colek42

8 ms·

31.
by colek42 4y ago
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
32.
Keyless Signing of Digital Attestations with Witness and SigStore(testifysec.com)
1 points by colek42 4y ago|0 comments
33.
Keyless Signing with Witness and SigStore(testifysec.com)
9 points by colek42 4y ago|0 comments
34.
Comparing In-Toto and Sigstore: Two Approaches to Software Supply Chain Security(testifysec.com)
1 points by colek42 4y ago|0 comments
35.
2019 – USENIX – in-toto: Providing farm-to-table guarantees for bits and bytes(youtube.com)
1 points by colek42 4y ago|0 comments
36.
Automating Compliance – Why the SBOM Falls Short(testifysec.com)
1 points by colek42 5y ago|0 comments
37.
What Is a Software Supply Chain Attestation?(testifysec.com)
2 points by colek42 5y ago|0 comments
38.
Fpx: Easy USB‑C power for all your devices(fpx.oxplot.com)
33 points by colek42 5y ago|4 comments
39.
by colek42 5y ago
I think this type of attestation gets us part of the way there, however, the solution needs to be a bit more generalized to cover all the threats. At TestifySec we are working on a open source pluggable attestation framework with a rego po
40.
by colek42 5y ago
When you start doing security this way you end up chasing your tail. There are so many ways to mess it up. There is a really good article that explains a different way of securing these systems though sets of attestations. https:/&#x2
41.
by colek42 5y ago
Dan's team and Google has worked with our team on implementation of the DSSE spec, see https://github.com/sigstore/rekor/pull/596 . I really don't understand the rent seeking argument. It is made co
42.
What Is the SSDF – and What Does It Mean for My Software Supply Chain Compliance(testifysec.com)
2 points by colek42 5y ago|0 comments
43.
What Is a Software Supply Chain Attestation(testifysec.com)
2 points by colek42 5y ago|0 comments
44.
by colek42 5y ago
At this point the threat model for you CI system should be to assume it it comprimised if you havent patched.
45.
Tool that emulates the SolarWinds CI compromise attack vector(github.com)
1 points by colek42 5y ago|0 comments
46.
by colek42 5y ago
The Linux kernel's Integrity Measurement Architecture can be used with the TPM to establish trust of the filesystem. ref: https://www.redhat.com/en/blog/how-use-linux-kernels-integri...
47.
by colek42 5y ago
The issue isn't compromise of the remote system, but trust of that remote system. TPM 2.0 gives us the ability to make measurements before establishing trust.
48.
by colek42 5y ago
If you are okay with working yourself to death and are in a nitch and in-demand market you could make that consulting.
49.
by colek42 5y ago
This is extremely sad to me. I served in Afghanistan from 2009-2010. One of the things that made me feel like it was worthwhile was watching girls be able to attend school. War sucks, and doesn't really work. We should do a better
50.
by colek42 5y ago
Are you challenging me to build a socat loadbalancer in bash? In all seriousness, I concur. But if you just need to redirect some data streams socat is a rock solid and simple solution.
51.
by colek42 5y ago
The UDS API has a particular property that allows the receiver to know the PID of the caller. The SPIFFE/SPIRE project uses this to perform introspection of a process and distribute certificates based on the results of that inspection
52.
by colek42 5y ago
socat is the tool for this. No need for a full blown webserver.
53.
by colek42 5y ago
I have to estimate time and materials for a lot of DevOps contracts. I estimate twice the hours, or more for Jenkins CI work vs GitLab CI even if my engineer is an expert in groovy. The complexity of Jenkins adds a huge amount of risk.
54.
What is an SBOM, and why should you care?(boxboat.com)
2 points by colek42 5y ago|0 comments
55.
Next week might as well be SBOM Week(tomalrichblog.blogspot.com)
1 points by colek42 5y ago|0 comments
56.
by colek42 5y ago
Don't advise "Just Do It" I've done this before and it causes a lot of personal stress.
57.
Supply Chain Security By Verification – Mitigating root credential loss(boxboat.com)
1 points by colek42 5y ago|0 comments
58.
by colek42 6y ago
Transitive identity is a difficult problem. SPIFFE has a working group to set up to try to solve it. https://groups.google.com/a/spiffe.io/g/transitive-identity-...
59.
by colek42 6y ago
I wrote about some mitigation steps here https://boxboat.com/2020/12/14/safeguarding-the-world-from-t...
60.
Safeguarding the World from the SolarWinds Hack and Future Supply Chain Attacks(boxboat.com)
1 points by colek42 6y ago|0 comments

More ›