Yolanda Robla

[Stacklok @StackLokHQ]

Security was a major focus at this year's @pycon — here are a few takeaways from the conference from Stackers @yrobla and Luis Juncal: https://t.co/aXcucfJEMx #oss #appsec

[Luke Hinds @decodebytes]

The private beta sign up link. We are accepting folks in rounds, so worth signing up early:

https://t.co/Jmd2coCCdY

[Luke Hinds @decodebytes]

We (@StackLokHQ) have released details of our Proof-of-Diligence algorithm and Graph. Very curious to see what others make of this. We have a private beta starting next week where we expose the API/UI for others try: https://t.co/zazECYu4qw

[Luke Hinds @decodebytes]

Busy day at @StackLokHQ , we also released Minder Cloud today. Craft custom policies for remediation at scale. The GitHub provider implementation is in place with a UI to compliment the CLI. https://t.co/Az8gq3qYad

[Stacklok @StackLokHQ]

Get ready, Open Source Summit North America attendees! Don't miss Craig McLuckie's keynote speech on the 17th at 10:20 AM PST! See details and add it to your schedule here: https://t.co/fJovXjziA7
#SoftwareSupplyChain #OpenSourceSecurity #Sigstore #OpenSource #DeveloperCommunity

[Luke Hinds @decodebytes]

2,791 packages published by a single user within 72 hours, all sharing the same 132 external dependencies, while depending on each other. I am curious where this all ends up.

[Craig McLuckie @cmcluck]

Love what I am seeing from the @trustypkg team. Real-time tracking of package feeds, with increasingly rich checks that identify and initiate removal of malicious material from community repos. What started as an intelligence engine is becoming a service for public good.

[trustypkg @TrustyPkg]

⚠️ Malicious Package Detected ⚠️ 📷: Contains obfuscated code calling suspicious URL's. Appears to be typo attacking bugsnag-js: https://t.co/t2I3s3uFXH

[Yolanda Robla @yrobla]

It is a pleasure to drive this challenging project at @StackLokHQ , working with an amazing team, where everyone is making an impact.

[Stacklok @StackLokHQ]

Trusty ingests and analyzes data on thousands of open source packages to calculate supply chain risk scores. We started with a monolithic architecture, processing package data in sequence based on a state manager—but hit challenges as Trusty expanded.

Staff Engineer @yrobla recently led our migration to an event-driven, microservices-based architecture, and explains the outcomes (and challenges) of moving to an @awscloud SNS + SQS stack for large-scale data processing. Trusty now hooks in to the open source Feeds project from @openssf for package updates. https://t.co/RqsoO6Chp6

[Stacklok @StackLokHQ]

Trusty ingests and analyzes data on thousands of open source packages to calculate supply chain risk scores. We started with a monolithic architecture, processing package data in sequence based on a state manager—but hit challenges as Trusty expanded.

Staff Engineer @yrobla recently led our migration to an event-driven, microservices-based architecture, and explains the outcomes (and challenges) of moving to an @awscloud SNS + SQS stack for large-scale data processing. Trusty now hooks in to the open source Feeds project from @openssf for package updates. https://t.co/RqsoO6Chp6

[Stacklok @StackLokHQ]

Dataset poisoning is a security concern for AI/ML models. Both major SBOM formats can specify the datasets used to train AI/ML models—but they can't yet point to a dataset revision in the case of a breach. @puerco explains: https://t.co/wD409PCQ2T #aisecurity

[Luke Hinds @decodebytes]

Interesting to see https://t.co/luSP6DojDt launched by the
@letsencrypt, we will evaluate using sunlight in
@projectsigstore rekor.

[Brian Dussault @briandussault]

We launched 🚀 our @StackLokHQ OSS Discord server where you can chat with the team about @projectsigstore, Minder (OSS Platform that helps open source communities build more secure software), and securing the software supply chain.

Join us! 📣 https://t.co/3MshO67glW

[Juan Antonio Osorio @jaosorior]

New blog post: Writing Minder rule types using Open Policy Agent and Rego

https://t.co/BiZTlT5f0M

@OpenPolicyAgent @StackLokHQ

[Luke Hinds @decodebytes]

Love discovering malicious open source packages or researching new novel software supply chain attacks in the wild?
We have an opening for a Senior Security Analyst at @StackLokHQ:
https://t.co/rxdYckeMqS

[Stacklok @StackLokHQ]

Have some spare time? Why not give minder a quick spin?

[Stacklok @StackLokHQ]

See How Stacklok Uses Minder Internally to Build More Secure Software:
https://t.co/VtTc32Sppf

[Yolanda Robla @yrobla]

https://t.co/SLFD9s8KZZ

[Brian Dussault @briandussault]

Minder was open sourced today. It's an open source platform that helps #OSS communities build more secure software. https://t.co/bQxmrJAgJm We would love your feedback

[Stacklok @StackLokHQ]

We’re excited to announce the launch of Minder and Trusty, two free-to-use tools that build on the power of @projectsigstore to help developers and #opensource communities keep their software safe. Read more on our blog: https://t.co/XPz2ez1sey