colek42

485 karmajoined October 21, 2015On HN

Founder of TestifySec, and maintainer of Witness and Archivista

github.com/in-toto/witness github.com/in-toto/archivista

cole at testifysec.com

Recent submissions

Show HN: CI/Lock – signed evidence of what your CI ran cilock.dev
1colek422modiscuss
Show HN: CI/lock – supply-chain attestation CLI, from the Witness creators cilock.dev
1colek423modiscuss
Anthropic vs. DoD: "Any lawful use" is a fight about control
2colek426mo8 comments
Shifting 'Shift Left' and What We Can Learn from Uber productgovernance.substack.com
2colek421ydiscuss
Shifting 'Shift Left' and What We Can Learn from Uber productgovernance.substack.com
1colek421ydiscuss
How to Shift Compliance Left – A Letter to Developers productgovernance.substack.com
3colek421ydiscuss
Shifting Compliance Left – A Letter to Compliance Teams productgovernance.substack.com
2colek421ydiscuss
Building an Effective Enterprise Software Supply Chain Policy testifysec.com
1colek423ydiscuss
Witness is a pluggable framework digital attestation github.com/testifysec
3colek423y1 comment
Keyless Signing of Digital Attestations with Witness and SigStore testifysec.com
1colek423ydiscuss
Keyless Signing with Witness and SigStore testifysec.com
9colek423ydiscuss
Comparing In-Toto and Sigstore: Two Approaches to Software Supply Chain Security testifysec.com
1colek423ydiscuss
2019 – USENIX – in-toto: Providing farm-to-table guarantees for bits and bytes youtube.com
1colek424ydiscuss
Automating Compliance – Why the SBOM Falls Short testifysec.com
1colek424ydiscuss
What Is a Software Supply Chain Attestation?testifysec.com
2colek424ydiscuss
Fpx: Easy USB‑C power for all your devices fpx.oxplot.com
33colek424y4 comments
What Is the SSDF – and What Does It Mean for My Software Supply Chain Compliance testifysec.com
2colek424ydiscuss
What Is a Software Supply Chain Attestation testifysec.com
2colek424ydiscuss
Tool that emulates the SolarWinds CI compromise attack vector github.com/testifysec
1colek424ydiscuss
What is an SBOM, and why should you care?boxboat.com
2colek425ydiscuss
Next week might as well be SBOM Week tomalrichblog.blogspot.com
1colek425ydiscuss
Supply Chain Security By Verification – Mitigating root credential loss boxboat.com
1colek425ydiscuss

All submissions and comments on Hacker News.