Viewing profile — bdesimone

Posting a coworker’s deep dive on the nuance of health checks that actually represent readiness. If you’ve had pods say "ready" while still failing traffic during rollouts, this wi…

FWIW, I'm very happy to see this announcement. Full MCP support was the only thing holding me back from using GPT5 as my daily driver as it has been my "go to" for hard problems an…

Genuinely, didn't take it that way at all! I don't expect you to be an expert on Pomerium. > Funnily enough, Octelium started as a sidecar ext_authz svc for Envoy instances to oper…

Quick note since it was mentioned. Pomerium does support Kubernetes at pretty much every level you mentioned (although I'm not entirely sure what a "a complete Kubernetes-tier plat…

TL;DR: We are building a new Agentic Access Gateway in Pomerium to safely let AI agents (like GPT-based deep researchers, scripts or assistants) access internal apps and resources …

Here's a collection of resources you might find helpful. https://github.com/pomerium/awesome-zero-trust/ Contributions/PRs very welcome.

If you are interested in BeyondCorp-style access, I put together a collection of curated resources. https://github.com/pomerium/awesome-zero-trust PRs welcome.

I agree that both can be used safely. And, yes to be clear, NMR here means "less likely to happen" not "better able to handle failure." Unfortunately, AES-GCM-SIV (or AEZ) aren't y…

In the document they say that AES-CBC is vulnerable to padding oracle attacks, and AES-GCM uses random nonces and requires key rotation after so many iterations.

> I see where this is coming and agree in spirit, but GCM is actually idiomatic Go and implemented through the crypto/aead interface, which does about as good a job as any library …

Citizenship is already weird. My wife and I both being born in the US, we are tri-citizens and our descendants will also have tri-citizenship in perpetuity. It would have been quad…

Yes. And you should probably assume that their claims of end-to-end encryption are about as solid as they were for iMessage. http://blog.cryptographyengineering.com/2013/06/can-app…

In the very same doc you quote, they also say of iMessage: "Apple does not log messages or attachments, and their contents are protected by end-to-end encryption so no one but the …

"Reopened on Novebmer 6" Is this an early draft?

I am happy to vouch for William who has been driving the Miami meet ups. He knows his Go and is able to deconstruct rather tricky subjects and present them in a way that's easy to …

I'm not suggesting prefixing.

It's less complicated than what I'm reading here. * Use a passphrase of at least five random words.[1] * Keep that passphrases secret.[2] * Use a password manager like 1Password or…

Agreed. Adds a bit of peer review to the mix.

Edit2 = Damage control.