Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Authentication Explained: When to Use Basic, Bearer, OAuth2, JWT & SSO

Modern apps don’t just check passwords—they rely on **API tokens**, **OAuth**, and **Single Sign-On (SSO)** to know who’s knocking before they open the door... read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Writing Load Balancer From Scratch In 250 Line of Code

A developer rolled out a fully working **Go load balancer** with a clean **Round Robin** setup—and hooks for dropping in smarter strategies like **Least Connection** or **IP Hash**. Backend servers live in a custom server pool. Swapping balancing logic? Just plug into the interface... read more  

Writing Load Balancer From Scratch In 250 Line of Code
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Building a Resilient Data Platform with Write-Ahead Log at Netflix

Netflix faced challenges like data loss, system entropy, updates across partitions, and reliable retries. To address these, they built a generic Write-Ahead Log (WAL) system serving a variety of use cases like delayed queues, generic cross-region replication, and multi-partition mutations. WAL abstr.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Organize your Slack channels by “How Often”, not “What” - Aggressively Paraphrasing Me

One dev rewired their Slack setup by **engagement frequency**—not subject. Channels got sorted into tiers like “Read Now” and “Read Hourly,” cutting through noise and saving brainpower. It riffs off the **Eisenhower Matrix**, letting priorities shift with projects, not burn people out... read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Privacy for subdomains: the solution

A two-container setup using **acme.sh** gets Let's Encrypt certs running on a Synology NAS—thanks, Docker. No built-in Certbot support? No problem. Cloudflare DNS API token handles auth. Scheduled tasks handle renewal... read more  

Privacy for subdomains: the solution
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Users Only Care About 20% of Your Application

Modern apps burst with features most people never touch. Users stick to their favorite 20%. The rest? Frustration, bloat, ignored edge cases. Tools like **VS Code**, **Slack**, and **Notion** nail it by staying lean at the core and letting users stack what they need. Extensions, plug-ins, integrati.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Uncommon Uses of Common Python Standard Library Functions

A fresh guide gives old Python friends a second look—turns out, tools like **itertools.groupby**, **zip**, **bisect**, and **heapq** aren’t just standard; they’re slick solutions to real problems. Think run-length encoding, matrix transposes, or fast, sorted inserts without bringing in another depen.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

The productivity paradox of AI coding assistants

A July 2025 METR trial dropped a twist: seasoned devs using Cursor with Claude 3.5/3.7 moved **19% slower** - while thinking they were **20% faster**. Chalk it up to AI-induced confidence inflation. Faros AI tracked over **10,000 developers**. More AI didn’t mean more done. It meant more juggling, .. read more  

The productivity paradox of AI coding assistants
Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

Implementing Vector Search from Scratch: A Step-by-Step Tutorial

Search is a fundamental problem in computing, and vector search aims to match meanings rather than exact words. By converting queries and documents into numerical vectors and calculating similarity, vector search retrieves contextually relevant results. In this tutorial, a vector search system is bu.. read more  

Link
@faun shared a link, 7 months, 1 week ago
FAUN.dev()

5 Free AI Courses from Hugging Face

Hugging Face just rolled out a sharp set of free AI courses. Real topics, real tools—think **AI agents, LLMs, diffusion models, deep RL**, and more. It’s hands-on from the jump, packed with frameworks like LangGraph, Diffusers, and Stable Baselines3. You don’t just read about models—you build ‘em i.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.