Author name: ITMAITY

tech blog

From first commits to big ships: Tune into our new open source podcast

What makes open source work, and why do so many of us keep showing up to build together? On the GitHub Podcast, we dive into the stories behind the code: the projects, the people, and the ideas shaping the open source ecosystem. At GitHub, we know open source has always been the launchpad for what’s next. But 2025 feels different. Everything new in software from AI agents to edge runtimes to climate-tech dashboards starts life in a public repository where anyone can fork, remix, and improve it overnight. When you invest in that commons, you’re not just sponsoring code; you’re underwriting the world’s R&D engine.  And that’s what we want to explore in our latest podcast with an eye towards everything that makes open source what it is today.  (And yes, we also answer essential questions like: how exactly do you do a hackathon on a plane?) Meet the core contributors I’m joined by an amazing crew of rotating hosts including Cassidy Williams, Kedasha Kerr, Andrea Griffiths, and me, Abby Cabunoc Mayes — all of us long-time contributors to different parts of the open source world. Together, we’ll explore what’s exciting, challenging, and evolving in open source today. Whether it’s community building, open science, developer education, or building in public, we each bring a unique perspective to the conversation. In today’s episode, we introduce ourselves, share how we got involved in open source, and reflect on what keeps us going. We talk about the importance of creating beginner content in a world seemingly saturated with beginner developer content with Kedasha, and Cassidy talks about how overhearing a conversation as a teenager sparked her love of code.  Plus, we spotlight some of our favorite open source projects that have caught our eyes this week. Here’s a sneak peek: Anime.JS, a visually stunning JavaScript animation library that sparks creativity. Docs, a collaborative open source document editor developed by the French and German governments. CSS Zero, a no-build frontend starter kit that simplifies web development. What’s in the build? Every two weeks we’ll share a new episode with stories from maintainers, contributors, and builders across the open source ecosystem. We’ll talk about tools, standards, and the side projects that spark joy (and sometimes chaos). You’ll also hear from special guests like Jason Lengstorf, who makes TV for developers, and Keeley Hammond, a core maintainer of Electron, who’ll share their own journeys and insights. Whether you’re just getting started, or you’ve been maintaining projects for years, there’s something here for you. Coming up next: we dive into the Model Context Protocol (MCP), what it is, why it matters, and how it’s helping make AI tools more transparent and interoperable. We’ll explore how MCP builds on the long history of open standards, and what it unlocks for developers today. Don’t want to miss out? Subscribe now to stay up to date on our latest episodes. The post From first commits to big ships: Tune into our new open source podcast appeared first on The GitHub Blog. ​ Maintainers, Open Source, GitHub Podcast, open source, open source community The GitHub Blog

tech blog

Onboarding your AI peer programmer: Setting up GitHub Copilot coding agent for success

We often describe GitHub Copilot as an AI peer programmer, or an AI member of the team. With agentic features like coding agent, you can assign issues to Copilot, and it will diligently get to work behind the scenes, creating a proposed solution to the problem, all without even asking for a cup of coffee. Much of the initial setup for Copilot coding agent is similar to onboarding a new developer – like providing good documentation and streamlining the setup process. But since it’s AI, there are a few things that make Copilot unique as a team member (aside from it not needing caffeine). So let’s explore how this is done. We’ll start by examining the flow Copilot coding agent follows, and key strategies to ensure Copilot has the resources it needs to generate the best possible pull request. Agentic workflows in GitHub Copilot: coding agent vs. agent mode GitHub Copilot comes with two key agentic capabilities: coding agent and agent mode. Think of coding agent as an autonomous tool: you give Copilot an issue, it spins up an Actions container, iterates in the background, and comes back with a pull request (PR). Agent mode is “stay in the loop:” an interactive sidekick in the editor or on github.com that executes smaller, multi-step tasks with you in real time. Same brain, different engagement model where one’s async and pull request–oriented, while the other’s conversational and immediate. Learn more >  Inside Copilot coding agent’s workflow: From issue to ready‑to‑review pull request When you assign an issue to Copilot, it follows a set pattern: Creates a branch for the code it will create. Creates a pull request to track its work and communicate with the team. Creates a contained environment for its work (running inside GitHub Actions). Reads the issue or prompt to understand the requested task. Explores the project to determine the best approach to tackle the problem. Works iteratively toward a solution. Finalizes its work, updates the pull request, and notifies the team the pull request is ready to be reviewed. By understanding this flow, we can work to ensure Copilot is set up for success. The first two steps — creating the pull request and branch — are self-contained, and there’s no additional work for us to do to help Copilot.  So, let’s skip right to the third step — the environment — where we can configure everything Copilot might need in the environment where it’ll write the code and run tasks as it generates the pull request. Configure Copilot’s environment with GitHub Actions In keeping with the analogy of onboarding a new developer, let’s consider the environment in which GitHub Copilot — or really any developer — does its work. Before you’re able to be productive, you need specific services, libraries, and frameworks installed. Copilot is the exact same. In order for Copilot to add a new feature and run the necessary tests to ensure everything works, it needs access to all the tooling the rest of your team has. We’ll do this with a custom workflow file. Coding agent uses a container running inside GitHub Actions. If you’re not already familiar with Actions, it’s our automation platform, and is configured using YAML files, which describe the necessary tasks that need to be completed.  Actions is often used for CI/CD, so tasks like testing, deployment, etc. In this case, Actions hosts the container coding agent will use for its work. And we can take advantage of the ability to script tasks in YAML to ensure said container is set up correctly! 💡Pro tip: There’s a good chance you already have a workflow for creating an environment, which could be used for development — say like the one used when running various tests or validation scripts. You can absolutely reuse those workflows for Copilot coding agent’s environment! Example Copilot setup workflow file To do this, create a new workflow file located at .github/workflows/copilot-setup-steps.yml with a job titled copilot-setup-steps. Inside the job, you’ll list all of the steps to install the necessary requirements for the environment. Let’s say, for example, we’re building a Python app that uses SQLite. We could have a workflow file like the following, which will be run to set up the environment for Copilot: name: “Copilot Setup Steps” # Automatically run the setup steps when they are changed # Allows for streamlined validation, # and allow manual testing through the repository’s “Actions” tab on: workflow_dispatch: push: paths: – .github/workflows/copilot-setup-steps.yml pull_request: paths: – .github/workflows/copilot-setup-steps.yml jobs: # The job MUST be called `copilot-setup-steps` # otherwise it will not be picked up by Copilot. copilot-setup-steps: runs-on: ubuntu-latest # Permissions set just for the setup steps # Copilot has permissions to its branch permissions: # To allow us to clone the repo for setup contents: read # The setup steps – install Python and our dependencies steps: – name: Checkout code uses: actions/checkout@v4 – name: Set up Python uses: actions/setup-python@v4 with: python-version: “3.13” cache: “pip” – name: Install Python dependencies run: pip install -r requirements.txt – name: Install SQLite run: sudo apt update && sudo apt install sqlite3 Whenever an issue is assigned to Copilot, it will run this workflow to configure its environment so it’ll have everything it needs! 💡 Pro tip: If you know something should be done a particular way, tell Copilot! In our above example, Copilot could install the requisite services on its own. However, doing so may lead to unexpected versions or other mistakes. As I always like to joke, don’t be passive aggressive with Copilot. 😀 Set Copilot up for success with well-written issues and prompts Speaking of not being passive aggressive, now’s the perfect time to focus on the next step Copilot follows: reading the issue. This will be Copilot’s entry point into creating the pull request you’ll later review. Remember that the more clearly defined the issue, the better quality the pull request.  The best approach is to think about how you’d like to see the first issue you’re assigned on

tech blog

How Microsoft’s customers and partners accelerated AI Transformation in FY25 to innovate with purpose and shape their future success

Over the past fiscal year, our customers and partners have driven pragmatic outcomes by implementing AI-first strategies across their organizations. With AI Transformation as their framework, we helped them enrich employee experiences, reinvent customer engagement, reshape business processes and bend the curve on innovation for their people, businesses and industries. Now, we are partnering to go beyond what they thought possible to unlock even greater potential by restructuring and centralizing their business strategies with an AI-first mindset. Our cloud and AI capabilities are leading the industry, and we are committed to working closely with our customers and partners to meet their increasingly complex needs and help them become frontier AI firms. Below are several stories from the past quarter reflecting the success we have seen broadly this past year. Each showcases what we can achieve together with an approach grounded in AI business solutions, cloud and AI platforms, and security. AI is blurring the lines between personal and organizational productivity, and we are helping our customers leverage Copilots and agents combined with human ambition to create differentiation. With over one million customers in Argentina, Banco Ciudad launched a digital transformation initiative focused on AI, productivity and security. What began as a pilot program quickly grew into broad adoption with the bank implementing Microsoft 365 Copilot to improve productivity, Microsoft Copilot Studio to develop agents and Microsoft Azure to scale their AI solutions. As a result, the bank strengthened its operational resilience, empowered teams, drove sustainable growth and improved customer engagement — even in a challenging economic environment. So far, the bank has freed up 2,400 employee work hours annually with savings projected to generate $75,000 USD monthly. As one of the country’s largest financial institutions, Commonwealth Bank of Australia is harnessing AI to meet rising customer expectations by developing smarter, more secure and highly customizable banking experiences at scale. To ensure employees have the confidence and expertise to leverage AI effectively, the bank launched a structured skilling initiative to empower them with the knowledge needed to adopt AI effectively. Eighty-four percent of 10,000 Microsoft 365 Copilot users reported they would not go back to working without it; and nearly 30% of GitHub Copilot code suggestions were adopted, driving efficiency and smarter decision-making. Nonprofit Make-A-Wish is dedicated to granting hope by fulfilling wishes for children with critical illnesses across the United States. Fragmented systems, limited data access and the need to protect sensitive information were creating challenges for the organization to operate effectively, so it turned to partner Redapt for support. Make-A-Wish deployed comprehensive Microsoft cloud and AI solutions — including Azure Cloud Services, Microsoft Fabric, Microsoft 365 Copilot and Copilot Studio — to unify its data, rebuild core applications and boost staff productivity. This transformation enabled the organization to increase operational efficiency, improve collaboration across national and regional chapters and strengthen its data security to protect sensitive family data. Sheló NABEL, a wellness and beauty company based in Mexico, faced operational challenges as it expanded its network of independent entrepreneurs. With support from partner Best Practices Consulting, the company integrated Microsoft Dynamics 365 to gain real-time market insights and optimize its demand planning across more than 400 products. They also integrated Microsoft Copilot to enhance customer service and increase operational efficiency with AI. As a result, the company has achieved a 17% increase in sales, 5X faster reporting processes and real-time inventory control. Based in Saudi Arabia, technology and communications company Unifonic serves millions of people across 160 countries. As their business began to scale rapidly, they faced challenges managing a growing hybrid workforce while maintaining strong security and compliance standards. To solve this, the company deployed Microsoft 365 E5 and Microsoft 365 Copilot to automate workflows and secure data in one platform. This unified ecosystem enabled teams to reduce time spent on audits by 85%, save two hours per day on cybersecurity governance, save $250,000 USD in costs and reduce time to set up client demos by 15%. Microsoft has the leading cloud platform for AI innovation with Azure as the infrastructure, Azure AI Foundry as the applications server and Fabric as the data platform. As legal professionals face challenges with manual data entry, document generation and compliance-heavy processes, Assembly Software aimed to transform how they handle complex, time-consuming workflows. Using Azure AI Foundry, the company built NeosAI — a fully embedded generative AI solution that automates nearly every aspect of the legal workflow — from document intake to drafting and reporting. As a result, law firms using NeosAI report saving up to 25 hours per case, with document drafting time reduced from 40 hours to just minutes. This AI solution is not only boosting productivity and reducing stress for legal professionals but also enabling firms to serve more clients with greater speed and accuracy. One of the world’s oldest continuously operating companies, Husqvarna Group, faced increasing pressure to modernize its network of factories, supply chains and distribution channels to stay competitive in a rapidly evolving landscape. The company implemented a comprehensive Microsoft Azure solution — including Azure Arc, Azure IoT Operations and Azure OpenAI — to unify cloud and on-premises systems, enable real-time data insights and drive innovation across global manufacturing operations. As a result, the company achieved a 98% reduction in data deployment time, cut infrastructure imaging costs by 50% and significantly improved productivity and uptime across its connected factories. Serving over 600,000 members in the United States, Members 1st Federal Credit Union sought to modernize its data infrastructure to deliver more personalized member experiences and support data-driven decision-making. The credit union faced challenges with siloed data across more than 15 sources and legacy systems with limited analytics capabilities. With support from partner 3Cloud, the credit union combined Azure SQL, Azure Data Factory and Azure Databricks to extract, log and centralize enterprise-wide data into a cutting-edge data lakehouse. Machine learning models that took 36 hours to run can now be done in three to four hours — a reduction of about 89%. Additionally, updates within its customer relationship management software now take 30 to 40 minutes compared to

tech blog

Amplifying Cyber Resiliency for Modern Enterprises

As cyber threats grow in sophistication, conventional security tools often fall short—particularly in the protection of backup data sets. Today, …   ​  ​As cyber threats grow in sophistication, conventional security tools often fall short—particularly in the protection of backup data sets. Today, … PowerProtect Blog | Dell

tech blog

Recommitting to our why, what, and how

Satya Nadella, Chairman and CEO, shared the below communication with Microsoft employees this morning. As we begin a new fiscal year, I’ve been reflecting on the road we’ve traveled together and the path ahead. Before anything else, I want to speak to what’s been weighing heavily on me, and what I know many of you are thinking about: the recent job eliminations. These decisions are among the most difficult we have to make. They affect people we’ve worked alongside, learned from, and shared countless moments with—our colleagues, teammates, and friends. I want to express my sincere gratitude to those who have left. Their contributions have shaped who we are as a company, helping build the foundation we stand on today. And for that, I am deeply grateful. I also want to acknowledge the uncertainty and seeming incongruence of the times we’re in. By every objective measure, Microsoft is thriving—our market performance, strategic positioning, and growth all point up and to the right. We’re investing more in CapEx than ever before. Our overall headcount is relatively unchanged, and some of the talent and expertise in our industry and at Microsoft is being recognized and rewarded at levels never seen before. And yet, at the same time, we’ve undergone layoffs. This is the enigma of success in an industry that has no franchise value. Progress isn’t linear. It’s dynamic, sometimes dissonant, and always demanding. But it’s also a new opportunity for us to shape, lead through, and have greater impact than ever before. The success we want to achieve will be defined by our ability to go through this difficult process of “unlearning” and “learning.” It requires us to meet changing customer needs, by continuing to maintain and scale our current business, while also creating new categories with new business models and a new production function. This is inherently hard, and few companies can do both. But I have full confidence that we can, and we will once again find the resolve, courage, and clarity to deliver on our mission in this new paradigm. With that context, I want to re-ground ourselves in our why, what, and how: our mission, our priorities, and our culture. Our why: mission  What does achieving our mission look like and feel like for us as a company? When Microsoft is succeeding, the world around us must succeed too. This is why each of us chose to be here, and as a company it’s how we earn our social permission to operate. When Bill founded Microsoft, he envisioned not just a software company, but a software factory, unconstrained by any single product or category. That idea has guided us for decades. But today, it’s no longer enough. We must reimagine our mission for a new era. What does empowerment look like in the era of AI? It’s not just about building tools for specific roles or tasks. It’s about building tools that empower everyone to create their own tools. That’s the shift we are driving—from a software factory to an intelligence engine empowering every person and organization to build whatever they need to achieve. Just imagine if all 8 billion people could summon a researcher, an analyst, or a coding agent at their fingertips, not just to get information but use their expertise to get things done that benefit them. And consider how organizations, empowered with AI, could unlock entirely new levels of agility and innovation by transforming decision-making, streamlining operations, and enabling every team to achieve more together than ever before. That’s the empowerment our mission enables, creating local surplus in every company, community, and country. And that’s our opportunity ahead. Our what: priorities  To deliver on our mission, we need to stay focused on our three business priorities: security, quality, and AI transformation. We are doubling down on the fundamentals while continuing to define new frontiers in AI. Security and quality are non-negotiable. Our infrastructure and services are mission critical for the world, and without them we don’t have permission to move forward. We’ve made substantial progress across SFI, QEI, and Engineering Thrive this year, and they remain top priorities to ensure that we continuously improve our innovation velocity and our operational metrics. We will reimagine every layer of the tech stack for AI—infrastructure, to the app platform, to apps and agents. The key is to get the platform primitives right for these new workloads and for the next order of magnitude of scale. Our differentiation will come from how we bring these layers together to deliver end-to-end experiences and products, with the core ethos of a platform company that fosters ecosystem opportunity broadly. Getting both the product and platform right for the AI wave is our North Star! Our performance this past year has positioned us well. And we must move forward with the intentionality and intensity that these industry shifts demand. Our how: culture Growth mindset has served us well over the last decade—the everyday practice of being a learn-it-all, not a know-it-all. It has reshaped our culture and helped us lead with greater humility and empathy. We need to keep that. It starts with each of us as individuals and our personal drive to learn, improve, and get better every day. Professional rewards, growth, and pride in our craft will always be the prime drivers. Beyond that, we each have the opportunity to connect our personal passion and philosophy of how we derive meaning from the work we do with Microsoft’s mission to empower the world. This is what makes it all worthwhile. This platform shift is reshaping not only the products we build and the business models we operate under, but also how we are structured and how we work together every day. It might feel messy at times, but transformation always is. Teams are reorganizing. Scopes are expanding. New opportunities are everywhere. It reminds me of the early ’90s, when PCs and productivity software became standard in every home and every desk! That’s exactly where we are now with AI.

tech blog

Private 5G: A New Era for Secure Federal Communications

Federal agencies must adopt secure 5G networks to meet communication demands vital for security, operations and public service.   ​  ​Federal agencies must adopt secure 5G networks to meet communication demands vital for security, operations and public service. Government Blog | Dell

tech blog

A Filmmaker’s Animation Adventure with AI

Filmmaker and animator Cory Choy skillfully integrates AI into his creative process while maintaining the authenticity of his work.   ​  ​Filmmaker and animator Cory Choy skillfully integrates AI into his creative process while maintaining the authenticity of his work. Dell Pro Max Blog | Dell

tech blog

Securing AI at the Endpoint

Secure your organization’s AI PCs with multiple layers of defense. Dell Trusted Workspace can help.   ​  ​Secure your organization’s AI PCs with multiple layers of defense. Dell Trusted Workspace can help. Endpoint Security Blog | Dell

tech blog

Dell Expands Audio Portfolio with Four Exciting New Additions

Elevate your work experience with four of Dell’s innovative audio solutions designed for seamless collaboration and crystal-clear communication.   ​  ​Elevate your work experience with four of Dell’s innovative audio solutions designed for seamless collaboration and crystal-clear communication. Client Peripherals Blog | Dell

tech blog

The IT Leader’s Guide to Feeding AI High-Quality Data

High-quality data is the key to quality AI outcomes, though how to cultivate it isn’t always clear. This playbook can help.   ​  ​High-quality data is the key to quality AI outcomes, though how to cultivate it isn’t always clear. This playbook can help. AI Solutions Blog | Dell

tech blog

Git security vulnerabilities announced

Today, the Git project released new versions to address seven security vulnerabilities that affect all prior versions of Git. Vulnerabilities in Git CVE-2025-48384 When reading a configuration value, Git will strip any trailing carriage return (CR) and line feed (LF) characters. When writing a configuration value, however, Git does not quote trailing CR characters, causing them to be lost when they are read later on. When initializing a submodule whose path contains a trailing CR character, the stripped path is used, causing the submodule to be checked out in the wrong place. If a symlink already exists between the stripped path and the submodule’s hooks directory, an attacker can execute arbitrary code through the submodule’s post-checkout hook. [source] CVE-2025-48385 When cloning a repository, Git can optionally fetch a bundle, allowing the server to offload a portion of the clone to a CDN. The Git client does not properly validate the advertised bundle(s), allowing the remote side to perform protocol injection. When a specially crafted bundle is advertised, the remote end can cause the client to write the bundle to an arbitrary location, which may lead to code execution similar to the previous CVE. [source] CVE-2025-48386 (Windows only) When cloning from an authenticated remote, Git uses a credential helper in order to authenticate the request. Git includes a handful of credential helpers, including Wincred, which uses the Windows Credential Manager to store its credentials. Wincred uses the contents of a static buffer as a unique key to store and retrieve credentials. However, it does not properly bounds check the remaining space in the buffer, leading to potential buffer overflows. [source] Vulnerabilities in Git GUI and Gitk This release resolves four new CVEs related to Gitk and Git GUI. Both tools are Tcl/Tk-based graphical interfaces used to interact with Git repositories. Gitk is focused on showing a repository’s history, whereas Git GUI focuses on making changes to existing repositories. CVE-2025-27613 (Gitk) When running Gitk in a specially crafted repository without additional command-line arguments, Gitk can write and truncate arbitrary writable files. The “Support per-file encoding” option must be enabled; however, the operation of “Show origin of this line” is affected regardless. [source] CVE-2025-27614 (Gitk) If a user is tricked into running gitk filename (where filename has a particular structure), they may run arbitrary scripts supplied by the attacker, leading to arbitrary code execution. [source] CVE-2025-46334 (Git GUI, Windows only) If a malicious repository includes an executable sh.exe, or common textconv programs (for e.g.,  astextplain, exif, or ps2ascii), path lookup on Windows may locate these executables in the working tree. If a user running Git GUI in such a repository selects either the “Git Bash” or “Browse Files” from the menu, these programs may be invoked, leading to arbitrary code execution. [source] CVE-2025-46335 (Git GUI) When a user is tricked into editing a file in a specially named directory in an untrusted repository, Git GUI can create and overwrite arbitrary writable files, similar to CVE-2025-27613. [source] Upgrade to the latest Git version The most effective way to protect against these vulnerabilities is to upgrade to Git 2.50.1, the newest release containing fixes for the aforementioned vulnerabilities. If you can’t upgrade immediately, you can reduce your risk by doing the following: Avoid running git clone with –recurse-submodules against untrusted repositories. Disable auto-fetching bundle URIs by setting the transfer.bundleURI configuration value to “false.” Avoid using the wincred credential helper on Windows. Avoid running Gitk and Git GUI in untrusted repositories. In order to protect users against attacks related to these vulnerabilities, GitHub has taken proactive steps. Specifically, we have scheduled releases of GitHub Desktop. GitHub Codespaces and GitHub Actions will update their versions of Git shortly. GitHub itself, including Enterprise Server, is unaffected by these vulnerabilities. CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386 were discovered by David Leadbeater. Justin Tobler and Patrick Steinhardt provided fixes for CVEs 2025-48384 and 2025-48385 respectively. The fix for CVE-2025-48386 is joint work between Taylor Blau and Jeff King CVE-2025-46835 was found and fixed by Johannes Sixt. Mark Levedahl discovered and fixed CVE-2025-46334. Avi Halachmi discovered both CVE-2025-27613 and CVE-2025-27614, and fixed the latter. CVE-2025-27613 was fixed by Johannes Sixt. The post Git security vulnerabilities announced appeared first on The GitHub Blog. ​ Git, Open Source, security alert The GitHub Blog

tech blog

Beyond prompt crafting: How to be a better partner for your AI pair programmer

When a developer first starts working with GitHub Copilot there’s (rightly) a focus on prompt crafting — or the art of providing good context and information to generate quality suggestions.  But context goes beyond typing out a couple of lines into Copilot Chat in VS Code. We want to ensure Copilot is considering the right files when performing operations, that these files are easy for Copilot to read, and that we provide Copilot any extra guidance it may need about the project or specific task.  So let’s explore taking the next step beyond prompt crafting, and think about how we can be a better partner for our AI pair programmer. Context is key I always like to talk about context by starting with a story. The other day my partner and I woke up and she said, “Let’s go to brunch!” Fantastic! Who doesn’t love brunch?  I recommended a spot, one of our favorites, and she said, “You know… we’ve been there quite a bit lately. I’d like to try something different.” I recommended another spot to which she replied, “Now that I’m thinking about it, I really want waffles. Let’s find somewhere that does good waffles.” This conversation is, of course, pretty normal. My partner asked a question, I responded, she provided more context, and back and forth we went. All of my suggestions were perfectly reasonable based on the information I had, and when she didn’t hear what she was expecting she provided a bit more guidance. As we continued talking, she realized she had a craving for waffles, which she discovered as she considered my suggestions. This is very much how we both talk with other people, but also how we approach working with generative AI tools, including Copilot. We ask questions, get answers, and work back and forth providing more context and making decisions based on what we see.  If we don’t receive the suggestions we’re expecting, or if something isn’t built to the specs we had in mind, it’s very likely Copilot didn’t have the context it needed — just as I didn’t have the context to suggest somewhere new when I started the conversation with my partner. How GitHub Copilot works with code To understand how Copilot in the IDE gets its context, it’s important to understand how it works. Except for agent mode, which performs external tasks, Copilot doesn’t build or run the code as it generates code suggestions. In fact, it behaves very similarly to, well, a pair programmer. It reads the code (and comments) of the files we’ve pointed it at just as another developer would.  But unlike a teammate, Copilot doesn’t have “institutional knowledge,” or the background information that comes with experience (although you can add custom instructions, but more on that later). This could be the history of why things were built a certain way (which isn’t documented somewhere but everyone just “knows” 🙄), that an internal library or framework that should always be used, or patterns that need to be followed. Obviously, all of this background info is important to get the right code suggestions from Copilot. If we’re using a data abstraction layer (DAL), for instance, but Copilot is generating raw SQL code, the suggestions aren’t going to be that helpful.  The problem isn’t that Copilot is generating invalid code. Instead, it’s lacking the context to generate the code in the format and structure we need. Basically, we want waffles and it’s giving us an omelette. Let’s see what we can do to get waffles. Using code comments to improve Copilot’s suggestions through better context There’s a common belief that quality code shouldn’t need comments, and that adding comments is a “code smell,” or an indication that something could be improved. While it’s noble to strive to write code that’s as readable as possible, it’s something we often fall short of in our day-to-day work. Even when we do “hit the mark”, we need to remember that just because code might be readable to one developer, it doesn’t mean it’s readable to all developers. A couple of lines of comments can go a long way to ensuring readability. The same holds true for Copilot! As we highlighted above, Copilot doesn’t run or compile your code except in specific situations. Instead, it “reads” your code much like a developer would.  Following the guidelines for having docstrings in functions/modules in Python, for example, can help ensure Copilot has a better understanding of what the code does and how it does it. This allows Copilot to generate higher-quality suggestions by using your existing code to ensure any new code follows the same patterns and practices already in place. 💡 Pro tip: When you open a file, it’s always a good idea to leave it in a better state than when you found it. One of the little improvements you could make is to add a few comments to places to help describe the code. You could always ask Copilot to generate the first draft of the comments, and you can add any additional details Copilot missed! The benefit of using custom instructions with GitHub Copilot on your projects To generate quality suggestions, Copilot benefits from having context around what you’re doing and how you’re doing it. Knowing the technology and frameworks you’re using, what coding standards to follow, and even some background on what you’re building helps Copilot raise the quality bar on its suggestions. This is where custom instructions come into play. Custom instructions help you provide all of this background information and set ground rules (things like what APIs you want to call, naming patterns you want followed, or even stylistic preferences).  To get started, you place everything that’s important into a file named copilot-instructions.md inside your .github folder. It’s a markdown file, so you can create sections like Project structure, Technologies, Coding standards, and any other notes you want Copilot to consider on every single chat request. You can also add any guidance on tasks where

tech blog

Modeling CORS frameworks with CodeQL to find security vulnerabilities

There are many different types of vulnerabilities that can occur when setting up CORS for your web application, and insecure usage of CORS frameworks and logic errors in homemade CORS implementations can lead to serious security vulnerabilities that allow attackers to bypass authentication. What’s more, attackers can utilize CORS misconfigurations to escalate the severity of other existing vulnerabilities in web applications to access services on the intranet. In this blog post, I’ll show how developers and security researchers can use CodeQL to model their own libraries, using work that I’ve done on CORS frameworks in Go as an example. Since the techniques that I used are useful for modeling other frameworks, this blog post can help you model and find vulnerabilities in your own projects. Because static analyzers like CodeQL have the ability to get the detailed information about structures, functions, and imported libraries, they’re more versatile than simple tools like grep. Plus, since CORS frameworks often use set configurations via specific structures and functions, using CodeQL is the easiest way to find misconfigurations in your codebases. Modeling headers in CodeQL When adding code to CodeQL, it’s best practice to always check the related queries and frameworks that are already available so that we’re not reinventing the wheel. For most languages, CodeQL already has a CORS query that covers many of the default cases. The easiest and simplest way of implementing CORS is by manually setting the  Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers. By modeling the frameworks for a language (e.g., Django, FastAPI, and Flask), CodeQL can identify where in the code those headers are set. Building on those models by looking for specific header values, CodeQL can find simple examples of CORS and see if they match vulnerable values. In the following Go example, unauthenticated resources on the servers could be accessed by arbitrary websites. func saveHandler(w http.ResponseWriter, r *http.Request) { w.Header().Set(“Access-Control-Allow-Origin”, “*”) } This may be troublesome for web applications that do not have authentication, such as tools intended to be hosted locally, because any dangerous endpoint could be accessed and exploited by an attacker. This is a snippet of the Go http framework where CodeQL models the Set method to find security-related header writes for this framework. Header writes are modeled by the HeaderWrite class in HTTP.qll, which is extended by other modules and classes in order to find all header writes. /** Provides a class for modeling new HTTP header-write APIs. */ module HeaderWrite { /** * A data-flow node that represents a write to an HTTP header. * * Extend this class to model new APIs. If you want to refine existing API models, * extend `HTTP::HeaderWrite` instead. */ abstract class Range extends DataFlow::ExprNode { /** Gets the (lower-case) name of a header set by this definition. */ string getHeaderName() { result = this.getName().getStringValue().toLowerCase() } Some useful methods such as getHeaderName and getHeaderValue can also  help in developing security queries related to headers, like CORS misconfiguration. Unlike the previous code example, the below pattern is an example of a CORS misconfiguration whose effect is much more impactful. func saveHandler(w http.ResponseWriter, r *http.Request) { w.Header().Set(“Access-Control-Allow-Origin”, r.Header.Get(“Origin”)) w.Header().Set(“Access-Control-Allow-Credentials”, “true”) } Reflecting the request origin header and allowing credentials permits an attacking website to make requests as the current logged in user, which could compromise the entire web application. Using CodeQL, we can model the headers, looking for specific headers and methods in order to help CodeQL identify the relevant security code structures to find CORS vulnerabilities. /** * An `Access-Control-Allow-Credentials` header write. */ class AllowCredentialsHeaderWrite extends Http::HeaderWrite { AllowCredentialsHeaderWrite() { this.getHeaderName() = headerAllowCredentials() } } /** * predicate for CORS query. */ predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) { exists(AllowCredentialsHeaderWrite allowCredentialsHW | allowCredentialsHW.getHeaderValue().toLowerCase() = “true” Here, the HTTP::HeaderWrite class, as previously discussed, is used as a superclass for AllowCredentialsHeaderWrite, which finds all header writes of the value Access-Control-Allow-Credentials. Then, when our CORS misconfiguration query checks whether credentials are enabled, we use AllowCredentialsHeaderWrite as one of the possible sources to check. The simplest way for developers to set a CORS policy is by setting headers on HTTP responses in their server. By modeling all instances where a header is set, we can check for these CORS cases in our CORS query.  When modeling web frameworks using CodeQL, creating classes that extend more generic superclasses such as HTTP::HeaderWrite allows the impact of the model to be used in all CodeQL security queries that need them. Since headers in web applications can be so important, modeling all the ways they can be written to in a framework can be a great first step to adding that web framework to CodeQL. Modeling frameworks in CodeQL Rather than setting the CORS headers manually, many developers use a CORS framework instead.  Generally, CORS frameworks use middleware in the router of a web framework in order to add headers for every response. Some web frameworks will have their own CORS middleware, or you may have to include a third-party package. When modeling a CORS framework in CodeQL, you’re usually modeling the relevant structures and methods that signify a CORS policy. Once the modeled structure or methods have the correct values, the query should check that the structure is actually used in the codebase. For frameworks, we’ll look into Go as our language of choice since it has great support for CORS. Go provides a couple of CORS frameworks, but most follow the structure of Gin CORS, a CORS middleware framework for the Gin web framework. Here’s an example of a Gin configuration for CORS: package main import ( “time” “github.com/gin-contrib/cors” “github.com/gin-gonic/gin” ) func main() { router := gin.Default() router.Use(cors.New(cors.Config{ AllowOrigins: []string{“https://foo.com”}, AllowMethods: []string{“PUT”, “PATCH”}, AllowHeaders: []string{“Origin”}, ExposeHeaders: []string{“Content-Length”}, AllowCredentials: true, AllowOriginFunc: func(origin string) bool { return origin == “https://github.com” } })) router.Run() } Now that we’ve modeled the router.Use method and cors.New — ensuring that cors.Config structure is at some point put into a router.Use function for actual use — we should then check all cors.Config structures for appropriate headers. Next, we find the appropriate headers fields

tech blog

Empowering Innovation with Dell Cyber Resilience

Threats evolve. So do we. Discover why Dell consistently sets the standard in cyber resilience, year after year.   ​  ​Threats evolve. So do we. Discover why Dell consistently sets the standard in cyber resilience, year after year. Cyber Resilience Blog | Dell

Scroll to Top