Zach Steindler

Hacker, cooker, hiker

[Zach Steindler @steiza]

Looking at push activity is so much better than individual commits.

Pushes are authenticated, unlike commit author identity. Looking at pushes you can more easily verify security practices, like requiring reviews (see https://t.co/kCOHeuK2WV).

Excited to see where this goes!

[GitHub @github]

It's now easier to understand changes to your repositories with the new activity view. This new activity view gives you the ability to self-serve insights to your favorite repository and all of its changes.

https://t.co/idXU7tXTiB

[Python Package Index @pypi]

An important update on our efforts to secure PyPI with multi-factor authentication: https://t.co/RPjnUweNP1

[OpenSSF @openssf]

We Want to Hear from You 🔊👂➡️ Take the OpenSSF Software Security Awareness Survey https://t.co/Pb7sTZRsHh

[Zach Steindler @steiza]

Last week was a big one for open source security:
- https://t.co/YhQ2PcBUkX
- https://t.co/X8gQTDEgpo
- https://t.co/1HvbmkDrrK

... and yet, there's so much more to do. I'm excited to serve on the 2023 OpenSSF TAC!

[OpenSSF @openssf]

We're pleased to announce the 2023 Technical Advisory Council (TAC) & Security Community Individual Representative (SCIR) on the Board of the OpenSSF 🥳https://t.co/SZkSLxDeGQ

[Zach Steindler @steiza]

Big day for open source security! npm worked with the open source project Sigstore to put together a beta of provenance, verifiably tying npm packages back to their source code and build instructions: https://t.co/X8gQTDDIzQ

[OpenSSF @openssf]

Today we're proud to announce the release of version 1.0 of SLSA 🎉 Supply-chain Levels for Software Artifacts is an OpenSSF project that provides specifications for software supply chain security, established by community expert consensus. #OSSecurity

[Zach Steindler @steiza]

@drunkenwood There are also aperiodic tiles, which cover a surface with a pattern, but the *pattern never repeats* https://t.co/s5EA0cmzL3

[Clint Gibler @clintgibler]

🗒️ gh-sbom

A gh CLI extension that outputs JSON SBOMs (in SPDX or CycloneDX format) for your GitHub repository

https://t.co/DwH6M7inKG

[Clint Gibler @clintgibler]

✍️ Sigstore project announces general availability and v1.0 releases

Two of @projectsigstore foundational projects, Fulcio and Rekor, published v1.0 releases as well

@steiza on why GitHub is excited
https://t.co/zB2fnLjKzH

By @davelester, @rdcallaw

https://t.co/fKCc98JWIb

[Justin Hutchings @jhutchings0]

Why is the @projectsigstore GA a big deal for developers? @steiza breaks it down for you. https://t.co/yDGdiOtZRL

[Justin Hutchings @jhutchings0]

Really loving all the excitement about @npmjs and @projectsigstore today. Thanks @lilyhnewman for interviewing @lorenc_dan and I on it today!

https://t.co/WSlRwwkrn5

[sMyle (🦋 @myles.dev) @MylesBorins]

Extremely excited about this. The npm team has been collaborating with GitHub's package security team for months putting together an RFC to improve the audibility and trust of npm packages using SigStore and trusted build infrastructure

https://t.co/D9IEzjPftp

[Zach Steindler @steiza]

Want to secure your builds, in the cloud, without scattering API keys everywhere? Come see my talk in ~25 minutes: https://t.co/AV2d3bLFMx or see my slides after at https://t.co/hxbgwrctk1 #fwdcloudsec

[Zach Steindler @steiza]

@twbrandt Afterwards we found https://t.co/gTFvm8DOaJ

[Zach Steindler @steiza]

An exciting evening in #chelseami

[GitHub @github]

Want to use GitHub-hosted Actions runners, but need to access resources on your private network? You’re in luck! We’ve documented 3 ways to do it ⬇️. https://t.co/muvHGrqk8k

[Zach Steindler @steiza]

@bdimcheff @akgood Yeah, you run the SSH CA, so you can have it enforce whatever requirements you'd like! Maybe you could convince @akgood to open source a serverless SSH CA that runs on GCP 👀

[Zach Steindler @steiza]

No new emoji flags, based on this post from the Unicode Emoji Subcommittee Chair (which has to be one of the best job titles I've ever heard): https://t.co/CXqPep3a24

cc @99piorg @BradyHaran @cgpgrey