Rejekts, let's goooooo 🚀

TinyGo 0.40 is out with many improvements to close out the year. Plenty of bugfixes and stability enhancements to make your life better and easier. New updates to the GC that are up to 10% faster! New boards! Go get it right now! github.com/tinygo-org/t... #tinygo #golang

Sorry for the hiccup with our tag in the previous post! Our thanks again to @ostifofficial.bsky.social for their help with this important audit, which you can again read about in our blog post: blog.thunderbird.net/2025/12/thun...

🎉 10 years of open source Swift! A decade ago today, we opened Swift to the world with a simple blog post: swift.org/blog/welcome What's grown since—thanks to an incredible community of contributors—has been extraordinary. Here's to the next ten years. 🧡

apk-tools 3.0.0 final is out

🌟 New OpenSSF Project Spotlight 💃 In this interview, SLSA Steering Committee member Tom Hennen (Google) breaks down how SLSA is helping organizations strengthen trust across the software supply chain. Watch the full Project Spotlight: 🔗 www.youtube.com/watch?v=gdYl... #OpenSSF #SLSA #OSSSecurity

The only thing that beats having some of your best friends at home for dinner is when one of them is a friggin cocktail master. México City SIG Release dinner with @veronicalg.bsky.social and @cpanato.dev .

Back from #KubeCon with a replenished heart from seeing so many good friends IRL again. I feel so grateful for all the support from folks around the @carabiner.dev projects. I think our supply chain security ecosystem is about to crack a very important milestone in usability as we advance together!

Obligatory yearly notice: This #KubeCon would be so much better if @parisinbmore.bsky.social was here 🥲 #missyou

@puerco.mx kicking off Open Source SecurityCon by demonstrating how to prevent cats messing with your training data.

Headed to Atlanta with @staceypotter.bsky.social for the most epic keynote ever on Tuesday. You don't want to miss it, it's going to be action-packed 💥 (and yes 🫲🏽🫲🏽🫲🏽)

As if there wasn't enough to do already, next week I will present on the role @protobom.dev plays in making SBOMit's verifiable SBOMs consumable. See you there!

⚞NEW⚟ “Trailblazing Python Security” dedicated talk track coming for #PyConUS 🛡️ 🐍🔥 We are looking for sponsors interested in supporting security in the Python ecosystem: pycon.blogspot.com/2025/10/pyco... bsky.app/profile/pyco... #python #opensource #oss #security #supplychain

Wow this is a match made in heaven 🤩

Check out this new example we published in the SLSA blog, it turned out really cool!

We've published a new 🔴🟡🟢 AMPEL case study on the SLSA Blog!

Spotted a dead snake on today's run 🐍

I am very proud of this release. Among other improvements, we now support evidence chains in PolicySets. This lets AMPEL synthesize verification subjects from attested data. For example, you can now apply a policy to all the dependencies extracted from an SBOM, the demo below shows how.

Give me a bolillo 🥖💩😱

Piggy

v0.2.0 of our signer library is out! This release ships with full support for DSSE signing and verification. github.com/carabiner-de...

I recorded a short video demoing this release if you'd like to see how it works :) youtu.be/RDmsAhD3znk

Menacing containers. Evem while bike touring.

It's impossible to describe what an IPA feels like after 84 km on the loaded bike. Pure heaven 🤤

Last big code reorg PR ahead of next week's release!

In spite of all, still one of the best runs 🏃🏽‍♂️

At the very edge of Latin America.

OK, so Japan it is 🇯🇵

A Discord server and new GitHub organization for zizmor https://blog.yossarian.net/2025/05/07/zizmor-discord-server-github-org #security #oss #devblog #programming #rust #zizmor

The term 'rune' for a Unicode code point was coined by Ken Thompson during a discussion we had to find a concise name to supplement 'char' for bytes. The Plan 9 C source files /sys/src/libc/port/*rune* appeared in the daily backup on Dec 9, 1991, so the name was coined on the evening of the 8th.

What's wrong babe? It's #MayThe4th an you've barely touched your Jabbacado toast.

if you love debugging, may I recommend purchasing a home?

Open Source Zeitgeist: The cloud-native messaging edition. youtu.be/MXcxWsdjYHA

I'm totally building a Warhol-style wall of silkscreens from these 😂

Attention vulnerability management nerds! If you are at #Kubecon in London, come hear how @kubernetes.io Release Engineering and SIG Security are building the K8s VEX feed. We'll show off slick new tools coming out to manage @openssf.org OpenVEX to help VEXing your CRA woes✌🏽 (17:30 in L1/S10/C)

@golangci-lint.run v2 is awesome, well worth the upgrade 🏆 I just read this post and you should too :)

🚨Kubernetes Security Advisory🚨 You wanna patch this critical ingress-nginx vuln right meow, even though it’s late in the day. Check it out! kubernetes.io/blog/2025/03...

It looks like we'll need like a month's worth of work to update all the golangci-lint configuration files everywhere @cpanato.dev :lolsob:

Also, remember that @pearljam.com gave the world: 🐪::Perl 💩 - yaml

This week in things we didn't know before: Human brains can turn into glass when enough heat is applied. www.bbc.com/news/article...

Remember, Google Maps are country specific In Pakistan it shows Kashmir as Pakistani, in India as Indian And in America it shows Gulf of Mexico as Gulf of America, but not elsewhere In fact in México it shows as “Gulfo del Idiota”

That's a wrap #Fosdem! 👋old friends & new @puerco.mx @daniel.haxx.se

Kubernetes Release Managers doing shady stuff CAUGHT!

Still my favourite vim meme

After a long break from public speaking, I'm going back to FOSDEM to talk about Quantum Computing -including security & OSS- 💗 Those who know me, know this is a topic very close to my heart. I'm very excited and I hope to see you there✨ fosdem.org/2025/schedul...

Spent the day fighting XML-DSig. AMA.

In 5 or less words start a fight not about religion or politics. Tabs or spaces, I don't really give a shit. Go.

#FOSDEM2025 so excited to see yall in Brussels!! roll call? Saturday: i’ll be in scooting btwn main+community in the AM, then hosting the #swiftlang devroom in the K building in the afternoon!! Hopefully i’ll make it out to the after party but I might be asleep 😂 fosdem.org/2025/schedul...

The next in my #Kubernetes #Security fundamentals video series is up now. This time I'm looking at how service account authentication works in Kubernetes, with some hopefully interesting details on how bound service account tokens work. youtu.be/jTswj4CS4IA?...