ENOSUCHBLOG

TL;DR: I’ve turned my April post on Brocards for vulnerability triage into a more permanent website.

TL;DR: I’m announcing my candidacy for the inaugural Python Packaging Council.

TL;DR: GitHub Actions should allow end-users to express audience constraints, to make it harder for an attacker to pivot across services that use independent OIDC-bearing jobs.

(Thanks to Facundo Tuesca for the name inspiration).

…because Trusted Publishing isn’t for you (or me) to trust!

Mini-post.

See vulnbrocards.com for a more permanent and maintained list of vulnerability brocards.

I noticed this a year or two ago, but forgot to write it up back then.

See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.

See cooldowns.dev for up-to-date information on cooldown adoption across various languages and package ecosystems.