in-toto, with Santiago Torres-Arias - a podcast by Adam Glick and Craig Box

When is it safe to run software? When is it safe to drink orange juice? Are we a better judge of one or the other? Santiago Torres-Arias is an Assistant Professor at Purdue University, the team lead of the in-toto project, and a contributor to The Update Framework. He joins Craig to talk security in both physical and software supply chains.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com


• mail: kubernetespodcast@google.com


• twitter: @kubernetespod

Chatter of the week

• Don’t Forget The Lyrics


• Gettin’ Jiggy Wit It


• Explained on Genius


• Will Smith on Top Gear


• The Oscars thing (CW: violence, cuss words that Will Smith didn’t used to have to rap to sell records)


• He’s The Greatest Dancer by Sister Sledge; written by Bernard Edwards and Nile Rodgers of Chic

News of the week

• New Cisco Intersight Kubernetes features


• Red Hat OpenShift v4.10


• ChaosNative acquired by Harness


• Azure PlayFab launches Thundernetes
  
  
  
  • Episode 26, with Cyril Tovena and Mark Mandel
  
  
  • Hacker News commentary
  
  
  
  


• Weave GitOps v2022-03


• Qumulo for Kubernetes


• SpectroCloud raises $40m


• Pinterest: 99% to 99.9% SLO, high performance control plane


• Uber: Avoiding CPU throttling in a containerized environment

Links from the interview

• in-toto


• The Update Framework


• Purdue University
  
  
  
  • Elmore Family School of Electrical and Computer Engineering
  
  
  • Purdue Boilermakers
  
  
  • Open Source Software Senior Design Projects
  
  
  
  


• NYU
  
  
  
  • Tandon School of Engineering
  
  
  • Justin Cappos
  
  
  
  


• PolyPasswordHasher


• Episode 155, with Priya Wadhwa


• apt-secure for Debian packages


• A keysigning and a signed PGP key


• Farm to table attestation


• Potato tracking


• An example of E. coli in lettuce


• in-toto record


• Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supply Chain in the Wake of the Sunburst Hack by Trevor Rosen, Solarwinds


• Reflections on Trusting Trust by Ken Thompson


• Secure Publication of Datadog Agent Integrations with TUF and in-toto


• US Executive Order on Improving the Nation’s Cybersecurity


• Readout of White House Meeting on Software Security


• sigstore
  
  
  
  • in-toto is the second most used format for sigstore
  
  
  
  


• SPIFFE


• SLSA


• in-toto moves to incubation in the CNCF


• CFSSL


• Math rock
  
  
  
  • Covet: “falkor”
  
  
  • TTNG: +3 Awesomeness Repels Water
  
  
  
  


• Bird of the Year
  
  
  
  • The kea
  
  
  • Breaking a police car
  
  
  
  


• Santiago Torres-Arias on Twitter and at badhomb.re

Further episodes of Kubernetes Podcast from Google

Further podcasts by Adam Glick and Craig Box

Website of Adam Glick and Craig Box