Viewing profile — trishankdatadog

python-tuf [1] back then assumed that everything was manipulated locally, yes, but a lot has changed since then: you can now read/write metadata entirely in memory, and integrate w…

> >The complexity designed into this system might make sense. TUF is very complex and not worth it for most projects, but Debian is exactly what TUF is designed for. I disagree tha…

Thanks for the TUF shoutout!

Yes, we (Datadog Agent integrations) were one of the early adopters mentioned, please see our blog post [1]. Also, really, the TLDR should be just use TUF + in-toto already. [1] ht…

Reupping my comment [1] from the last discussion: > Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas. [1] https://news.yc…

signify is nice when key distribution, revocation, and rotation is handled for you... but how do you do that securely for many different publishers on a single repo?

> software update cryptography is both a solved problem (just use signify) Well, just use TUF [1] and in-toto [2] ;) [1] https://theupdateframework.io/ [2] https://in-toto.io/

Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas.

Yes, please see PEP 458: https://www.python.org/dev/peps/pep-0458/

LMAO, funniest thread all day

Yes, I talked about it: https://news.ycombinator.com/item?id=24371628

Philip is right: they are complementary: https://ssl.engineering.nyu.edu/blog/2020-02-03-transparent-...

Apply pattern/toolset recursively. Software supply chain problems largely eventually solved this way.

Don't miss how we used TUF [1] and in-toto [2] to build compromise-resilient CI/CD (the first in the industry AFAICT) for the Datadog Agent integrations [3][4] that detects attacks…

Little-known fact: like Google Fuchsia, Bottlerocket uses The Update Framework (TUF)[1][2] to securely update itself! [1] https://theupdateframework.io/ [2] https://github.com/awsl…

It's not well-documented, but non-FIPS can support 4096. FIPS goes up to 3072 for, well, FIPS reasons.

Anyway, how to generate GPG keys on YubiKey in ~15m: https://github.com/DataDog/yubikey

CI/CD is critical to any DevOps operation today, but when attackers compromise it, they get to distribute malicious software to millions of unsuspecting users. We present how Datad…

Nassim Taleb has been saying this forever, he first talked about it in at least Antifragile IIRC.

"AGL includes the meta-updater Yocto layer that enables OTA software updates via Uptane, an automotive-specific extension to The Update Framework. Uptane and TUF are open standards…

Sure, but most SSH servers probably don't support FIDO2 yet (GitHub didn't the last time I checked). Also, please sign your git commits.

BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey

my bad, but still, no reply as yet...