security, and our approach focuses on the components you assemble to create your applications. If you develop software today, you understand that much of your work is spent creating applications that sit atop frameworks like Spring and Hibernate. It isn’t enough for your own software and infrastructure to be secure. These days, you need to account for vulnerabilities in your dependencies.

And, again, this isn’t operation’s responsibility. Security is a shared responsibility across both development and operations. This is something that developers need to take ownership of. While we’ll probably never know how sites like LinkedIn, eHarmony, and Last.fm were compromised, there’s a good chance that some of these sites were compromised via known vulnerabilities in outdated components. Components like Tomcat or frameworks like Struts are among the list of artifacts that have known problems.

Don’t get hacked because you didn’t upgrade to the latest version of Tomcat or because you happened to be using some ancient version of Spring with a known vulnerability. If you are consuming artifacts from Central (and if you are a Java developer, you probably are), you need to start using Nexus Professional to keep track of your dependencies. If you are using Hudson or Jenkins, take some time to evaluate Insight for CI.

A big thanks to all of you who registered and attended our Insight for CI Demo last week. We had a great turnout and a lot of fantastic questions! If you didn’t have a chance to register, that doesn’t mean you have to miss out. The replay is now available.

Request the webinar recording here.

Ready to try Insight for CI for yourself? Let us help you get started.

Thank you!

“Nearly two-thirds of security leaders say their senior executives are paying more attention to security today than they were two years ago, due in large part to media attention.” and “60 percent of the advanced organizations named security as a regular boardroom topic, compared to only 22 percent of the least advanced organizations”

Instead of simple three-tiered applications following a standard Apache -> Tomcat -> RDBMS pattern, today’s scaleable applications involve a portfolio of technologies: Redis, Hadoop, real-time BI systems, integration with 3rd party APIs, Node.js, with more and more companies adopting a portfolio of technologies. It is becoming increasingly difficult to draw a line around a particular application and evaluate security vulnerabilities in isolation.

Today, you need to have your security group sitting next to you evaluating a complex application as it evolves…. but, back to the article, it isn’t just the evolution of technology that is making security a focus for business, it is a series of high-profile, embarrassing data breaches. A CEO that wouldn’t have thought very much about security technology a few years ago, sees what happens to a Stratfor or Global Payments and they understand the risks. Data security is front and center in the news, and a data breach can be a business-ending event.

So get out in front the problem. Start tracking your application dependencies and identify known vulnerabilities with Insight.

When we launched Nexus Professional and integrated Sonatype Insight information we gave you the ability to keep track of your overall exposure to security vulnerabilities. Your IT organization gained a window into the intersection of known vulnerabilities with the artifacts you download from Central. That was a good start, but the real benefit is Insight for CI. We launched Insight for CI this week, and it’s the tool you’ll want to use to address security vulnerabilities in specific products. If it is your responsibility to keep up with security, one of the easiest ways to take a more proactive approach is to start using Insight for CI to track your application’s dependencies.

Click here to get started with Insight for CI. It works with either Hudson or Jenkins, and it covers both license and security information.

Join Brian Fox tomorrow, Wednesday, May 23 at 11AM EDT or 2PM EDT (GMT-0400) for a 30 minute tour of Insight for CI. In this demo, Brian will show how Insight for CI will help you:

• Generate a detailed bill of materials for every build in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Two sessions are available tomorrow, Wednesday, May 23. Choose the best time for you:

Register – 11:00AM EDT (GMT-0400)

Register – 2:00PM EDT (GMT-0400)

Due to high demand, we have added a second webinar presentation next Wednesday at 2PM EDT (GMT-0400) to accommodate multiple time zones. Here are the details for the presentation:

Join Brian Fox this Wednesday, May 23 at 11AM EDT or 2PM EDT (GMT-0400) for a 30 minute tour of Insight for CI. In this demo, Brian will show how Insight for CI will help you:

• Generate a detailed bill of materials for every build in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Two sessions are now available on Wednesday, May 23. Choose the best time for you:

Register – 11:00AM EDT (GMT-0400)

Register – 2:00PM EDT (GMT-0400)

Hudson: Move to Eclipse, Sonatype donates enhancements, and more

• Oracle announces Hudson move to Eclipse Foundation Oracle plans to contribute the Hudson core code to the Eclipse Foundation. Read Jason van Zyl’s blog or the stories in ADT, eWEEK, and SD Times.

• Sonatype donates enhancements We will contribute our Maven 3.x integration work to the Eclipse Foundation. Watch this community demonstration of the new features. Read more about our contribution in Application Development Trends.

• Sonatype launches Sonatype Pro™ for Hudson See our website for more details.

• Hudson Survey Sonatype and Oracle surveyed over 1,200 Hudson users to see what they’d like to see in future versions. The majority of respondents considered reliability and performance to be most important enhancements. Read a summary blog post or get the full details in this presentation.

Nexus News:  Enterprise Enhancements Coming Soon

We’ve been hard at work on Nexus too – not just Hudson.

• Enterprise Enhancements Our users tell us they want improved enterprise features. Centralized repository management ranks at the top, followed closely by high availability.  We will start rolling out these features this summer, beginning with centralized management. Watch this blog for more details. To try early releases or provide feedback to our engineering team, email us.

• Nexus 1.9.1 We released the latest version of Nexus last month with lots of important, under-the-hood changes.  For the full story check out Brian Fox’s blog post.

• New name You may have noticed that the professional, supported version of Nexus has a new name – Sonatype Pro for Nexus. Only the name has changed, everything else is exactly the same.

Sonatype Training: MVN-101 & MVN-201

Learn the know-how and best practices directly from Apache Maven and Nexus experts.

Upcoming Training Classes:

MVN-101: Maven Mechanics – 1 day virtual class Enrollment fee: $595 USD MVN-101 Maven Mechanics comprehensively covers Apache Maven installation and configuration, explains the motivation behind Maven and gives an overview of related development tools. Learn more.

Upcoming MVN-101 Classes Tuesday, June 14, 2011, 9:00AM – 4:00PM CEST (UTC/GMT + 0200) Monday, June 27, 2011, 11:AM-7:00PM EDT (UTC/GMT – 0400)

MVN-201 Development Infrastructure Design – 1 day virtual class Enrollment fee: $795 USD MVN-201 Development Infrastructure Design covers advanced Apache Maven topics and provides expertise with the structure of a Maven POM and a Maven multi-module project. Learn more.

Upcoming MVN-201 Class Tuesday, June 28, 2011, 11:00AM – 7:00PM EDT (UTC/GMT – 0400)

Follow Sonatype on Twitter

If you want to get updates from the Sonatype team the moment news breaks, follow us on Twitter @SonatypeCM.

If you would like to join our mailing list, you can subscribe here.

Improving Your Java development with Maven 3 and Hudson

Tuesday, June 7, 2011 @ 10:30AM – 11:00AM EDT (UTC/GMT – 0400)

Presenter: Jason van Zyl, Sonatype CTO & Founder

Attend this webinar to learn about the advantages of upgrading to Apache Maven 3, including improved speed, greater stability and increased compatibility. Jason will also talk about the greatly improved support for Maven 3 within Hudson that is easy to configure and supports complex build scenarios with ease. We will cover the Eclipse IDE integration for both Maven and Hudson that improves developer productivity.

Register now!

In this issue:

EclipseCon 2011 is just days away, and the Sonatype team has a full schedule of sponsored talks and workshops.

This week we held a webinar on the Future of Hudson – if you missed the first run you can replay the webinar here.

And would you like a chance to win an Apple iPad 2? Take our survey on the future of our open source projects and commercial products. For survey rules, please click here.

EclipseCon 2011 is being held in Santa Clara, California from March 21 – 24.

As a Strategic Member of the Eclipse Foundation and as a proud Gold Sponsor, Sonatype is looking forward to another year of great talks, tutorials and BOF’s at EclipseCon 2011. Sonatype technical leaders will host a number of sponsored talks on Tuesday, March 22 in the Cypress Room. Topics we will cover include: Next Generation Development Infrastructure, Hudson Continuous Integration, Tycho Build Conversion, Discovering p2 API’s, Maven 3 and many more.

Check out the full lineup of presentations here.

We hope to see you there! But if you can’t make it, get all of the conference updates from the Sonatype team on Twitter by following the hashtag #EclipseCon.

Event Details:

• Date: March 21-24, 2011
• Location: Hyatt Regency Santa Clara, CA
• Event Website: http://www.eclipsecon.org/2011/