Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

Build Your Own AI Assistant with Goose and Model Runner Building an Easy Private AI Assistant with Goose and Model Runner

GooseCLI joins forces withDocker Model Runnerto bring OpenAI-compatible language models right to your desktop. Privacy? Check. Flexibility? Double-check. Tame tedious tasks and streamline workflows with a script-happy AI sidekick, all running safely from your own machine. No clouds in sight... read more  

Build Your Own AI Assistant with Goose and Model Runner Building an Easy Private AI Assistant with Goose and Model Runner
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

LangChain vs. Langfuse

LangChainconducts LLM workflows with finesse. It's like a symphony, swapping components as easily as React swaps elements in the DOM. MeetLangfuse, your backstage pass. It deconstructs complex LLM setups into structured datasets, offering a front-row view to every single model interaction... read more  

LangChain vs. Langfuse
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

Will ChatGPT tell this blind woman to take poison?

ChatGPT botched it big time—confusing poison with penicillin like it's a game. Told a user without sight to pop poison in almost every trial (100 times, no less). That's downright terrifying... read more  

Will ChatGPT tell this blind woman to take poison?
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

Sync Claude Code conversations with Issues, & your git commits with your Issues, & track the history of your LLM-generated code

AI coding assistants boost developer productivity by offering real-time, context-aware code suggestions and automating routine tasks. Powered by large language models like GPT and Code LLaMA, they understand project context and improve accuracy with static analysis and reinforcement learning. Top to.. read more  

Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

The Rise of Energy and Water Consumption Using AI Models, and How It Can Be Reduced

AI and data centers gobble up 2-3% of the world's electricity.Expect that number to swell. All those chatty AI models? They gulpup to 500ml of water per conversationjust to keep cool. Techniques like transfer learning and model distillation play hero roles in hacking down AI's thirst for energy. Mod.. read more  

The Rise of Energy and Water Consumption Using AI Models, and How It Can Be Reduced
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

Journey to 1000 models: Scaling Instagram’s recommendation system

Instagram'sML setup now wrangles more than1000 models. They've cooked up amodel registryand anautomated launch platform. Together, these cut deployment time from days to mere hours, keeping things rock-solid and amping up productivity... read more  

Journey to 1000 models: Scaling Instagram’s recommendation system
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

The Junior Developer Extinction: We’re All Building the Next Programming Dark Age

AI cranks junior developers’ productivity by up to 40%.The catch? It might spawn a crowd tethered to tools they haven't fully grasped... read more  

The Junior Developer Extinction: We’re All Building the Next Programming Dark Age
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

New Crypto-Jacking Attacks Target DevOps and AI Infrastructure

Wizpopped the hood on a sneaky crypto-jacking scheme. Meet JINX-0132, an operation that hijacksNomad, Consul, Docker,andGiteamisconfigurations to stay under the radar. Meanwhile,Sysdigraised the alarm on a copycat act aimed atOpen WebUI. It’s a growing trend that flips exposed infrastructure into a .. read more  

New Crypto-Jacking Attacks Target DevOps and AI Infrastructure
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

The Future of AI-Augmented Infrastructure: Letting AI Handle the Terraform Tax

Terraformreviews drag teams through "invisible costs," even with sleek tools. AI jumps in, offering sharper, context-savvy vetting without shaking up current workflows... read more  

The Future of AI-Augmented Infrastructure: Letting AI Handle the Terraform Tax
Link
@faun shared a link, 10 months, 4 weeks ago
FAUN.dev()

Go is 80/20 language

Gokeeps it simple, delivering 80% of the goods with just 20% of the mess. But some critics sniff around, demanding more for their extra 36% effort.Swiftproves the point that more isn’t always better with its extra baggage... read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.