I do security work at GitHub (before that, Duo) and before that I was a co-founder at Olark.
I also maintain a2docs and BBTXL.
Sigstore & Post-Quantum Cryptography (2025) [Sigstore Blog]
How Sigstore is approaching the transition to post-quantum cryptographic algorithms, balancing unblocking experimentation with ongoing algorithm selection and implementation.
Verifying Sigstore Bundles as an End User [Sigstore Blog]
When verifying a Sigstore bundle you should know what instance it came from (public or private), what identities you trust, and which identity providers you trust to supply those identities.
Sidebar: P2P Video and File Sharing in the Browser
Sidebar lets you have video meetings and secure file sharing in your browser, directly between peers without having data pass through a central server.
What's in the SOSS: OpenSSF Mission, Vision, Strategy, and Roadmap [OpenSSF Podcast]
OpenSSF "What's in the SOSS?" podcast episode with Arun Gupta (Intel / OpenSSF Governing Board Chair) and I about the Mission, Vision, Strategy, and Roadmap for the OpenSSF and what we're particularly excited about for 2025.
What's in the SOSS: Dig Into Package Repository Security [OpenSSF Podcast]
OpenSSF "What's in the SOSS?" podcast episode with Jack Cable from CISA and I about the Principles for Package Repository Security and the Securing Software Repositories Working Group.
Sigstore Cosign: Keeping Up with the Client Libraries
Presentation at SigstoreCon about work we're doing to keep cosign interoperable with client libraries and things like npm provenance, Homebrew attestations, and PyPI attestations.
Lessons Learned: Scaling Out Securing Open Source
Presentation at Microsoft BlueHat on how the OpenSSF Securing Software Repositories Working Group assisted in developing security capabilties across PyPI, Homebrew, NuGet and Rust Crates.
The second half of software supply chain security on GitHub [GitHub Blog]
What the US public sector has been saying about the second half of supply chain security, and how GitHub can help you protect the integrity of the software you build.
cosign Verification of npm Provenance, GitHub Artifact Attestations, and Homebrew Provenance [Sigstore Blog]
How to use cosign with new deployments of Sigstore where signed material is stored in the bundle format.
How to Make Programming Language Package Repositories More Secure [OpenSSF Blog]
How the OpenSSF Securing Repositories Working Group supports varied package repositories through security roadmaps, publishing implementation guidance of specific capabilities, and inventorying funding sources.
Public Sector + OpenSSF: Principles for Package Repository Security
An Open Source Summit North America talk with Jack Cable on releasing v0.1 of the Principles for Package Repository Security, to help open source package repositories with roadmaps and to reference in their applications for funding.
Releasing Principles for Package Repository Security [OpenSSF Blog]
Announcing the v0.1 release of Principles for Package Repository Security, a collaboration between the OpenSSF Securing Software Repositories Working Group and the Cybersecurity and Infrastructure Security Agency (CISA).
Using Go's built-in compiler and linker tooling, along with a Python helper script, to find out which dependencies add the most size to the resulting binary.
Advanced Security Capabilities All Package Managers Should Have
Talk given at Google Open Source Ecosystem Security Roundtable
npm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem
Talk given at Black Hat 2023 with Trevor Rosen
Build Provenance for all Package Registries [OpenSSF Securing Software Repositories Working Group]
Guidance for package registries in adopting build provenance to verifiably link a package back to its source code and build instructions.
Bringing Provenance to All of Open Source: Lessons from npm's Sigstore Integration [Supply Chain Security Con]
Bringing non-falsifiable links between packages on npm and their source code and build instructions.
Security Considerations with Fulcio and OIDC JWTs
Things to keep in mind when using OIDC tokens with Sigstore's Fulcio.
Why we're excited about the Sigstore general availability [GitHub Blog]
The Sigstore GA means you can protect your software supply chain today with GitHub Actions, and will power new npm security capabilities in the near future.
Unlocking Cloud Build Security with OIDC
Using OIDC to make building in cloud CI/CD safer.
Connecting to a Private Network from GitHub-hosted Actions Runners [GitHub Blog]
Several ways for GitHub-hosted Actions runners to connect to resources on your private network.
How to Secure Your End-to-End Supply Chain [GitHub Blog]
Securing your projects is no easy task, but end-to-end supply chain security is more top of mind than ever.
Azure Security Roadmap
What do you do when you're handed a pile of new-to-you Azure accounts to secure?