Join Stacker @jaosorior for an Intro to #Minder today at 10am ET / 3pm BST / 5pm EEST to get a high-level overview and demo of the project. YouTube livestream is at: piped.video/watch?v=YvP9YGQ4… #SupplyChainSecurity #ShiftLeft #DevSecOps

In London? Our CTO @decodebytes will be keynoting @DevSecOpsLG tonight with a talk on "Secure Repo Management as Scale, with Minder" at Google's (Central Saint Giles) London Office. Sign up here👇 meetup.com/devsecops-london-…

Livestream begins in 2 short hours, grab your 🌮 tacos and meet us there! Securi-Taco Tuesdays presents "Understanding Software Trust: Let’s explore Secure Attestations & the in-toto framework" with special guest @torresariasss piped.video/watch?v=nS3DCjcr…

Join @puerco & @stacey_potter for another #SecuriTacoTuesday livestream on Sep. 17! Bring your tacos as we dive into #SecureAttestations and the in-toto framework! piped.video/watch?v=nS3DCjcr…

🚨Tomorrow 🗓️ Join Stackers @puerco & @stacey_potter for #SecuriTacoTuesdays next livestream: Trust & Verify: How code Signing & @projectsigstore Secure The Software Supply Chain with @rdcallaw & @haydentherapper piped.video/live/JwfTCeBkL18…

Our next Securi-Taco Tuesday Livestream is August 27 with guest speakers from Google's Open Source Security Team: @haydentherapper & @rdcallaw. 📺 Aug 27: Trust & Verify How Code Signing & Sigstore Secure the Software Supply Chain piped.video/live/JwfTCeBkL18…

Excited to be here at #BlackHatUSA today! Stop by booth SC408 in Startup City for demos of new features (and get some new 🧦) #BHUSA

Honored to be a Rising Star ⭐ in Forbes 2024 Cloud ☁️ 100. This list is impressive, and we’re excited to be part of the cloud’s future. 🎉 Grateful for the recognition @BessemerVP @Forbes @SalesforceVC @cloud100 bit.ly/4fsf2tv #Cloud100 #RisingStar

Rewatch this @CloudNativeFdn #CNSCon Talk by our very own @puerco - it's rich in demos showing off many #bomshell capabilities! piped.video/watch?v=IKtKd3mq… #SBOM #SoftwareSupplyChain #SoftwareBillofMaterials #protobom

Sigstore founders @decodebytes & @rdcallaw discuss the origins of Sigstore, their experience growing the community, ongoing work to integrate Sigstore into Homebrew, PyPI, Maven Central plus Sigstore roadmap priorities & where the project is heading. piped.video/watch?v=8Kwuo21k…

TODAY! Tune in to this @CloudNativeFdn Livestream as Stackers @jaosorior and Jakub Hrozek dive into automating pinning GitHub Actions & container images to digests 9am PT | 12pm ET | 16:00 UTC | 17:00 BST 📺piped.video/watch?v=jHW2x-8L…

ICYMI: Check out @puerco 's keynote on VEX and how the @kubernetesio Release team bootstrapped OpenVEX feeds throughout the @CloudNativeFdn ecosystem: piped.video/watch?v=WHkSINRJ… #sbom #oss

Thanks to @ADALogics for doing a security audit recently for Minder! They analyzed our threat model and vulnerable code patterns, so that we can make Minder even more secure. stacklok.com/blog/securing-o… #cybersecurity

Earlier this week, we discovered that the Roblox Node.js library was hit by the "Destroy Loneliness" npm starjacking attack, deploying QuasarRAT. Execution of this virus would have allowed the attacker to establish command and control over affected Windows endpoints. We've notified @github and this package has now been removed from npm. Read @0xpoppaea's analysis of this attack here: stacklok.com/blog/destroylon… #cybersecurity #ThreatIntel #malware

JULY 17: Join Stackers @jaosorior & Jakub Hrozek for this @CloudNativeFdn Livestream to learn how you can automate pinning GitHub Actions & container images to their digests! Sign up here: community.cncf.io/events/det… Or tune in to piped.video/@cncf or twitch.tv/cloudnativefdn/

Join us for Securi-Taco Tuesdays with guest @decodebytes On July 16 @ 12pm CST / 7pm BST we'll talk: 🌮Tacos 💻The software development lifecycle 🔒The software supply chain security landscape 💣Where attack vectors lie meetup.com/stacklok-user-gro…

Staff Engineer @puerco delivering the final keynote today at #CNSCon on the OpenVEX project, which provides a standardized way to communicate about the exploitability of vulnerabilities (and works with @SPDXTeam or @CycloneDX_Spec SBOMs). #appsec

When we made a change to Minder's auth model, we chose to use @OpenFGA; it allowed us to write a multi-tenant auth model with the right level of granularity and a hierarchical permissions structure. Thanks for this great project! 👏More details: stacklok.com/blog/using-open…

Pinning actions and container images to digests is a security best practice, but tedious to do. The new #oss Frizbee GitHub Action makes automating this process easier. stacklok.com/blog/new-frizbe… #appsec #github

🚨 Tutorial Alert! 🗓️ Thu. June 27th at 1:55pm PT Join Evan Anderson (Stacklok) & María Inés Parnisari (@Okta) for this @CloudNativeFdn #CNSCon #tutorial Implementing a Multi-Tenant, Relationship-Based Authorization Model with @OpenFGA. sched.co/1dCVn

One thing Minder can help you do is automate your repo config, especially if your project spans 10s or 100s of @GitHub repos and each one needs a license file, secret scanning, etc. Here's a quick demo of how this works. piped.video/HJDSBBFgzLE?feature… #oss #appsec

Vulnerability scanners find #OpenSource dependencies in your code with CVEs—but what about malicious/deprecated #OSS packages? #Minder auto flags & blocks PRs with deprecated or malicious packages, & prevents them from being merged. Watch the demo here: piped.video/XkHxYU9nD2k

In this @CloudNativeFdn on-demand #webinar Evan Anderson goes over the breadth of (free or CNCF-sponsored) tools available to help you keep your GitHub repos - and Actions - consistently configured and secure for your end users. 📺 Tune in Thu. Jun 27 community.cncf.io/events/det…

In his upcoming #CNSCon #Keynote talk @puerco dives into how the #Kubernetes Release Engineering Team, in collaboration with TAG Security, bootstrapped #OpenVEX feeds throughout the @CloudNativeFdn ecosystem, and more! Thursday, June 27 at 10:05am PT sched.co/1dCVD

Join Stackers Evan Anderson & Dania Valladares for a #tutorial on Automating Configuration & Management of your @GitHub Repos with #Minder at @CloudNativeFdn #CNSCon Wednesday, June 26 • 3:50pm - 5:15pm sched.co/1dCUu #CloudNativeSecurityCon #CloudNativeSecurity

Catch our CTO @decodebytes with Bob Callaway for their @CloudNativeFdn #CNSCon talk: #Sigstore: Past, Present and Future Directions Wednesday, June 26 at 11:50am PT sched.co/1dCUB #CloudNativeSecurityCon

Our amazing Community Manager @stacey_potter repping Stacklok and earning her #KCDNYC Champion badge at @KcdNewyork last month! 👏👏👏 #KCD2024 #KubernetesforHumans

Happy #KuberTENes! #k8s co-founder @cmcluck reflects on lessons learned about building large-scale #OSS projects from his work building k8s with @brendandburns, @jbeda, and the rest of the team at @googlecloud. stacklok.com/blog/all-i-real…

An #AI #SBOM could assess risk by identifying when and where models trained on compromised datasets were deployed. But current formats can't yet accurately track datasets used in model training. @puerco on what is needed to secure AI model supply chains: stacklok.com/blog/ai-sbom-wh…

📣 We are thrilled to announce @CMcluck will be a Keynote Speaker at @AllThingsOpen in Raleigh, NC this October! 🧑‍🚀 To learn more about this amazing #OpenSource conference or to grab your 🎟️ Early Bird tickets at just $99 (until June 28) visit: 2024.allthingsopen.org

Thanks @openssf for featuring our work to help #opensource maintainers and communities use and operationalize @projectsigstore to secure their projects! openssf.org/blog/2024/06/04/…

#Kubernetes is turning 10! 🥳 Join Stacklok CEO & #k8s co-creator @cmcluck for the #KuberTENes #BirthdayBash on June 6 from 6:30 - 9:30pm PT to #celebr8k8s! Learn more, register to attend in-person, or livestream the event at events.linuxfoundation.org/k…

Security was a major focus at this year's @pycon — here are a few takeaways from the conference from Stackers @yrobla and Luis Juncal: stacklok.com/blog/3-key-take… #oss #appsec

At Stacklok, we're super grateful for our #OpenSource contributors! 🏆 This month we'd like to give a special shout out to Predrag Rogic (github.com/prezha) & Chris Burns (github.com/ChrisJBurns) for their #Minder contributions! 💖 Thank you 💖

#oss maintainers, if you're tired of trying to make sure every project repo has a security.md file, branch protections enabled, Dependabot configured, etc—Minder can help you automate this, and it's free for public repos. Here's how. stacklok.com/blog/tutorial-u…

Stacklok CTO @decodebytes on the need to think beyond CVEs to determine whether an #opensource dependency is "safe" to use, and what other risk factors to consider. stacklok.com/blog/cves-the-e…

Auto-remediation is a big part of Minder. We want to help devs catch security issues before they merge *AND* make it easier to resolve them. This demo shows how to auto-remediate repo config drift, @github Actions pinning + more: bit.ly/4bsg4m8

.@github's new Artifact Attestations feature uses @projectsigstore to generate and verify signed attestations for anything made with Actions. 👏👏 We've added support in Minder to use the contents of signed attestations for enhanced security policies: stacklok.com/blog/unlocking-…

For #opensource maintainers with projects spanning 20+ repos, it's often manual and time-consuming to manage repo configuration. We built a policy template in Minder to automate this—you can customize it and apply it to your repos for free: cloud.stacklok.com/

(2/2) Our second announcement: Minder Cloud! Having high-quality intelligence about open source packages is only as useful as an organization’s or a community’s ability to drive policies that shape developer behavior. That’s why we launched the open source software security platform Minder last November, as a way to apply and continuously enforce policies across the software delivery lifecycle. Today, we are launching Minder Cloud, a fully managed version of Minder that makes it easier for open source developers and communities to set up and enforce policies to help them produce safer, more sustainable software. To that end, we have committed to making Minder Cloud free forever for use on public repositories. Read more and get started with Minder Cloud here: bit.ly/4aynMv4

(1/2) 👋 We made some big announcements today at the #OSSummit. Here's the first. Today, we're introducing the OSS Trust Graph, a way to model trust in #opensource ecosystems. It maps the connections between open source contributors and projects, and, through our “proof-of-diligence” algorithm, uses that data to build an understanding of the relative safety and sustainability of those projects. We think this Trust Graph can help in two ways: 1) Identifying malicious activity. We can’t say with confidence that the OSS Trust Graph would have uncovered the XZ vulnerability, but we believe it’s a step in the right direction. We know that the hostile actors’ introduction of many relatively unknown “sock puppet” accounts would have driven down the score of the project. While there would be a fair amount of activity, the introduction of relatively unknown individuals all contributing to the same project would lower the project’s score, providing a signal to the community. 2) Identifying open source projects that need support. Through changes in scoring, the OSS Trust Graph could help us understand when high-contributing maintainers leave a high-scoring and widely used project, leaving it vulnerable to being abandoned or to a hostile takeover. Likewise, it could help identify high-scoring projects with a low number of high-scoring maintainers that could benefit from additional support and funding. Read more about this and sign up for private beta access here: bit.ly/3w6y5HH

We're at #OSSummit this week! Stop by our booth in the Solutions Showcase to say hi and catch a demo of new Minder capabilities. (And grab some new socks 🙂 ) And don't miss @cmcluck 's keynote on Weds at 10:20; he'll be talking about AI security and announcing some new capabilities to help #opensource communities detect and prevent supply chain attacks. (Details here: ossna2024.sched.com/event/1a…)

Get ready, Open Source Summit North America attendees! Don't miss Craig McLuckie's keynote speech on the 17th at 10:20 AM PST! See details and add it to your schedule here: hubs.la/Q02sBzml0 #SoftwareSupplyChain #OpenSourceSecurity #Sigstore #OpenSource #DeveloperCommunity

We'll be at Open Source Summit North America! #opensourcesoftware #SoftwareSupplyChain #CyberSecurity #OpenSourceSecurity #SecureCoding #Sigstore #OpenSource #DeveloperCommunity

Via @trustypkg , we found a malicious JavaScript #oss package minutes after it was published to @npmjs last week. "bugsnagmw" was advertised as useful middleware for an Express web application, but actually opened a shell in your app server for an attacker to exploit. Here's how we deobfuscated the code to figure this out: stacklok.com/blog/analysis-o… #cybersecurity

Trusty ingests and analyzes data on thousands of open source packages to calculate supply chain risk scores. We started with a monolithic architecture, processing package data in sequence based on a state manager—but hit challenges as Trusty expanded. Staff Engineer @yrobla recently led our migration to an event-driven, microservices-based architecture, and explains the outcomes (and challenges) of moving to an @awscloud SNS + SQS stack for large-scale data processing. Trusty now hooks in to the open source Feeds project from @openssf for package updates. stacklok.com/blog/from-monol…