Join us

ContentUpdates and recent posts about Sigstore..
Link
@kaptain shared a link, 4 months, 3 weeks ago
FAUN.dev()

You Want Microservices—But Do You Need Them?

Amazon Prime Video ditched its pricey microservices maze and rebuilt as asingle-process monolith, cutting ops costs by 90%. No big press release. Just results. Same move from Twilio Segment. And Shopify. Both pulled their tangled systems back intomodular monoliths- cleaner, faster, easier to test, a.. read more  

You Want Microservices—But Do You Need Them?
Link
@kaptain shared a link, 4 months, 3 weeks ago
FAUN.dev()

Kubernetes Configuration Good Practices

Stripped down and sharp, the blog lays out Kubernetes config best practices: keep YAML manifests in version control, use Deployments (not raw Pods), and label like you mean it - semantically, not just alphabet soup. It digs into sneaky pain points too, like how YAML mangles booleans (yes≠true), and .. read more  

Link
@kaptain shared a link, 4 months, 3 weeks ago
FAUN.dev()

The Grafana trust problem

Grafana’s been busy clearing the shelves.Grafana Agent,Agent Flow, andOnCall? All deprecated. The replacement:Grafana Alloy- a one-stop observability agent that handles logs, metrics, traces, and OTEL without flinching. Meanwhile,Mimir 3.0ships with a Kafka-powered ingestion pipeline. More scalabili.. read more  

Link
@kaptain shared a link, 4 months, 3 weeks ago
FAUN.dev()

Turning Kubernetes Last Access to Kubernetes Least Access Using KIEMPossible

KIEMPossible is a new open-source tool for Kubernetes entitlement cleanup. It maps out who has access to what - roles, entities, permissions - and shows how those are actually used across your clusters. Think of it as a permission microscope for AKS, EKS, GKE, and even the DIY K8s crowd. It breaks d.. read more  

Turning Kubernetes Last Access to Kubernetes Least Access Using KIEMPossible
Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

How I Built a 100% Offline “Second Brain” for Engineering Docs using Docker & Llama 3 (No OpenAI)

Senior Automation Engineer built an offline RAG system for technical documents using Ollama, Llama 3, and ChromaDB in a Dockerized microservices architecture. The system enables efficient retrieval and generation of information from PDFs with a streamlined UI. The deployment package, including compl.. read more  

Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

How to Evaluate LLMs Without Opening Your Wallet

A new mock-based framework lets QA and automation folks stress-test LLM outputs - no API calls, no surprise charges. It runs entirely local, usingpytest fixtures, structured test flows, and JSON schema checks to keep things tight. Test logic stays modular. Cross-validation’s baked in. And if you nee.. read more  

Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

I tested ChatGPT’s backend API using RENTGEN, and found more issues than expected

A closer look at OpenAI’s API uncovers some shaky ground: misconfiguredCORS headers, missingX-Frame-Options, noinput validation, and borkedHTTP status handling. Large uploads? Boom..crash!CORS preflightrequests? Straight-up denied. So much for smooth browser support... read more  

I tested ChatGPT’s backend API using RENTGEN, and found more issues than expected
Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

Cato CTRL™ Threat Research: HashJack - Novel Indirect Prompt Injection Against AI Browser Assistants

A new attack method -HashJack- shows how AI browsers can be tricked with nothing more than a URL fragment. It works like this: drop malicious instructions after the#in a link, and AI copilots likeComet,Copilot for Edge, andGemini for Chromemight swallow them whole. No need to hack the site. The LLM .. read more  

Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

AI and QE: Patterns and Anti-Patterns

The author shared insights on how AI can be leveraged as a QE and highlighted potential dangers to watch out for, drawing parallels with misuse of positive behaviors or characteristics taken out of context. The post outlined anti-patterns related to automating tasks, stimulating thinking, and tailor.. read more  

Link
@kala shared a link, 4 months, 3 weeks ago
FAUN.dev()

Writing a good CLAUDE.md

Anthropic’s Claude Code now deprioritizes parts of the root context file it sees as irrelevant. It still reads the file every session, but won’t waste cycles on side quests. The message to devs: stop stuffing it with catch-all instructions. Instead, use modular context that unfolds as needed - think.. read more  

Writing a good CLAUDE.md
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.