Viewing profile — adityasaky

Hey Will, thanks! The paper is from quite a few years ago now and the reference is for a subset of gittuf's threat model, specifically the metadata manipulation / reference state a…

As others have said, read access for refs / directories is a bit more complicated than just embedding a secret in the repository given how Git works. We have more exploring to do b…

At present, gittuf's access control policies are centered around _write_ permissions rather than _read_. That said, we want to re-use some of the same policy semantics to build _re…

> does it also filter/escape ANSI Sequences in messages and author names? Not at present! Do you have a link or so I could use to familiarize myself? I'm curious if and how it'd fa…

It's multi-pronged and I imagine adopters may use a subset of features. Broadly, I think folks are going to be interested in a) branch/tag/reference protection rules, b) file prote…

Yes! We have clean integration with other tools in the Git ecosystem on our roadmap.

Our alpha release is this week! We have pretty much everything in place for us to cut the tag and publish the first binaries. The next thing is to kick its tires a bit, we have som…

I’m one of the maintainers of gittuf, happy to answer questions!

You've also got to factor in all the software that relies on projects developed primarily on GitHub.

Strange, I hadn't come across that before. Not sure what they're trying to achieve, deny they ever had a leak?

Even then, you want to revoke those credentials rather than try to wipe it from history, no?

I haven't read the paper but if Wikipedia serves as a detection tool, I don't particularly see a problem using it. Perhaps the real problem is the non-Wikipedia, canonical systems …

https://fiftytwo.in/story/madras-check/ Here’s an essay from last year that talks about him, his sister, and the culture of chess in Chennai.

How does that work when we're considering stationary first responders though?

Note: OpIndia is far from an unbiased source.

Unfortunately (this may have changed in recent times), they often don't update the public repos in line with their releases. They put them out all at once later. Also, last I check…

As I understand it, federation enables two separate instances of some particular service to interact. They can still use single sign-on independently for their own authentication n…