Hot on the heels of ThreadFix 2.7 and the two patents on our Hybrid Analysis Mapping technology, the 3.0 release of ThreadFix is planned for early Q1 2019 – just in time for RSAC 2019! So what’s actually new in ThreadFix 3.0?
New UI/UXThreadFix has always had a tremendous amount of capability and technology under the hood, but until now the UI/UX experience has taken a bit of a backseat. An industry analyst once described it as “engineering grade” and we don’t think it was intended to be a compliment. We have been hard at work refreshing these aspects of the system and the result is a UI that is a lot more modern, and a UX that makes ThreadFix much easier to use.
New Architecture: Microservices, Containers, XaaSThreadFix “Classic” was a monolithic Java/Spring/Hibernate-based application – a pretty standard architecture and one that served us well for a long time. That said, the ThreadFix platform is about 10 years old and, given the directions we’re taking it, the architecture was getting a bit creaky. With 3.0 we’ve reworked things to take a much more modern approach. ThreadFix has been broken up into a set of microservices that are packaged in containers. That’s all great from a technical standpoint, but why should ThreadFix users care about this? Two main reasons: scalability and maintainability:
- Scalability– As we are dealing with significantly larger data sets and more frequent data upload volumes, larger ThreadFix installations need to scale far more than they used to. To handle these situations in the past we would tweak database queries and have folks add additional memory and processing power, but we were hitting some limits with this approach. The new architecture should scale nearly horizontally by deploying additional containers for services that are proving to be bottlenecks. This will help in large data volume environments as well as environments seeing much more frequent scan uploads from DevOps CI/CD pipelines.
- Maintainability– Upgrades to ThreadFix have traditionally been a bit challenging, involving updates to the software as well as SQL updates to the database. With the new architecture you can simply pull an updated set of containers, and one of the services handles all of the database versioning for you.