HN Explorer

colek42

↗ HN profile [ 73.4 ms ] full profile
Karma
0
Created
()
Submissions
0
  1. Show HN: CI/Lock – signed evidence of what your CI ran (cilock.dev)

    I helped create Witness, donated it to the CNCF/in-toto ecosystem, and worked on the NIST 800-204D "pipeline observer" guidance. CI/Lock is the next version of that work, and it's under the Apache 2.0 license. Here's…

    1 points 1
  2. Show HN: CI/lock – supply-chain attestation CLI, from the Witness creators (cilock.dev)
    1 points 0
  3. Anthropic vs. DoD: "Any lawful use" is a fight about control

    I served 12 years infantry, then built targeting tools at JSOC vs ISIS. Now I lead a team building AI tools automating the compliance process. I’ve got opinions on Anthropic + DoD When people argue about “AI in weapons”…

    2 points 3
  4. Shifting 'Shift Left' and What We Can Learn from Uber (productgovernance.substack.com)
    2 points 0
  5. Shifting 'Shift Left' and What We Can Learn from Uber (productgovernance.substack.com)
    1 points 1
  6. 2 points 0
  7. How to Shift Compliance Left – A Letter to Developers (productgovernance.substack.com)
    3 points 0
  8. Shifting Compliance Left – A Letter to Compliance Teams (productgovernance.substack.com)
    2 points 0
  9. Building an Effective Enterprise Software Supply Chain Policy (testifysec.com)
    1 points 0
  10. Witness is a pluggable framework digital attestation (github.com)
    3 points 1
  11. Keyless Signing of Digital Attestations with Witness and SigStore (testifysec.com)
    1 points 0
  12. Keyless Signing with Witness and SigStore (testifysec.com)
    9 points 0
  13. Comparing In-Toto and Sigstore: Two Approaches to Software Supply Chain Security (testifysec.com)
    1 points 0
  14. 2019 – USENIX – in-toto: Providing farm-to-table guarantees for bits and bytes (youtube.com)
    1 points 0
  15. Automating Compliance – Why the SBOM Falls Short (testifysec.com)
    1 points 0
  16. What Is a Software Supply Chain Attestation? (testifysec.com)
    2 points 0
  17. Fpx: Easy USB‑C power for all your devices (fpx.oxplot.com)
    33 points 4
  18. What Is the SSDF – and What Does It Mean for My Software Supply Chain Compliance (testifysec.com)
    2 points 0
  19. What Is a Software Supply Chain Attestation (testifysec.com)
    2 points 0
  20. Tool that emulates the SolarWinds CI compromise attack vector (github.com)
    1 points 0
  21. What is an SBOM, and why should you care? (boxboat.com)
    2 points 0
  22. Next week might as well be SBOM Week (tomalrichblog.blogspot.com)
    1 points 0
  23. Supply Chain Security By Verification – Mitigating root credential loss (boxboat.com)
    1 points 0
  24. Safeguarding the World from the SolarWinds Hack and Future Supply Chain Attacks (boxboat.com)
    1 points 0
  25. Safeguarding the World from Solarburst and Future Supply Chain Attacks (boxboat.com)
    1 points 0