Staff Software Engineer
Welcome to my update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I was at Ruby Kaigi, and gave a talk about Marshal! Ruby Kaigi This was my first Ruby Kaigi, and boy was it quite an experience. Coming right off…
Welcome to my update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I attended RailsConf, and shipped a gem that makes setting up trusted publishing for an existing gem fit into a 5 minute lightning talk. RailsConf…
Welcome to my update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I spent a bunch of time refactoring the Sigstore implementation, and banged my head against timestamping verification, which is mostly implemented…
Welcome to my update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I focused on implementing SCT verification in Sigstore, and made some improvements to the Protobug gem (which is now released!). Sigstore switched…
Welcome to my eleventh update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I attending the Linux Foundation’s Open Source Summit North America 2024, and spent a whole bunch of time talking to my peers about…
Welcome to my thenth update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I fixed some DoS vectors in RubyGems.org. Documentation for the compact index I spent a few hours helping Martin write down some…
Welcome to my ninth update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I dealt with the fallout from the xz/liblzma backdoor. I also took a last minute trip to NY for a funeral, which was honestly more exhausting…
Welcome to my eighth update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. This week I wrapped up the pure-Ruby proto implementation. Plain Ruby Protos I landed a massive PR that basically makes the implementation compliant!…
Welcome to my seventh update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. The past week I was mostly on airplanes and working on sigstore & protobufs. Sigstore Verification What is there to say? TUF Client As I’ve…
Welcome to my sixth update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. Fixing a common source of ONCALL pages As I mentioned last week , I had found that by far our most expensive query was for reverse dependencies of a…
Welcome to my fifth update as Ruby Central’s security engineer in residence, sponsored by AWS . My goal is to write a short update every week, chronicling what I’ve been working on, and reminding myself that I was, in fact, productive. The past two weeks I have been heads-down on a pure-ruby Sigstore implementation, which has a lot of moving parts. I hope to outline some of the…