Allow loading remote contents and showing images to get the best out of this email.FAUN.dev's DevOps Weekly Newsletter
 
🔗 View in your browser.   |  ✍️ Publish on FAUN.dev   |  🦄 Become a sponsor
 
Allow loading remote contents and showing images to get the best out of this email.
DevOpsLinks
 
#DevOps #SRE #PlatformEngineering
 
 
📝 The Opening Call
 
 
At FAUN.dev, our goal has always been to help developers stay informed - not by chasing headlines, but by understanding the stories that truly matter.

Today, we're introducing a new approach to developer news.

Using advanced retrieval and analysis systems, FAUN.dev News now connects facts, people, and context into coherent, data-driven narratives. Each story is crafted to reveal how ideas, technologies, and organizations intersect.

Every article now includes:
- Visual maps of key entities and connections
- Contextual relationships between people, tools, and events
- Concise insights and clear takeaways to guide your understanding
- And more!

Our aim is simple: make technical news more structured, transparent, and meaningful - so you can grasp complex developments faster and with confidence.

Explore the new FAUN.dev News at faun.dev/news

P.S: We're still experimenting with new features and sections - we only published a few entries but we'd like to know your feedback, it will be really helpful! Please reply to this email and share your thoughts!
 
 
🔍 Inside this Issue
 
 
Security headlines meet engineering hygiene: a 570GB GitLab heist and a self-spreading npm worm collide with sharper Kafka tracing, saner Azure log retention, and real FinOps wins. If you care what leaks, what scales, and what your budget actually funds, the links below do work.

🧾 Demystifying Log Retention in Azure
📚 GitHub MCP Registry
💸 How FinOps Drives Value for Every Engineering Dollar
🛰️ Observability for the Invisible: Tracing Message Drops in Kafka Pipelines
🚨 Red Hat GitLab Breach: 570GB Data Stolen by Crimson Collective
🐛 Shai-Hulud npm Supply Chain Attack
🧭 Top 30 Argo CD Anti-Patterns to Avoid When Adopting Gitops
⚖️ What are Error Budgets? A Guide to Managing Reliability

Less leak, more leverage—ship like you mean it.

Have a great week!
FAUN.dev Team
 
 
ℹ️ News, Updates & Announcements
 
faun.dev faun.dev
 
Red Hat GitLab Breach: 570GB Data Stolen by Crimson Collective   ✅
 
 
Red Hat took a hit. The “Crimson Collective” made off with 570 GB from its consulting GitLab instance—ripping data from over 28,000 repos.

What got swiped? Architecture diagrams, auth tokens, network maps—the kind of stuff you'd rather not see floating around. About 800 orgs are in the blast radius, including the NSA and Bank of America.
 
 
github.blog github.blog
 
GitHub MCP Registry
 
 
The GitHub MCP Registry is now available as the central hub for discovering MCP servers. With most MCP servers already hosted on GitHub, developers can easily find and use the tools they need for AI development. The registry aims to create a more open and interoperable ecosystem for AI tools.
 
 
digitalocean.com digitalocean.com
 
Introducing DigitalOcean Organizations, a new and comprehensive account layer
 
 
DigitalOcean just dropped Organizations—a real upgrade for anyone juggling multiple Teams. Think one top-level account to rule them all: centralized user control, one invoice to track, and org-wide settings for taxes, credits, and permissions.
 
 
wiz.io wiz.io
 
Shai-Hulud npm Supply Chain Attack
 
 
Malicious npm packages just leveled up: this one dropped a self-spreading worm that hijacks repos and leaks secrets the moment it lands.

It abuses postinstall scripts to run TruffleHog and swipe tokens straight from your codebase. Then it uses GitHub Actions to exfiltrate the loot and auto-publish more poisoned packages—spreading the infection across orgs whenever new tokens pop up in CI/CD.

This is the first time JavaScript’s supply chain has seen something this self-replicating. It’s not just malware—it’s an outbreak.
 
 
👉 Enjoyed this?Read more news on FAUN.dev/news
 
🔗 Stories, Tutorials & Articles
 
shankuehn.io shankuehn.io
 
Demystifying Log Retention in Azure
 
 
Azure logs come in three flavors: Activity Logs, Diagnostic Logs, and Log Analytics. Each with its own rules for retention and billing. The catch? Those differences aren’t quirks—they’re baked in.
 
 
dzone.com dzone.com
 
Observability for the Invisible: Tracing Message Drops in Kafka Pipelines
 
 
When an event drops silently in a distributed system, it is not a bug, it is an architectural blind spot. Detect, debug, and prevent message loss in Kafka-based streaming pipelines using tools like OpenTelemetry, Fluent Bit, Jaeger, and dead-letter queues. Make sure observability gaps in event streams are addressed to make events accountable in high-scale messaging platforms handling millions of events.
 
 
blog.duolingo.com blog.duolingo.com
 
How FinOps Drives Value for Every Engineering Dollar
 
 
Duolingo’s FinOps crew didn’t just track cloud costs - they wired up sharp, automated observability across 100+ microservices. Real-time alerts now catch AI and infra spend spikes before they torch the budget.

They sliced TTS costs by 40% with in-memory caching. Dumped pricey CloudWatch metrics for Prometheus. Same insights, lower bill.
 
 
medium.com medium.com
 
Top 30 Argo CD Anti-Patterns to Avoid When Adopting Gitops
 
 
A new teardown of Argo CD anti-patterns calls out 28 common misfires—stuff like skipping Git for Application CRDs or stuffing Helm/Kustomize config right into Argo CD manifests. Yikes.

It pushes for a cleaner setup: use ApplicationSets instead of rolling your own YAML, turn on auto-sync/self-heal, and split your Git repos—one for source code, one for K8s manifests, one for CD logic. Keep the layers tidy.
 
 
oneuptime.com oneuptime.com
 
What are Error Budgets? A Guide to Managing Reliability
 
 
OneUptime shows how to put error budgets to work—keeping feature velocity in check without tanking reliability. The goal: ship fast, stay within SLOs.

They do it by tracking burn rates, syncing across teams, and tuning SLOs to match how users actually use the product. Less guesswork, more signal.
 
 

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

 
⚙️ Tools, Apps & Software
 
github.com github.com
 
flosell/trailscraper
 
 
 A command-line tool to get valuable information out of AWS CloudTrail
 
 
github.com github.com
 
juanjoDiaz/serverless-plugin-warmup
 
 
Keep your lambdas warm during winter.
 
 
github.com github.com
 
volantvm/flint
 
 
Lightweight tool for managing linux virtual machines
 
 

👉 Spread the word and help developers find and follow your Open Source project by promoting it on FAUN. Get in touch for more information.

 
🤔 Did you know?
 
 
Did you know that on AWS EC2, IMDSv2 limits metadata responses to 1 network hop by default? In container networks (bridge/overlay), that extra hop to 169.254.169.254 often drops the request. The fix: use HttpPutResponseHopLimit=2 (or more) or run hostNetwork / an IMDS proxy so containers can fetch tokens reliably.
 
 
😂 Meme of the week
 
 
 
 
🤖 Once, SenseiOne Said
 
 
"In multi-cloud you don't avoid vendor lock-in; you collect it. SRE just gets more failure modes and less visibility."
— SenseiOne
 

(*) SenseiOne is FAUN.dev’s work-in-progress AI agent

 
👤 This Week's Human
 
 
This week, we’re highlighting Shrey Shah, an AI agent developer and Cursor Ambassador with five years of building with AI—from early GitHub Copilot to running workshops on prompting, evals, and agent workflows. At Vivun, he’s a Senior Software Engineer | AI, shipping knowledge‑graph recommendations, vector search, and scalable agents grounded in tight test harnesses and iterative evals.
 

💡 Engage with FAUN.dev on LinkedIn — like, comment on, or share any of our posts on LinkedIn — you might be our next “This Week’s Human”!

 
❤️ Thanks for reading
 
 
👋 Keep in touch and follow us on social media:
- 💼LinkedIn
- 📝Medium
- 🐦Twitter
- 👥Facebook
- 📰Reddit
- 📸Instagram

👌 Was this newsletter helpful?
We'd really appreciate it if you could forward it to your friends!

🙏 Never miss an issue!
To receive our future emails in your inbox, don't forget to add community@faun.dev to your contacts.

🤩 Want to sponsor our newsletter?
Reach out to us at sponsors@faun.dev and we'll get back to you as soon as possible.
 

DevOpsLinks #497: Red Hat GitLab Breach: 570GB Data Stolen
Legend: ✅ = Editor's Choice / ♻️ = Old but Gold / ⭐ = Promoted / 🔰 = Beginner Friendly

You received this email because you are subscribed to FAUN.dev.
We (🐾) help developers (👣) learn and grow by keeping them up with what matters.

You can manage your subscription options here (recommended) or use the old way here (legacy). If you have any problem, read this or reply to this email.