Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Understanding LLMs: Insights from Mechanistic Interpretability

LLMs generate text by predicting the next word using attention to capture context and MLP layers to store learned patterns. Mechanistic interpretability shows these models build circuits of attention and features, and tools like sparse autoencoders and attribution graphs help unpack superposition, r.. read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

The LinkedIn Generative AI Application Tech Stack: Extending to Build AI Agents

LinkedIn tore down its GenAI stack and rebuilt it for scale—with agents, not monoliths. The new setup leans on distributed, gRPC-powered systems. Central skill registry? Check. Message-driven orchestration? Yep. It’s all about pluggable parts that play nice together. They added sync and async modes.. read more  

The LinkedIn Generative AI Application Tech Stack: Extending to Build AI Agents
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

GitHub Copilot on autopilot as community complaints persist

GitHub's biggest debates right now? Whether to shut down AI-generated "noise" fromCopilot—stuff like auto-written issues and code reviews. No clear answers from GitHub yet. Frustration is piling up. Some devs are ditching the platform altogether, shifting their projects toCodebergor spinning upself-.. read more  

GitHub Copilot on autopilot as community complaints persist
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Building Agents for Small Language Models: A Deep Dive into Lightweight AI

Agent engineering with **small language models (SLMs)**—anywhere from 270M to 32B parameters—calls for a different playbook. Think tight prompts, offloaded logic, clean I/O, and systems that don’t fall apart when things go sideways. The newer stack—**GGUF** + **llama.cpp**—lets these agents run loc.. read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

AgentHopper: An AI Virus

In the “Month of AI Bugs,” researchers poked deep and found prompt injection holes bad enough to run **arbitrary code** on major AI coding tools—**GitHub Copilot**, **Amazon Q**, and **AWS Kiro** all flinched. They didn’t stop at theory. They built **AgentHopper**, a proof-of-concept AI virus that .. read more  

AgentHopper: An AI Virus
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Guardians of the Agents 

A new static verification framework wants to make runtime safeguards look lazy. It slaps **mathematical safety proofs** onto LLM-generated workflows *before* they run—no more crossing fingers at execution time. The setup decouples **code from data**, then runs checks with tools like **CodeQL** and .. read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Vibe coding has turned senior devs into ‘AI babysitters,’ but they say it’s worth it

Fastly says95% of developersspend extra time fixing AI-written code. Senior engineers take the brunt. That overhead has even spawned a new gig: “vibe code cleanup specialist.” (Yes, seriously.) As teams lean harder on AI tools, reliability and security start to slide—unless someone steps in. The re.. read more  

Vibe coding has turned senior devs into ‘AI babysitters,’ but they say it’s worth it
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Introducing the MCP Registry

The new **Model Context Protocol (MCP) Registry** just dropped in preview. It’s a public, centralized hub for finding and sharing MCP servers—think phonebook, but for AI context APIs. It handles public and private subregistries, publishes OpenAPI specs so tooling can play nice, and bakes in communit.. read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

LLM Evaluation: Practical Tips at Booking.com

Booking.com built Judge-LLM, a framework where strong LLMs evaluate other models against a carefully curated golden dataset. Clear metric definitions, rigorous annotation, and iterative prompt engineering make evaluations more scalable and consistent than relying solely on humans. **The takeaway**:.. read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Scaling Prometheus: Managing 80M Metrics Smoothly

Flipkart ditched its creakyStatsD + InfluxDBstack for afederated Prometheussetup—built to handle 80M+ time-series metrics without choking. The move leaned intopull-based collection,PromQL's firepower, andhierarchical federationfor smarter aggregation and long-haul queries. Why it matters:Prometheus.. read more  

Scaling Prometheus: Managing 80M Metrics Smoothly
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.