⽬录遍历 Apache ActiveMQ 未授权访问,5.12 之前的版本 fileserver存在 PUT任意写 CVE-2015-5254 Apache Solr CVE-2017-12629 CVE-2019-0193 [ Apache Solr 5.x - 8.2.0 ] Apache Zookeeper 未授权访问,敏感信息泄露 Apache Shiro

Product Ops  Product Management  Every technology under the sun  Solaris, Windows, Linux  Apache, IIS, TCServer, etc.  Oracle, DB2, SQL Server  How we got better  We read and we studied.

Focusing on small, frequent capability releases  Valuing working software over comprehensive documentation  Responding rapidly to changes in operations, technology, and budgets  Actively involving Focusing on small, frequent capability releases  Valuing working software over comprehensive documentation  Responding rapidly to changes in operations, technology, and budgets  Actively involving the definition may include code completion, the level and types of testing, and (just enough) documentation. For a release, the definition may include more rigorous testing such as regression testing,

AUTOMATED TESTS AS DOCUMENTATION AND COMMUNITIES OF PRACTICE i. Ensure automated tests demonstrate use and behavior of libraries and components ii. Test suite becomes the living documentation of the system continuous inspection, automated testing to achieve outcomes intended with controls. e. ENSURE DOCUMENTATION AND PROOF FOR AUDITORS AND COMPLIANCE OFFICERS i. DevOps challenges the traditional notions

i. Don’t practice “Mean Time until Declared Innocent” – culture of blame encourages limited documentation, hiding telemetry, deflection 1. Prevents creation of institutional knowledge about incidents incidents 1. Bad pull requests – typically doesn’t have enough context for the reader, little documentation of the changes intended outcome, or explanation of the thought process behind the change 2.

potential implications, or to merely rubber stamp their approvals c. Creating large volumes of documentation of questionable detail which become obsolete shortly after they are written d. Pushing large

3. DB scripts and reference data 4. Containers 5. Automated tests 6. Project artifacts – documentation, procedures, etc. 7. Application configuration files 8. This also includes pre-production and