dlor

5 ms·

1.
by dlor 5mo ago
Enriching does a few things, but the main ones are adding CVSS information and CPE information. CVSS (risk) is already well handled by other sources, but CPE (what software is affected) is kind of critical. I don't even know how they&#
2.
by dlor 5mo ago
We're going to be launching Chainguard Libraries for Rust in a few weeks, this article perfectly calls out the issues. crates are somewhat better designed than NPM/PyPI (the dist artifacts are source based), but still much worse t
3.
by dlor 6mo ago
It's both. They got compromised by another supply chain attack on Trivy initially.
4.
by dlor 9mo ago
Hey! I work at Chainguard. We don't guarantee zero active exploits, but we do have a contractual SLA we offer around CVE scan results (those aren't quite the same thing unfortunately). We do issue an advisory feed in a few version
5.
by dlor 2y ago
Really cool to see all the hard work on Trusted Publishing and Sigstore pay off here. As a reminder, these tools were never meant to prevent attacks like this, only to make them easier to detect, harder to hide, and easier to recover from.
6.
by dlor 2y ago
This is awesome to see, and the result of many years of hard work from awesome people.
7.
by dlor 3y ago
There's no defeating of scanners or even static linking. It's all automation, dynamic linking and patching to make the scanners happy. We go to great lengths to make sure that the scanners actually find everything so the results a
8.
by dlor 3y ago
I can confirm our business is roughly 0 percent consulting and that it's 100% selling these hardened images.
9.
by dlor 3y ago
The big ones that help are SBOMs, STIGs, FIPS, and CVE reduction. The images and the paperwork we provide make it so they can be dropped in to even the most regulated environments without toil. Most of our customers use them for FedRAMP or
10.
by dlor 3y ago
The program details are here: https://docs.docker.com/trusted-content/dvp-program/
11.
by dlor 3y ago
Yep, that's it - the product is hardened container images!
12.
by dlor 3y ago
Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project. We produce SBOMs during the build process, and crypt
13.
by dlor 3y ago
Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`
14.
by dlor 3y ago
I work at Chainguard, happy to answer any questions!
15.
OpenPubKey and Sigstore(blog.sigstore.dev)
93 points by dlor 3y ago|28 comments
16.
The Tyranny of Nits(leafwing-studios.com)
1 points by dlor 3y ago|0 comments
17.
by dlor 3y ago
Have you ever been on a boat? It's not safe to assume the existence of anything, including a toilet, on them.
18.
CVSS 4.0 Is Here, but Prioritizing Patches Still a Hard Problem(darkreading.com)
3 points by dlor 3y ago|0 comments
19.
by dlor 3y ago
Yep - a new version of image spec and distribution spec (not runtime spec). This version allows for formalized ways to store other types of content in registries (think Helm Charts, OPA policies, etc.), as well as a way to "attach&quot
20.
by dlor 3y ago
Personally? I've done quite a bit here although there's always more. I worked at Google to fund Rust development internally and externally, helped sponsor the work that eventually led to getting Rust adopted in the Linux kernel, a
21.
by dlor 3y ago
SQL injection and XSS are typically solved at a library/framework level instead of a programming language one, although type systems can help make those frameworks usable and work well. Either way, they're effectively "solved
22.
by dlor 3y ago
It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Impr
23.
CWE Top Most Dangerous Software Weaknesses(cwe.mitre.org)
155 points by dlor 3y ago|128 comments
24.
The EU’s Product Liability Directive could kill open source(techradar.com)
1 points by dlor 3y ago|1 comments
25.
by dlor 3y ago
We're trying to fix this problem at Chainguard. We have our own Linux distro that packages modern versions of software (like minutes or hours after it's released), as well as older versions. We're also working on FIPS 140-2 a
26.
Elastic Stack container images signed with Sigstore(elastic.co)
1 points by dlor 3y ago|0 comments
27.
by dlor 3y ago
I'm not a lawyer, but that's definitely not their only recourse here. Lawyers are not going to look at this coordinated attempt to subvert a EULA and say "oh well, nothing we can do here".
28.
Shrink to Secure: Kubernetes and Secure Compact Containers(gsantoro.dev)
3 points by dlor 3y ago|0 comments
29.
by dlor 3y ago
We work with much of the Alpine community and some of the maintainers. The glibc choice instead of musl alone means that a separate toolchain and distro is required, but there are also a lot of other distinctions. We still work with them up
30.
by dlor 3y ago
The real number is probably somewhere in the middle - one yaml file can define many packages - see the gcc or clang or argocd ones for examples of that. glibc explodes into a few dozen, for example.

More ›