Worthwhile exploration on the impact of CopyFail in the context of Podman. The baseline security posture seems better and you can even improve things using older techniques. Definitely worth switching.
Straight from the uutils rewrite. This is interesting both for the class of bugs which made it (very system integration oriented, unsurprisingly) and the ones which didn't appear at all (anything to do with memory).
Want a primer on email routing? This is pretty much it.
C++ too can have its own supply chain disasters with enough effort!
More in depth look at the launch white paper and the issues covered in the PR. Not much survives scrutiny... there's nothing special with this model.
A reminder that path based APIs and security don't go well together to manage files.
It's first a great marketing stunt. The model is likely not the secret sauce though.
Can crates.io make things easier to secure? I do think so. But this post is right that we shouldn't forget the social aspect of the whole supply chain security conversation.
Indeed, the current supply chain model of Rust could be better. While we wait for improvements (with no sign of them coming), there are ways to try to avoid some of the common pitfalls.
Comprehensive guide to have SSH keys stored in the TPM chip. Clearly it's still a very manual process.
Lots of interesting measures to reduce the risk of supply chain issues. Definitely to be considered on your projects.
Looks like an interesting tool to check your SQL queries on the CI.
We're not helped much by our tools here... Clearly provenance needs to be double checked.
You'd wish more projects would put such measures in place.
Clearly those are new and the vendors need to put in place proper security practices. Still those are on the road...
Interesting trick in Got, using SSH certificates to prove the origin on commits. This feels a bit rough though, tooling has room for improvement.
Kind of obvious I think, but this likely bears repeating. Containers are not a magical recipe for security. There are many attack vectors to keep in mind and evaluate.
Not sure it'll keep being efficient if the political heat keeps going up. Still this is a nice idea.
One more example that it should be used for NLP tasks, not knowledge related tasks. The model makers are consuming so much data indiscriminately that they can't easily fine comb everything to remove the poisoned information.
The OpenClaw instances running around are really a security hazard...