trishankdatadog

7 ms·

1.
by trishankdatadog 3y ago
python-tuf [1] back then assumed that everything was manipulated locally, yes, but a lot has changed since then: you can now read/write metadata entirely in memory, and integrate with different key management backend systems such as GC
2.
by trishankdatadog 5y ago
> >The complexity designed into this system might make sense. TUF is very complex and not worth it for most projects, but Debian is exactly what TUF is designed for. I disagree that TUF is too complicated for most projects. While our
3.
by trishankdatadog 6y ago
Thanks for the TUF shoutout!
4.
by trishankdatadog 6y ago
Yes, we (Datadog Agent integrations) were one of the early adopters mentioned, please see our blog post [1]. Also, really, the TLDR should be just use TUF + in-toto already. [1] https://www.datadoghq.com/blog/engineerin
5.
by trishankdatadog 6y ago
Reupping my comment [1] from the last discussion: > Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas. [1] https://news.ycombinator.com/item?id=24446577
6.
by trishankdatadog 6y ago
signify is nice when key distribution, revocation, and rotation is handled for you... but how do you do that securely for many different publishers on a single repo?
7.
by trishankdatadog 6y ago
> software update cryptography is both a solved problem (just use signify) Well, just use TUF [1] and in-toto [2] ;) [1] https://theupdateframework.io/ [2] https://in-toto.io/
8.
by trishankdatadog 6y ago
Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas.
9.
by trishankdatadog 6y ago
Yes, please see PEP 458: https://www.python.org/dev/peps/pep-0458/
10.
by trishankdatadog 6y ago
LMAO, funniest thread all day
11.
by trishankdatadog 6y ago
Yes, I talked about it: https://news.ycombinator.com/item?id=24371628
12.
by trishankdatadog 6y ago
Philip is right: they are complementary: https://ssl.engineering.nyu.edu/blog/2020-02-03-transparent-...
13.
by trishankdatadog 6y ago
Apply pattern/toolset recursively. Software supply chain problems largely eventually solved this way.
14.
by trishankdatadog 6y ago
Don't miss how we used TUF [1] and in-toto [2] to build compromise-resilient CI/CD (the first in the industry AFAICT) for the Datadog Agent integrations [3][4] that detects attacks anywhere between our developers and end-users [
15.
by trishankdatadog 6y ago
Little-known fact: like Google Fuchsia, Bottlerocket uses The Update Framework (TUF)[1][2] to securely update itself! [1] https://theupdateframework.io/ [2] https://github.com/awslabs/tough
16.
by trishankdatadog 6y ago
It's not well-documented, but non-FIPS can support 4096. FIPS goes up to 3072 for, well, FIPS reasons.
17.
by trishankdatadog 6y ago
Anyway, how to generate GPG keys on YubiKey in ~15m: https://github.com/DataDog/yubikey
18.
How to Build a Compromise-Resilient CI/CD(sched.co)
1 points by trishankdatadog 6y ago|1 comments
19.
by trishankdatadog 6y ago
CI/CD is critical to any DevOps operation today, but when attackers compromise it, they get to distribute malicious software to millions of unsuspecting users. We present how Datadog used TUF and in-toto to develop, to the best of our
20.
by trishankdatadog 6y ago
Nassim Taleb has been saying this forever, he first talked about it in at least Antifragile IIRC.
21.
by trishankdatadog 6y ago
"AGL includes the meta-updater Yocto layer that enables OTA software updates via Uptane, an automotive-specific extension to The Update Framework. Uptane and TUF are open standards that define a secure protocol for delivering and verif
22.
by trishankdatadog 6y ago
Sure, but most SSH servers probably don't support FIDO2 yet (GitHub didn't the last time I checked). Also, please sign your git commits.
23.
by trishankdatadog 6y ago
BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey
24.
by trishankdatadog 6y ago
my bad, but still, no reply as yet...
25.
by trishankdatadog 6y ago
Hi Travis, If you are reading this, I'm one of the members of the TUF [1] and in-toto [2] team, where we try to solve exactly this kind of problems. While I agree with you that reproducible builds sound a lot simpler than they actually
26.
by trishankdatadog 6y ago
Strange comment. I'm not sorry you're not sorry either.
27.
by trishankdatadog 6y ago
The problem with Transparent Logs / Certificate Transparency is that they don't have the best story with regarding to recovering from compromise. We wrote an article comparing The Update Framework (TUF) to CT/TL: https:&#x2F
28.
by trishankdatadog 6y ago
n=2 anecdata: no problems updating two MacBook Pros from 2017 and 2018, which were also already on Catalina.
29.
by trishankdatadog 6y ago
15 minutes could save you 15% on your cybersecurity insurance or more: https://github.com/DataDog/yubikey
30.
Secure PyPI downloads with signed repository metadata(python.org)
1 points by trishankdatadog 7y ago|0 comments

More ›