Live data from Hacker News

GitLab acquires Peach Tech and Fuzzit

about.gitlab.com

41–50 of 55 posts

Re: GitLab acquires Peach Tech and Fuzzit

#41
post #33

Earlier quoted context omitted.

I’m a Gitlab fanboy, but you’re right. We run a medium sized Gitlab instance and wanted to automate a bunch of tasks on it - like you should as a good adherent to DevOps principals. But Gitlab is actively hostile to you building automations on top of it. Every access token is tied to a Gitlab User and every user is charged X$ a month, regardless of if it’s a bot or not. So the end result of this is a single bot user…

They're addressing the lack of service accounts, targeted for 13.1: https://gitlab.com/gitlab-org/gitlab/-/issues/6883

Yep, we want to charge only for people, not bots. Sorry it took a while to resolve this, it was complex.

Re: GitLab acquires Peach Tech and Fuzzit

#42

Gitlab looks more and more like SAP these days. That's not necessarily a bad thing, enterprises out there choose all-in-one solutions because they need tech that covers the most ground with the easiest budget allocation, POC efforts from internal buyers and streamlined consulting at the post-sale effort. But once in, Gitlab, differently from SAP or Salesforce, is customized from around instead of from within. Meaning…

You nailed it. I am personally guilty of creating all kinds of helper tools over GitLab CI/CD madness. This is exactly what is the problem with GitLab - too many features and high complexity and on the other hand, missing some fairly basic and important stuff. And then there is that kubernates fetish... :S I wonder every several weeks what is keeping me on it - is it just sunken cost of my team or there is something…

What are the top 3 basic and important things that GitLab could add?

Re: GitLab acquires Peach Tech and Fuzzit

#43

Gitlab looks more and more like SAP these days. That's not necessarily a bad thing, enterprises out there choose all-in-one solutions because they need tech that covers the most ground with the easiest budget allocation, POC efforts from internal buyers and streamlined consulting at the post-sale effort. But once in, Gitlab, differently from SAP or Salesforce, is customized from around instead of from within. Meaning…

Thanks for your thoughtful comment.

“building a solid platform for dev and ops taking code to production” => great, that is a big focus for us!

We already have invested a lot to make this easier, including environments, feature flags, and more. Our direction is on https://about.gitlab.com/direction/ops/#release

What is the top feature you would like to see?

Re: GitLab acquires Peach Tech and Fuzzit

#44
post #42

Earlier quoted context omitted.

You nailed it. I am personally guilty of creating all kinds of helper tools over GitLab CI/CD madness. This is exactly what is the problem with GitLab - too many features and high complexity and on the other hand, missing some fairly basic and important stuff. And then there is that kubernates fetish... :S I wonder every several weeks what is keeping me on it - is it just sunken cost of my team or there is something…

What are the top 3 basic and important things that GitLab could add?

1. running CI locally

2. issue relations in core

3. getting a repository file via curl easily (yeah, seriously)

Re: GitLab acquires Peach Tech and Fuzzit

#45
post #41

Earlier quoted context omitted.

They're addressing the lack of service accounts, targeted for 13.1: https://gitlab.com/gitlab-org/gitlab/-/issues/6883

Yep, we want to charge only for people, not bots. Sorry it took a while to resolve this, it was complex.

I’m really glad you’ve reached this decision, but I’m still not happy with being asked “why are these automation tasks costing us $XXX” per year during our last recent license license update.

Until this epic is completed you are charging people full-seat price for automation users which, because of the poorly-scoped token permissions, require multiple “user” accounts to implement securely.

An automation utility in no way delivers the same value as a full time developer and it really shook me to know that this is how you have historically valued bots. It runs counter to everything that you publicise.

Re: GitLab acquires Peach Tech and Fuzzit

#46
post #42

Earlier quoted context omitted.

What are the top 3 basic and important things that GitLab could add?

1. running CI locally 2. issue relations in core 3. getting a repository file via curl easily (yeah, seriously)

Thanks, those are clear and concrete. Some quick thoughts (can’t get detailed ones since GitLab is having a friends and family day):

1. This works but not nearly with all functionality.

2. Maybe an options to have related in core and more detailed relations like blocking in a paid version.

3. I’m surprised this isn’t possible already. Is this easy to contribute for anyone?

Re: GitLab acquires Peach Tech and Fuzzit

#47
post #42

Earlier quoted context omitted.

What are the top 3 basic and important things that GitLab could add?

1. running CI locally 2. issue relations in core 3. getting a repository file via curl easily (yeah, seriously)

1. It does take some effort to get the gitlab-runner to run locally but it is possible to use the shell runner. This does require that you connect the gitlab-runner to an instance of GitLab. If I understand correctly, I think you're asking for the ability to take a `.gitlab-ci.yml` file and run the job(s) locally from your shell without requiring it go through the gitlab-runner and connecting to a GitLab instance. Please correct me if I'm off. 2. I'm not sure I understand what this means. 3. I think this is already possible. E.g. `curl https://gitlab.com/gitlab-org/security-products/license-mana.... Can you elaborate with a few more details on this?

Re: GitLab acquires Peach Tech and Fuzzit

#48
post #11

That's cool, but I wish they'd polish the base experience a little bit first. As well as stop this 'everything on kubernetes' thing. Right now I need kubernetes for at least half of all Gitlab functionality, and I have no doubt this latest acquisition will be the same thing.

@Aeolun - The acquisitions, once integrated, will work just like the other Secure scanners (e.g., SAST, DAST). They will be launched via CI runners within their own containers. As such, Kubernetes isn’t needed. @factorialboy is correct.

Re: GitLab acquires Peach Tech and Fuzzit

#49

Gitlab looks more and more like SAP these days. That's not necessarily a bad thing, enterprises out there choose all-in-one solutions because they need tech that covers the most ground with the easiest budget allocation, POC efforts from internal buyers and streamlined consulting at the post-sale effort. But once in, Gitlab, differently from SAP or Salesforce, is customized from around instead of from within. Meaning…

> That's where Gitlab should be putting their efforts, in building a solid platform for dev and ops taking code to production instead of acquiring middle-of-the-road in-between tech like Peach Tech and Fuzzit, that add complexity to the core offering without checking many boxes for the clients seriously on the lookout for app/api testing.

IMO acquiring a small business does not shift focus away from other parts of the product. Peach Tech and Fuzzit now have the support of the rest of GitLab and that benefits everyone. I don't know the headcount of the two companies that were acquired but I would think this would be equivalent to spinning off a small team to focus on an area (fuzzing) that could add value to the greater software community.

The idea that these companies were acquired to check a checkbox is disrespectful to the work that they were doing before the acquisition.

When GitLab decided to give the `.gitlab-ci.yml` a try it was a risk. It seems to have paid off because others started to copy them. Introducing fuzzing to be part of the devops life cycle could be thought of the same way.

> Focus on the platform, enabling integrated customization and implementation robustness while orchestrating the outside moving parts and a great plugin ecosystem. Then get that certification program going strong. Right now your competitor Github "are belong to" Microsoft, and MS, better or worse, sure can do the platform thing for the many sizes of businesses where the meat of your revenue is truly coming from.

It sounds like you have some amazing ideas. Contribute them https://gitlab.com/gitlab-org/gitlab/-/issues/new. The issue tracker isn't the equivalent of `/dev/null`. Community contribution is the core of GitLab. Everyone can contribute.

GitHub might host a lot of open source but GitLab is open source.

Re: GitLab acquires Peach Tech and Fuzzit

#50
post #2

Also on https://devops.com/gitlab-adds-fuzz-testing-to-devsecops-too... and https://siliconangle.com/2020/06/11/gitlab-acquires-peach-te... We think that Fuzzing will grow in importance as security gets more focus in the software development process.

Anyone has any stats on the adoption of security scanning in general for devops projects? and fuzzing in particular?

@diminish - We have some stats related to security scanning which we cover in our security trends report (https://about.gitlab.com/blog/2020/04/02/security-trends-in-...). It is a very interesting read and would like to hear your feedback. We also did a survey of fuzzing usage the highlights are here (https://about.gitlab.com/direction/secure/fuzz-testing/fuzz-...). We are excited about bringing Peach Tech and Fuzzit into GitLab as we are going to be able to address a big pain point for adoption of fuzzing (integration into CI).
Post reply on HN