Skip to main content

Search complete. 206 mentions across 108 episodes found for "CI/CD".

Sep 12, 2026

speaker_0HOST
5:54
Yeah, I want to make sure the severity of that specific target is really clear to whoever's listening.
speaker_0HOST
5:58
Like, why are attackers so obsessed with GitLab? Why are CICD pipelines, you know, these continuous integration and deployment systems, such a massive target?
speaker_1HOST
6:09
You have to look at what a CICD pipeline actually controls.
speaker_1HOST
6:12
It is the absolute apex of the software supply chain.
speaker_1HOST
6:16
Right.
speaker_1HOST
6:17
It does.
speaker_1HOST
6:17
Attackers want access to your proprietary source code so they can hunt for other hidden zero day vulnerabilities.
speaker_1HOST
6:24
But the real prize, honestly, is the CICD secrets.
AndreHOST
11:03
Yeah.
AndreHOST
11:05
But I think, yeah, I still see the distribution between, you know, having dedicated instance for CI, having, you know, one for CD or sometimes even two for CD that you have non-pro for CD and production for CD separately, especially in the bigger organizations, which are a bit more legacy.
AndreHOST
11:25
You still have Jenkins in your case when you have more centralized set for it.
PaulinaHOST
11:30
Yeah, so if you don't have money for GitHub Enterprise, you run Jenkins.
AndreHOST
12:09
I've seen in the past in some organizations.
PaulinaHOST
12:12
Depends.
PaulinaHOST
12:12
Well, nice thing about GitHub Action is, so a lot of CI, CD servers, their philosophy is that you get one file one CICD pipeline, whatever file per repo, like for instance with Jenkins.
PaulinaHOST
12:29
I don't know if that changed, but back in the day, you could only have like one Jenkins file per repo and that was it.
AndreyHOST
9:06
It's also possible.
AndreyHOST
9:07
I've seen people doing that a lot on CICD, for instance, because in the end of the day, most of those coding agents, they're just JavaScript programs that could be quickly installed in the GitHub Action Runner, for instance.
AndreyHOST
9:22
And then if you have your private roles, you can consume through the role, then you can do a code review.
AndreyHOST
9:28
We actually have a blog post that I will... link to the show notes like one of the consultants in Firefox self-wrote it where how you can define the role and that will be like so basically you can set a cup uh through the i am on uh bedrock spending which was like not the obvious thing to do like it's not very obvious how to do it but it's actually possible and then you can say like well start declining requests on the i am level when we like spend three thousand
Alex AntoniukHOST
18:22
Every change comes with a tax.
Alex AntoniukHOST
18:25
The debt has reached its terminal stage when it touches architecture, tests, CICD, docs, and processes.
Alex AntoniukHOST
18:34
One change triggers a dozen others.
Alex AntoniukHOST
18:37
So, the signals are clear.
Jason FurgalGUEST
30:46
And I think we just we can't be as loose as we have been.
Jason FurgalGUEST
30:49
But we're going to build everything, which is a great answer for a CICD from a CICD perspective to say, every time there's a change, we're going to build for 20 products.
Jason FurgalGUEST
30:57
We're going to build for five different chips.
Jason FurgalGUEST
31:00
Is that necessary? You know, that's not as much fun, but can you do that a little bit smarter where maybe you build for one representative tool chain and that covers half of what you need.
Low LevelHOST
34:40
And those are going out and like shy looting the entire internet.
Low LevelHOST
34:43
Around that time, Team PCP got really into this thing where they were attacking vulnerable instances of CICD.
Low LevelHOST
34:52
For example, when you're on GitHub, if you submit a pull request to a repo, if the repo is not set up properly, if it uses the wrong kind of pull request, you can get a CICD action to fire on behalf of the maintainer of the repo with your data in the pull request.
Low LevelHOST
35:11
If, for example, like a bash script runs that uses data from your pull request, you can use that to compromise the CI CD instance.
Low LevelHOST
35:19
Okay.
Alexis BertholfHOST
10:43
I wonder, I guess especially when you're pushing code into production on a network level.
Alexis BertholfHOST
10:52
To give you guys a bit of background, I was just on a call earlier and we were talking about Megaport acquired a bare metal company, right? And one of the use cases that they're seeing a lot of is they have AI agents that are continuously testing for CICD, right? They'll go, they will make code improvements, they will deploy their own compute instance on our bare metal farm by themselves, make sure it works, and then push the change into prod.
Alexis BertholfHOST
11:21
So if we're looking at that from an infrastructure perspective or from a network perspective, can you take something like a forward networks where it is, what's the term for what they do? It's like- Digital twin? Yeah, a digital twin, right? Where you have a digital twin of your environment You have an AI agent or an instance where you can go and take a snippet of code from AI, deploy it in your digital twin to make sure nothing breaks, and the change is actually doing what you want it to before you actually apply it to production.
Chris GrundemannGUEST
11:53
And that's where I think, yes, I think there's some...
David CurlewisGUEST
3:42
And so we build for the most users.
David CurlewisGUEST
3:45
If you wanna get from point A to point B, whether that's, you know, CICD systems or, you know, mailing systems, whatever it might be, we'll build the platform that allows you to kind of decouple your thinking.
David CurlewisGUEST
3:55
You can just think about the product, the customer.
David CurlewisGUEST
3:57
You don't have that cognitive overhead of maintaining everything else down to the nuts and bolts.
AlexisHOST
10:43
I wonder, I guess especially when you're pushing code into production on a network level.
AlexisHOST
10:52
To give you guys a bit of background, I was just on a call earlier and we were talking about Megaport acquired a bare metal company, right? And one of the use cases that they're seeing a lot of is they have AI agents that are continuously testing for CICD, right? They'll go, they will make code improvements, they will deploy their own compute instance on our bare metal farm by themselves, make sure it works, and then push the change into prod.
AlexisHOST
11:21
So if we're looking at that from an infrastructure perspective or from a network perspective, can you take something like a forward networks where it is, what's the term for what they do? It's like- Digital twin? Yeah, a digital twin, right? Where you have a digital twin of your environment You have an AI agent or an instance where you can go and take a snippet of code from AI, deploy it in your digital twin to make sure nothing breaks, and the change is actually doing what you want it to before you actually apply it to production.
Chris GrundemannGUEST
11:53
And that's where I think, yes, I think there's some...
AlexisHOST
10:43
I wonder, I guess especially when you're pushing code into production on a network level.
AlexisHOST
10:52
To give you guys a bit of background, I was just on a call earlier and we were talking about Megaport acquired a bare metal company, right? And one of the use cases that they're seeing a lot of is they have AI agents that are continuously testing for CICD, right? They'll go, they will make code improvements, they will deploy their own compute instance on our bare metal farm by themselves, make sure it works, and then push the change into prod.
AlexisHOST
11:21
So if we're looking at that from an infrastructure perspective or from a network perspective, can you take something like a forward networks where it is, what's the term for what they do? It's like- Digital twin? Yeah, a digital twin, right? Where you have a digital twin of your environment You have an AI agent or an instance where you can go and take a snippet of code from AI, deploy it in your digital twin to make sure nothing breaks, and the change is actually doing what you want it to before you actually apply it to production.
Chris GrundemannGUEST
11:53
And that's where I think, yes, I think there's some...

98 more episodes mention CI/CD.

Create an account to see the whole feed, search across every transcript, and follow the entities you care about.

We value your privacy

We use cookies to understand how you use our platform and to improve your experience. Click “Accept All” to consent, or “Decline non-essential” to opt out of non-essential cookies. Read our Privacy Policy.