Matt Moore is a co-founder and CTO of @chainguard.dev. He joins Gregor Vand to discuss AI powered software supply chain threats, CI/CD attacks, software inventories, and machine speed patching. @mattmoor.dev softwareengineeringdaily.com/podcasts/ai-...

AI-Powered Threats to the Software Supply Chain - Software Engineering Daily

Matt Moore is a co-founder and CTO of Chainguard. He joins Gregor Vand to discuss AI powered software supply chain threats, CI/CD attacks, software inventories, and machine speed patching.

softwareengineeringdaily.com

Chainguard's new scanner blocks "greyware" — open source packages that pass every security check but still steal credentials, harvest API keys, and phone home to remote servers.

"Don't just grab random stuff off the internet": What Chainguard found in 52,000 open-source packages

Chainguard's new scanner blocks "greyware" — open source packages that pass every security check but still steal credentials, harvest API keys, and phone home to remote servers.

bit.ly

Anyone who builds software with client side validation should go read about phreaking

By maintaining focus on your existing goals and proven metrics, you can ensure that AI becomes a genuine accelerator of your mission rather than an expensive distraction. By @stevefenton.co.uk

How To Measure AI's Organizational Impact

By maintaining focus on your existing goals and proven metrics, you can ensure that AI becomes a genuine accelerator of your mission rather than an expensive distraction.

bit.ly

LOL they won't listen to me, maybe they'll listen to @mattmoor.dev

Vibe coders must understand that AI is just a productivity tool, and they — not the AI — are ultimately accountable for the code it produces for them. By @mattmoor.dev, thanks to Chainguard

Should Your Team Be Vibe Coding?

Vibe coders must understand that AI is just a productivity tool, and they — not the AI — are ultimately accountable for the code it produces for them.

bit.ly

PSA: attacks on public infrastructure like software package registries are on the rise. Here’s an active one targeting folks who have crates.io accounts.

crates.io: Rust Package Registry

crates.io

Andrew Gallant@burntsushi.net · 12mo ago

FYI, I got an obvious phishing attempt in my inbox from `security@rustfoundation.dev` that was masquerading as a security breach notification. It made it past gmail's spam filters. The link goes to the `github.rustfoundation.dev` domain.

Six months after launching container host VMs, Chainguard is expanding into application and base VM images with zero-CVE guarantees. By @darrylktaft.bsky.social

Why Chainguard Is Doubling Down on Virtual Machines in a Container World

Six months after launching container host VMs, Chainguard is expanding into application and base VM images with zero-CVE guarantees.

bit.ly

Vibe coders must understand that AI is just a productivity tool, and they — not the AI — are ultimately accountable for the code it produces for them. By @mattmoor.dev, thanks to Chainguard

Should Your Team Be Vibe Coding?

Vibe coders must understand that AI is just a productivity tool, and they — not the AI — are ultimately accountable for the code it produces for them.

bit.ly

There’s a difference between genAI not being good and not being able to get good results when using genAI.

For CI reasons (speed), I wrote a FUSE filesystem to act like the $GOMODCACHE directory to make it look like all world's #golang modules are available locally on disk without having to download them. Then the FS downloads them if/as needed, storing them in git trees/blobs (no commits) for de-dup.

Sounds like ko for swift 😁

Joseph Heck@heckj.bsky.social · last yr.

Super cool - Euan’s talk about Swift container plugin is up on youtube: youtu.be/MV0wACpikyw, service to container image uploaded to a registry in one shot #swiftlang #cloudnative

Cool to see AWS notifying customers of misconfigured OIDC trusts which are vulnerable!

Report: 83% Of Americans Just Want To Put On Sunglasses And Say ‘Let’s Do This’ theonion.com/report-...

It costs nothing yet the feeling it generates is priceless when you let people know you appreciate the work they’re putting in.

"Matt Damon famous?" "Well, maybe Ben Affleck famous..."

a man is sitting in a chair with his eyes closed and smiling .

ALT: a man is sitting in a chair with his eyes closed and smiling .

media.tenor.com

Find someone that looks at you the way Biden looks awarding Magic Johnson the medal of freedom.

CNN@cnn.com · 2y ago

President Joe Biden awarded the nation’s highest civilian honor, the Presidential Medal of Freedom, to 19 people on Saturday, recognizing a broad swath of luminaries across politics, culture and the arts: cnn.it/3W0LyKP

Parents Mortified as Kids Turn Elf on the Shelf Into Snitch in the Ditch: bit.ly/4gnERdA

Optimist: head Pessimist: tail Realist: grep

Justin Garrison@justingarrison.com · 2y ago

The three pillars of observability Tail Grep Sed

How do you weigh an elephant? The same way you weight a human, just on a much larger scale.

King Charlie begging for 🦃

PSA: don’t forget to take the giblets out of the neck area.

Google Cloud's most annoying feature is probably that so much relies on GCP load balancers. You need them to do an static https site backed by a bucket, you need them to use IAP with Cloud Run, etc. etc. So many low cost services instantly jump to $30/m because they need an LB.

Someone told me it's the same pattern as cp and mv and I'll never forget command <thing that exists> <thing you want to create>

This is cool. I guess I'm now @mattmoor.dev

Bluesky@bsky.app · 2y ago

💡 Tip: You can set your website as your username on Bluesky! This is one form of self-verification, and we especially encourage official organizations and brands to do this! Examples include @npr.org @react.dev @duolingobrasil.com.br. Here's our guide for how to do this: