I'm very much looking forward to KubeCon Atlanta next week. On Monday, I'll be hosting a panel "Balancing Developer Freedom and Security" with Cat Morris, @marcusforpeace.bsky.social , @alex.zenla.io  (plus A.N. Other guest) as part of Open Source SecurityCon. https://tinyurl.com/23sjsctb 1/3

Pretty sure my kids have worked out a rota system for messing with my sleep.

I've recently been reading an early access version of Refactoring English by @mtlynch.io . I have to say this is a great book, with lots of hard-won tips and advice on how to make your writing more accessible and get it in front of a relevant audience. 

One thing I find pretty remarkable is the fact that models like Whisper for voice-to-text have gotten really good at removing stop words and pauses from speech understanding when you change your inflection to mean putting a word in quotes. It is really remarkable.

The Custom Assembly tooling at @chainguard.dev  just got some nice updates! I recorded a new video showcasing custom assembly including the improved rename/save-as functionality.

The video from my talk  on "Guarding the Supply Chain" at @cloudnativebergen.dev  is out!

If you've visited the @chainguard.dev  Images page recently you might have noticed there's a fun new calculator which estimates how much $$$ you could save by moving to our images and thereby eliminating CVE remediation tasks.

The ATmosphere is now over 40M accounts 🪿🎉🙌

I thought I'd starting posting quotes every Friday as something a little more interesting for the weekend. Hopefully it's not too cringy, but I do have a soft spot for an inspirational quote. We're starting with...

Big thanks to Anthony Hodson for doing a write-up on the recent @kcduk.bsky.social event, with short interviews from @lizrice.com , @hannahfoxwell.net and myself.

A little while back Thomas Strömberg posted (on LinkedIn) about the surprisingly lack of malware detection tooling running on platforms today.

@adrianmouat.com from @chainguard.dev teaching the attendees at #cndb2025 the secrets about Guarding the Supply Chain 🛡️🚀

If you were affected by recent changes to MinIO, check out the @chainguard.dev  MinIO image. We didn't want people to be stuck on an unmaintained image, so we've added the our version to the free tier.

If anyone is at @cloudnativebergen.dev  today, please come catch my talk at 11.45 in Hovedsalen (first floor). I'll be talking all things Supply Chain Security and going through some tools and projects that can help you improve your security posture, especially with containers.

We recently announced the GA release of @chainguard.dev  Libraries for Python. And we're working hard on Java and Node. Why should you be interested? Because you don't want to be impacted by the next Shai Hulud or similar attack.

That's no ballroom

One of my favourite movie quotes: "You, me, or nobody is gonna hit as hard as life. But it ain't about how hard ya hit. It's about how hard you can get hit and keep moving forward. How much you can take and keep moving forward. That's how winning is done!"

Thanks to everyone who came to my @kcduk.bsky.social  talk yesterday. Here's the slides:

A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (45+ scanners)

Speaking in public is a skill like any other, and it absolutely comes with practice. But it does not come naturally to most humans. Public speaking is typically people’s number one fear, even over death. Seinfeld joked that people at a funeral would rather be in the casket than giving the eulogy!

I'm not sure about @randyshoup.bsky.social (who is a great speaker!) but I really had to work at presentations and talks. It didn't come naturally. So don't worry if you're nervous or your first talks aren't amazing. It's something that definitely gets easier with practice!

Now we have @wiggitywhitney.bsky.social telling us how to trust a liar. Or creating a journal application with Claude code and open telemetry.

@mccune.org.uk is next up at @kcduk.bsky.social talking about, err, talks

Day 2 of @kcduk.bsky.social and @lianmakesthings.bsky.social is explaining how platform engineering replaced the DevOps walk of confusion with a canyon of confusion.

@edera.dev discovered an serious vuln in various Rust crates for handling tar files edera.dev/stories/tarm...

Now we have Jake Klein and Chunyi Lyu talking about how Kratix builds on top of GitOps. @kcduk.bsky.social

@stefanprodan.com kicks off track 1 at @kcduk.bsky.social with a talk on GitOps and Flux

@hannahfoxwell.net continues the @kcduk.bsky.social keynotes by telling us how GenAI is redefining software development.

@mt165.co.uk it's talking about trade and geography in Scotland. But he showed a map of Scotland without Shetland. Which is basically a diplomatic incident as far as I'm concerned.

@lizrice.com kicks off @kcduk.bsky.social by telling us about the business of open source software. It's free like a puppy can be free!

I'm hugely excited because this is the first day of the KCDUK Edinburgh edition! It's been a long year getting ready for this moment. I'm really impressed with the line-up we've put together and the venue is looking great as well. I really hope you all enjoy the event.

The recent NPM attacks have shown how fragile our package ecosystem is and how easily attackers can subvert projects. At @chainguard.dev  we just announced our JavaScript libraries project to combat this threat.

For anyone at @cloudnativebergen.dev on the 27/28th , I'll be speaking about supply chain security, the recent NPM attacks and what you can do to protect yourself.

If you're using Java and containers, make sure you check out Jib. It's a really easy way to build containers for Java projects via a Maven or Gradle plugin. The build process is internal, so you don't even need to have Docker installed.

Apparently Dockerfiles are Engineer's *favourite* maintenance task! (Fixing CI/CD pipelines was least favourite). Read this and other great nuggets in @chainguard.dev 's Engineering Reality Report

KCDUK in Edinburgh is next week!

We’re speaking at @kcduk.bsky.social next week! Come say hi! Antonia and Xavier are doing a live demo with a Pi and KubeEdge — Kubernetes at the edge, literally. @salisburyheavyindustries.com talking about migrating a few hundred clusters to Cluster API and what we learned the hard way.

Natalie Somersall recently wrote a blog about how we can trust the provenance Open Source software. It's a thorny question, especially given Git's status; omnipresent but not designed for security and identity verification: https://tinyurl.com/yc6wtuju

I recently found this link to fantastic collection of resources for engineers. Basically the most important books and articles to read if you're serious (or curious!) about software engineering:

We are getting really close to KCDUK in Edinburgh now (under two weeks!).

One of the biggest problems in tech right now is the exploitation of Open Source. At the pointy end of this is are the package repositories like Maven, NPM, PyPI etc -- who are all run as a public good but have found themselves at the heart of supply-chain hacks.

If you're building Java applications into containers, make sure you check out the Jib project. Jib lets you build and push containers directly from maven/gradle, without even needing the Docker daemon to be present.

Calling all Kubernetes security interested folk. We're planning the next version of the OWASP Kubernetes Top 10, and have a survey to solicit ideas and feedback here docs.google.com/forms/d/e/1F... . Shouldn't take more than a couple of minutes to fill out and all feedback's welcome!

If you are impacted by the changes to Bitnami Helm Charts, please check out my new video on migrating to @chainguard.dev  Helm Charts.  I hope this helps some of you! Note that Helm Charts are available to our paid subscribers only. 

You know how squids squirt ink when they feel threatened? My 1 yo seems to feel peeing is the appropriate response to a nappy change.

Here's the slides from my @gotocon.com  Copenhagen talk "Supply Chain Security and the Real World: Lessons from Incidents". I hope you enjoyed it if you caught it earlier today!   

#Japan​’s biggest producer of beer is still not producing any beer this week. #Asahi Group Holdings shut down production Monday after detecting a cyber intruder. And today it’s confirmed fears of #ransomware. In #SBBlogwatch, we dry out. securityboulevard.com/2025/10/japa...

For those of you at GOTO Copenhagen, I'll be speaking at 14.15 in room 2 about what we can and should be learning from recent security incidents.

For those of you at GOTO Copenhagen, I'll be speaking at 14.15 in room 2 about what we can and should be learning from recent security incidents.

If you're at GOTO Copenhagen, I'll be on Sam Newman's Graham Norton style chat show alongside Kief Morris at 15.15 today. It's on the live stage, which is up the spiral stairs at the back (good luck). For those of you not lucky enough to be there, I think it is recorded.