Viewing profile — dlor

Enriching does a few things, but the main ones are adding CVSS information and CPE information. CVSS (risk) is already well handled by other sources, but CPE (what software is affe…

We're going to be launching Chainguard Libraries for Rust in a few weeks, this article perfectly calls out the issues. crates are somewhat better designed than NPM/PyPI (the dist a…

It's both. They got compromised by another supply chain attack on Trivy initially.

Hey! I work at Chainguard. We don't guarantee zero active exploits, but we do have a contractual SLA we offer around CVE scan results (those aren't quite the same thing unfortunate…

Really cool to see all the hard work on Trusted Publishing and Sigstore pay off here. As a reminder, these tools were never meant to prevent attacks like this, only to make them ea…

This is awesome to see, and the result of many years of hard work from awesome people.

There's no defeating of scanners or even static linking. It's all automation, dynamic linking and patching to make the scanners happy. We go to great lengths to make sure that the …

I can confirm our business is roughly 0 percent consulting and that it's 100% selling these hardened images.

The big ones that help are SBOMs, STIGs, FIPS, and CVE reduction. The images and the paperwork we provide make it so they can be dropped in to even the most regulated environments …

The program details are here: https://docs.docker.com/trusted-content/dvp-program/

Yep, that's it - the product is hardened container images!

Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore p…

Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`

I work at Chainguard, happy to answer any questions!

Have you ever been on a boat? It's not safe to assume the existence of anything, including a toilet, on them.

Yep - a new version of image spec and distribution spec (not runtime spec). This version allows for formalized ways to store other types of content in registries (think Helm Charts…

Personally? I've done quite a bit here although there's always more. I worked at Google to fund Rust development internally and externally, helped sponsor the work that eventually …

SQL injection and XSS are typically solved at a library/framework level instead of a programming language one, although type systems can help make those frameworks usable and work …

It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Pa…

We're trying to fix this problem at Chainguard. We have our own Linux distro that packages modern versions of software (like minutes or hours after it's released), as well as older…