OSS Supply Chain Security @google. @projectsigstore @theopenssf Technical Advisory Council - Ex-Red Hat, NetApp, IBM. PhD ECE NCSU.
North Carolina
- Tweets 502
- Following 136
- Followers 692
- Likes 518
Bob Callaway retweeted
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
22
198
1,209
98,775
Bob Callaway retweeted
Introducing Christina Hammock Koch Hall.
Today, Chancellor Kevin Howell announced that NC State’s Engineering Building II, located on the Oval on Centennial Campus, has been named in honor of NASA astronaut and three-time NC State alumna Christina Hammock Koch.
14
163
1,274
74,580
Bob Callaway retweeted
Happy for @Google to take part in this work for a more secure digital ecosystem for everyone.
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
4
25
85
20,856
Bob Callaway retweeted
For 20+ years, @Google has been dedicated to OSS and the developers who secure it. To combat the current threat landscape, we’re joining our industry peers to make new commitments.
blog.google/innovation-and-a…
7
19
1,743
Bob Callaway retweeted
I am proud to share the announcement about our CodeMender project at @GoogleDeepMind, an agent that can automatically fix a range of code security vulnerabilities. From only a modest-compute run, our agent submitted 72 high-quality fixes to vulnerable code in popular codebases, and maintainers accepted and upstreamed them.
deepmind.google/discover/blo…
23
83
558
81,665
Bob Callaway retweeted
🥳 #OpenSSF is turning 5! From sigstore to SLSA, OpenSSF Scorecard to GUAC—we’ve grown into a global force for open source security.
Read the full journey & join the celebration 🎉
👉 hubs.la/Q03zYdN80
Tell us how OpenSSF has impacted your work ⬇️
3
15
1,855
Bob Callaway retweeted
I am really excited that NVIDIA model hub is the first model hub that has adopted the model signing project. NVIDIA has collaborated significantly on the project and is a major reason for the standardization of the signature format (OMS).
🔐 AI can no longer rely on assumed trust.
Learn how cryptographic model signing on NGC builds trust into agentic systems that reason, plan, and act.
Tech blog ➡️ nvda.ws/3IQpsHy
1
2
7
379
Bob Callaway retweeted
Tom Hennen from @Google shares how the new #SLSA Source Track helps reduce the risk of source tampering—bringing stronger guarantees to code integrity and auditability. Learn how to protect your repo from attacks like PHP and xz. #OSSummit #OpenSSF #SupplyChainSecurity
4
4
464
Bob Callaway retweeted
I was pleasantly surprised to see model signing presented in the first 5 slides of the conference. And then the A2A talk raised the stakes: we need to sign the agent cards.
My thesis: we can do the same with the same model signing solution
Day 1 at #OSSummit NA 2025.
Jim Zemlin, Executive Director of the @linuxfoundation , highlighted Model Signing v1.0 in his keynote—a key milestone from the OpenSSF AI/ML WG to help secure the machine learning supply chain.
Read the blog to learn more: openssf.org/blog/2025/04/04/…
1
3
251
Bob Callaway retweeted
Excellent post on how confidential computing is being used with the transparency.dev witness ecosystem. blog.transparency.dev/harden…
2
4
14
3,855
Bob Callaway retweeted
Yesterday we launch v1.0 of model signing library, taming the wild west of model formats and deserialization vulnerabilities. You can read more about why this is needed and why we picked Sigstore as main signing method at security.googleblog.com/2025…
1
3
9
322
Bob Callaway retweeted
📣 Announcing v1.0 of the model-signing project, developed by the #OpenSSF AI/ML WG! This project enables signing + verifying ML models of any size/format using #sigstore, self-signed certs, or key pairs. Read the blog to learn more & get involved: openssf.org/blog/2025/04/04/…
4
14
1,088
Bob Callaway retweeted
🚀 The Alpha-Omega project has published its 2024 annual report!
With $6M in grants, Alpha-Omega helped staff security teams, fund audits, and strengthen critical #opensource projects—shaping a more secure and sustainable ecosystem.
📖 hubs.la/Q034J9HY0
2
4
285
Bob Callaway retweeted
The vote for in-toto's graduation is live on github.com/cncf/toc/pull/152…! Show your support with a 👍!
There's now a formal proposal for in-toto's graduation at the @CloudNativeFdn, opened by steering committee member @torresariass!
github.com/cncf/toc/pull/116…
2
8
773
Bob Callaway retweeted
OSV-Scanner has just released the first beta for V2, a major update that includes significant new features, including layer-aware container scanning, remediation for pom.xml, new HTML output and more.
osv.dev/blog/posts/osv-scann…
Please try it out and give us feedback!
4
11
1,335
cloud.google.com/blog/produc…
Awesome blog on how we’re using SLSA to make GKE more secure for our customers!
2
9
539
Bob Callaway retweeted
Happy new year! OSV had a lot of great progress in 2024, from new ecosystem adoption, API improvements, and scanner feature development! We just published a blog about these and our 2025 plans here: osv.dev/blog/posts/2024-in-r… !
4
8
985
Bob Callaway retweeted
On the heels of @Google’s ‘Big Sleep’ AI discovery of a real-world vulnerability, our OSS-Fuzz team identified and reported 26 vulnerabilities to open-source project maintainers by using AI-generated and enhanced fuzz targets. Read more here: security.googleblog.com/2024…
28
67
8,451
Bob Callaway retweeted
New blog post about OSS-Fuzz AI-powered fuzzing is live!
We talk about what went into making LLMs work well enough for this use case to find 26 new vulnerabilities (including a CVE in OpenSSL), as well as what else we have planned to make this better.
security.googleblog.com/2024…
26
110
16,033
Bob Callaway retweeted
ToB's @arturcygan found code execution and DoS bugs after just a few hours of fuzzing ZBar, an open-source library for reading barcodes.
tl;dr basic fuzz testing can reveal serious bugs - even in widely used software. blog.trailofbits.com/2024/10…
1
18
71
6,563