decodebytes

6 ms·

91.
by decodebytes 5y ago
It's under the Linux Foundation, a non profit org and you also missed the third founder Purdue University for whatever reason. We also have community members from NYU, Arch Linux, Debian an Alpine Linux (plus folks from the rust commun
92.
by decodebytes 5y ago
It supports GPG if you really want to use it (no idea why someone would want to in this day and age).
93.
by decodebytes 5y ago
Good question, cosign is a client that works with containers OCI / registries. We are also develop clients to work with pypi, rust cargo and cases such as helping to protect against curl | bash attacks
94.
by decodebytes 5y ago
yep, you got it. And further to this, anyone could stand up their own sigstore service. In fact we expect some of the bigger oss projects to do just that.
95.
by decodebytes 5y ago
https://twitter.com/decodebytes/status/1404540227474046980
96.
by decodebytes 5y ago
This is where the transparency log comes in, certificate signing is openly auditable. It's the same as certificate transparency, malicious or mistakenly administered certificates are openly auditable (instead of being a transaction tha
97.
by decodebytes 5y ago
This is where the transparency log comes in. The hash / signature and public key (by way of a signed x509 certificate) are hashed into an tamper resistant immutable merkle tree. This makes it hard to tamper with the hash. However a bad
98.
by decodebytes 5y ago
One of the co-founders here. sigstore will be a non profit / free to use service. Think Let's Encrypt for software signing. My hope is that we shift the paradigm so that consuming untrusted software via packages / dependencie
99.
Sigstore – A new standard for signing, verifying and protecting software(sigstore.dev)
118 points by decodebytes 5y ago|79 comments
100.
by decodebytes 5y ago
Not sure, if you're aware. I was replying to the comment asking for the same tool, but for rust.
101.
by decodebytes 5y ago
grep for unsafe
102.
by decodebytes 5y ago
This is quite a nice introduction to cryptography on it's own, there is not Bitcoin aspect to it at all. It introduces what cryptography (very basic number shift cyphers) and then brings in hashing , symmetric / asymmetric encrypt
103.
by decodebytes 5y ago
It really is. The stuff facebook serves to me is just so badly wrong it's hilarious that they are taken someone's money to show me an add which if anything is going to result in me even less likely to buy the product
104.
by decodebytes 5y ago
Not here to defend bitcoin, but that's not true. You can buy all three of those (to varying degrees in different countries).
105.
by decodebytes 5y ago
One of the Bandit maintainers here (the tool used for this research). static analysis results cannot be used for the overall security posture of an application. Bandit can and has often found vulnerabilities, but its not something you can r
106.
by decodebytes 5y ago
I disagree. Right now some of the most cutting edge technology is developed within Open Source communities, predominantly resourced by geographically spread folks from different companies / independents - all using tools to communicate
107.
by decodebytes 5y ago
There was a documentary in the UK which I just cannot remember the name of anymore. They have an African tribe (father and mother) exchange places with a middle class father and mother in a UK suburb. One interesting element was how the Afr
108.
The Tourist’s Guide to Pub Etiquette [pdf](sirc.org)
2 points by decodebytes 5y ago|0 comments
109.
by decodebytes 5y ago
Anyone interested in leveraging a TPM, it's worth a look at the open source project https://keylime.dev In regards to dane-pgp highlighting Intel TXT / tboot, Keylime does not use this. It measures via grub and a uefi
110.
by decodebytes 5y ago
They are not asking for math geniuses?
111.
by decodebytes 5y ago
I am at RH right now, engineering. Things have really not changed. I will be honest I am a little nervous that Jim has left, but I think on the whole it's still a great place to work right now. In 3-5 years , who knows?
112.
by decodebytes 5y ago
outuled the iron thing already, had a blood panel and levels were very good.
113.
by decodebytes 5y ago
Hey, I have this really bad. Around 7-8pm I feel like I want someone to pull on my legs hard and they get an antsy feeling where I cannot keep them still. When I then go to bed, my legs kick and jerk , my wife has complained about me actual
114.
by decodebytes 5y ago
> I never understood why someone would live over an hour away from where they work property prices.
115.
by decodebytes 5y ago
Surely if they have crippling social anxiety, being stuck in an office all day with others where they are expected to socialise no matter how bad their anxiety might be playing up on any given day, is far worse? Also the only social part I
116.
by decodebytes 5y ago
> Lastly, WFH for years can result in a serious mental health decline. If you think you're doing fine after 1 year, come see me after 5. You'll realize by the end of it just how important water cooler conversation is for your B
117.
by decodebytes 5y ago
I feel directly opposite to this, I am way more productive working from home as a programmer, for this reason alone: https://heeris.id.au/2013/this-is-why-you-shouldnt-interrupt... Also I find modern tools easily make
118.
Rekor – Secure Supply Chain Transparency Log(github.com)
2 points by decodebytes 5y ago|0 comments
119.
by decodebytes 5y ago
Rekor is just that. It's a merkle tree implementation (with extras such as timestamping) https://github.com/sigstore/rekor
120.
by decodebytes 5y ago
Maybe take a look at rekor, part of the sigstore project, it's built specifically for software supply chain transparency (disclaimer I am one of the community). Being a transparency log, you get much better guarantees around inclusion

More ›