Join us

ContentUpdates and recent posts about Sigstore..
Link
@kaptain shared a link, 4 months, 2 weeks ago
FAUN.dev()

The State of Java on Kubernetes 2026: Why Defaults are Killing Your Performance

Akamas just dropped fresh numbers: over60% of Java apps running on Kubernetesstick with default JVM settings. That means sluggish memory use, GC thrash, and CPUs getting choked out. Even with "container-friendly" Java builds out there, most teams still skip setting GC types or heap sizes. Kubernetes.. read more  

The State of Java on Kubernetes 2026: Why Defaults are Killing Your Performance
Link
@kala shared a link, 4 months, 2 weeks ago
FAUN.dev()

YOLO Mode: Hidden Risks in Claude Code Permissions

A scrape of 18,470 Claude Code configs on GitHub shows a pattern: developers are handing their AI agents the keys to the castle. Unrestricted file, shell, and network accessis common. Among them: - 21.3% let Claude runcurl - 14.5% allowarbitrary Python execution - 19.7% give itgit pushprivileges Tha.. read more  

YOLO Mode: Hidden Risks in Claude Code Permissions
Link
@kala shared a link, 4 months, 2 weeks ago
FAUN.dev()

Adventures in Neural Rendering

A graphics dev took a swing at encoding rendering signals - radiance, irradiance, depth, AO, BRDFs - using tightMLPs in HLSL. They benchmarked size, storage, and runtime cost. Turns out, MLPs beatL2 spherical harmonicsfor packing radiance. But they stumble on irradiance and specular BRDFs. Bring inR.. read more  

Adventures in Neural Rendering
Link
@kala shared a link, 4 months, 2 weeks ago
FAUN.dev()

Why Trying to Secure OpenClaw is Ridiculous

OpenClaw, an open-source autonomous AI agent with full device access, racked up 179K GitHub stars - and walked straight into a security nightmare. It shipped wide open: default ports exposed to the internet, its plugin hub laced with malicious packages. Slapped-on fixes followed, warning labels, Vir.. read more  

Why Trying to Secure OpenClaw is Ridiculous
Link
@kala shared a link, 4 months, 2 weeks ago
FAUN.dev()

Building a TUI is easy now

Hatchet usedClaude Code, a terminal-native coding agent, to build and ship a real TUI-based workflow manager - fast. Like, days-fast. Powered by theCharm stack(Bubble Tea, Lip Gloss, Huh), it leans hard into CLI-heavy development. Claude Code handled live testing intmux, whipped up frontend views fr.. read more  

Building a TUI is easy now
Link
@kala shared a link, 4 months, 2 weeks ago
FAUN.dev()

GPT-5.2 derives a new result in theoretical physics

GPT-5.2 Pro spotted something wild: a nonzero gluon scattering amplitude in the half-collinear regime. That’s supposed to vanish, according to standard QFT gospel. Not anymore. OpenAI’s own model backed it up with a formal proof. Humans triple-checked it analytically. And yep - it holds. Now it’s bl.. read more  

GPT-5.2 derives a new result in theoretical physics
Link
@devopslinks shared a link, 4 months, 2 weeks ago
FAUN.dev()

Owning a $5M data center

Comma.ai just dropped the specs on its hand-rolled ML data center. Picture this: 600 homegrown GPU rigs (TinyBox Pros), 4PB of flash. The whole thing trains on a PyTorch stack they built themselves, wired up with a custom model tracker and job scheduler they namedMiniray. Inference runs through dyna.. read more  

Owning a $5M data center
Link
@devopslinks shared a link, 4 months, 2 weeks ago
FAUN.dev()

The future of software engineering is SRE

Agentic coding and no-code tools are everywhere now. Building features? Easier than ever. The harder part is keeping systems solid once they’re out in the wild. The real game:maintainability, reliability, and evolutionunder real pressure - not just building, but keeping it together over time... read more  

The future of software engineering is SRE
Link
@devopslinks shared a link, 4 months, 2 weeks ago
FAUN.dev()

Why does SSH send 100 packets per keystroke? ¡

The default macOS SSH client now floods connections withSSH2_MSG_PING “chaff” packets- a 2023 privacy tweak meant to hide keystroke timing. Nice in theory. In practice? It tanks performance for real-time terminal apps like games built on Bubbletea over SSH. Turning it off - either through client fla.. read more  

Why does SSH send 100 packets per keystroke? ¡
Link
@devopslinks shared a link, 4 months, 2 weeks ago
FAUN.dev()

From Paging to Postmortem: Google Cloud SREs on Using Gemini CLI for Outage Response

Google Cloud SREs just leveled up their incident response game with theGemini CLI- an LLM-fueled terminal sidekick built onGemini 3. It jumps in fast: drafts mitigation playbooks, digs into root causes, and cranks out postmortem reports. All withhuman-in-the-loopguardrails to keep things sane... read more  

From Paging to Postmortem: Google Cloud SREs on Using Gemini CLI for Outage Response
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.