Join us

ContentUpdates and recent posts about Sigstore..
Link
@kala shared a link, 5 days, 23 hours ago
FAUN.dev()

A trillion dollars is a terrible thing to waste

OpenAI co-founder Ilya Sutskever just said the quiet part out loud: scaling laws are breaking down. Bigger models aren’t getting better at thinking, they’re getting worse at generalizing and reasoning. Now he’s eyeingneurosymbolic AIandinnate inductive constraints. Yep, the “just make it huge” era m.. read more  

A trillion dollars is a terrible thing to waste
Link
@kala shared a link, 5 days, 23 hours ago
FAUN.dev()

Prompts for Open Problems

The author, Ben Recht, proposes five research directions inspired by his graduate machine learning class, arguing for different research rather than just more. These prompts include adopting a design-based view for decision theory, explaining the robust scaling trends in competitive testing, and mov.. read more  

Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

Advancing Our Chef Infrastructure: Safety Without Disruption

Slack pulled back the curtain onSlack AI, its LLM-powered assistant built with a fortress mindset. Every customer gets their ownisolated environment. Any data passed tovendor LLMs? It'sephemeral. Gone before it can stick. No fine-tuning. No exporting data outside Slack. And there’s a wholemiddle-lay.. read more  

Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

Why we're leaving serverless

Every millisecond matters in the critical path of API authentication. After two years of battling serverless limitations, the entire API stack was rebuilt to reduce end-to-end latency. The move from Cloudflare Workers to stateful Go servers resulted in a 6x performance improvement and simplified arc.. read more  

Why we're leaving serverless
Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

Failure is inevitable: Learning from a large outage, and building for reliability in depth at

Datadog ditched its “never fail” mindset after a March 2023 meltdown knocked out half its Kubernetes nodes and took major user features down with them. The fix? A full-stack rethink built aroundgraceful degradation. The team addeddisk-based persistence at intake,live-data prioritization,QoS-aware re.. read more  

Failure is inevitable: Learning from a large outage, and building for reliability in depth at
Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

You’ll never see attrition referenced in an RCA

Lorin Hochstein argues that while high-profile engineer attrition is often speculated to contribute to major outages, it is universally absent from public Root Cause Analyses (RCAs). This exclusion occurs because public RCAs aim to reassure customers by focusing on technical fixes, whereas attrition.. read more  

Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

Declarative Action Architecture

The Declarative Action Architecture (DAA) is a scalable E2E testing pattern that separates concerns across three distinct layers. TheTest Layeris 100% declarative, statingwhatis being tested without any procedural logic, making tests read like documentation. The coreAction Layerimplements the execut.. read more  

Declarative Action Architecture
Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

Comparing AWS Lambda Arm64 vs x86_64 Performance Across Multiple Runtimes in Late 2025

A new open-source benchmark looked at 183,000 AWS Lambda invocations, andarm64 beats x86_64across the board in both cost and speed. Rust on arm64 with SHA-256 tuned in assembly? It clocks in 4–5× faster than x86 in CPU-heavy tasks. Cold starts are snappy too—5–8× quicker than Node.js and Python... read more  

Comparing AWS Lambda Arm64 vs x86_64 Performance Across Multiple Runtimes in Late 2025
Link
@devopslinks shared a link, 5 days, 23 hours ago
FAUN.dev()

The story of how we almost got hacked

Team Invictus caught a BEC attempt using WeTransfer to slip in a fake Microsoft 365 login page powered byEvilProxy. Classic Adversary-in-the-Middle move, but dressed up with a slick delivery package. Digging deeper, the team mapped the attacker’s setup and found something bigger: a credential grab c.. read more  

The story of how we almost got hacked
News FAUN.dev() Team Trending
@kaptain shared an update, 6 days ago
FAUN.dev()

Agent Sandbox Brings Kernel-Level Guardrails to AI Agents on Kubernetes

Kubernetes gVisor Kata Containers Google Kubernetes Engine (GKE)

Agent Sandbox, a new Kubernetes primitive, was introduced at KubeCon NA 2025 to enhance AI agent management on Kubernetes and Google Kubernetes Engine.

Agent Sandbox Brings Kernel-Level Guardrails to AI Agents on Kubernetes
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.