Stacklok reposted this
We're excited to have Craig McLuckie, CEO for Stacklok, presenting on the keynote stage "Community-centric approaches to securing AI-generated code" at #AllThingsOpen! https://buff.ly/3ToSmk6
From the founders of projects such as sigstore and kubernetes, Stacklok is a community-centric software supply chain security startup.
External link for Stacklok
Seattle, Washington, US
Stacklok reposted this
We're excited to have Craig McLuckie, CEO for Stacklok, presenting on the keynote stage "Community-centric approaches to securing AI-generated code" at #AllThingsOpen! https://buff.ly/3ToSmk6
Stacklok reposted this
In 1 week: 🔒Securi-Taco Tuesdays 🌮 hosts Adolfo García Veytia & Stacey Potter invite Santiago Torres Arias on the show to discuss "Understanding Software Trust: Let's Explore Secure Attestations & the in-toto Framework" 📅 Sep 17th (11am PT | 12pm CST | 2pm ET | 7pm BST) More details on our meetup page: https://lnkd.in/ev-vae_m Or watch via our LinkedIn Event here: https://lnkd.in/eH9gFsgD
DPRK-aligned threat actors have launched a new surge of activity targeting developers in the cryptocurrency and Web3 sectors using malicious NPM packages. Our investigation (led by security researcher Poppaea McDermott) revealed the stealer and loader BeaverTail embedded in these packages, spreading through weaponized GitHub repositories involved in fake job applications. The attack chain highlights the growing risks of dependency hijacking and transitive vulnerabilities in the open-source supply chain. Read Poppaea's analysis of this attack here: https://lnkd.in/g3Xvdh_4 #malware #appsec #cybersecurity
In 1 week: 🔒Securi-Taco Tuesdays 🌮 hosts Adolfo García Veytia & Stacey Potter invite Santiago Torres Arias on the show to discuss "Understanding Software Trust: Let's Explore Secure Attestations & the in-toto Framework" 📅 Sep 17th (11am PT | 12pm CST | 2pm ET | 7pm BST) More details on our meetup page: https://lnkd.in/ev-vae_m Or watch via our LinkedIn Event here: https://lnkd.in/eH9gFsgD
#SigstoreCon Supply Chain Day CFP Closes this FRIDAY (Sep. 13) be sure you submit this week to share your adoption story, learnings from building a Sigstore client, or have a technical deep-dive, research topic, or supply chain security best practices! https://lnkd.in/eGkUyiEN
📣 Last call for CFP submissions for #SigstoreCon Supply Chain Day! Got insights on Sigstore, SLSA, or TUF? We want to hear from you! Share your case studies, technical deep dives, or best practices in supply chain security. Submit your talk today and join the conversation! 💬 📅 Deadline: Friday, Sept 13. Less than a week left! 📃 Submit here: https://lnkd.in/epuM-EJa ⚙️ Session types: 30-min Presentation | 10-min Lightning Talk #OSSSecurity #OpenSource
During this episode of 🔒 Securi-Taco Tuesdays 🌮 we’re diving into the world of software trust and security with this introductory level discussion on software attestations and the open source project in-toto (a Cloud Native Computing Foundation (CNCF) incubating project). We’ll explore how software attestations provide critical insights into the integrity and authenticity of code, and how the in-toto project’s comprehensive framework ensures secure supply chains. We’ll talk about practical strategies for implementing these tools to protect against vulnerabilities, ensuring that every step of your software’s lifecycle meets the ultimate standards of trust and security. About our Speaker: Santiago Torres Arias is an Assistant Professor at Purdue's Electrical and Computer Engineering Department. His interests include binary analysis, cryptography, distributed systems, and security-oriented software engineering. His current research focuses on securing the software development lifecycle, cloud security, and update systems. Santiago is a member of the Arch Linux security team and has contributed patches to F/OSS projects on various degrees of scale, including Git, the Linux Kernel, Reproducible Builds, NeoMutt, and the Briar project. Santiago is also a maintainer for Cloud Native Computing Foundation's project The Update Framework (TUF) as well as lead the in-toto and Sigstore projects.
On our last Securi-Taco Tuesday Adolfo García Veytia welcomed Bob Callaway & Hayden Blauzvern from Google's Open Source Security Team (GOSST) on to chat about how code signing and sigstore secure the software supply chain. Read the livestream recap blog & watch the replay here: https://lnkd.in/geHSMdQx #TechTalk #SoftwareIntegrity #sigstore #SoftwareSupplyChain #OpenSource #DevSecOps
On August 29th, our automated threat detection platform alerted us to the presence of malicious code in a newly published PyPI package named "invokehttp." This package raised red flags due to inconsistencies in its metadata and the absence of any verified connection to its claimed GitHub repository. The attacker opted to link the package to a popular Selenium ChromeDriver GitHub repository. This has the same effect of exploiting the repository’s high number of stars, forks, and followers, adding a layer of credibility to "invokehttp." Read our full analysis of this attack on our blog here: https://lnkd.in/gPr6nVDA
If you're based in London, don't miss CTO Luke Hinds' keynote at DevSecOps - London Gathering's 7th birthday this September!
We are very excited to be celebrating DevSecOps - London Gathering 7th birthday on Wednesday 18th September at the Google London Office in St Pancras! This year we are welcoming guest speakers Luke Hinds from Stacklok, Ashley Ward from ControlPlane and Laura Raquel Guzman & Monica Carranza from Google. Join us from 5:45PM to hear #DevSecOps talks, network and enjoy some great food, drinks, birthday cake and a raffle! You can find out more details plus RSVP to save your seat over on MeetUp > https://lnkd.in/duSt_86p
Now available in Trusty: Vulnerability and license data for open source packages! 🙌 You can now use trustypkg.dev to view vulnerabilities and their severity levels for specific open source package versions across five different language ecosystems. We use OSV.dev (an open source vulnerability database and schema from Google) for our vulnerability and severity data. You can also view a package's open source license information, including Blue Oak Council permissiveness levels and whether the licenses are approved by Open Source Initiative (OSI). This data can also be used for policy enforcement in Minder: You can block pull requests that introduce packages with known CVEs, to make sure that developers don't merge unsafe code. Check it out now at www.trustypkg.dev, or read more in our blog post! https://lnkd.in/g5g8766A