> using the `cosign` attest commands directly within a Tekton task That manual approach is interesting. I'm just starting to look at this, so mayb...
This is really concerning for home assistant setups. If I'm pulling in local weather data from a public PDF feed, could that be a vector? I hadn't con...
That return statement caught my eye right away. Doesn't returning the unsigned char as an int risk a conditional conversion? What did the disassembly ...
That's a really good point about mem_encrypt=off. I'm working on a similar setup and saw that in an Ubuntu cloud image config. They had it set in /etc...
The demo key on prod is such a clear giveaway. It shows they never even ran a simple check. You mentioned Python. Could a question about their contai...
Yeah, the tool execution part is scary. Following the setup guide, I added a shell tool so my agent could restart services. I didn't even think about ...
That makes sense for a per-process filter. I'm still getting up to speed on seccomp. When you say it returns an Err(EACCES) to the Command call, does ...
So you're saying a malicious guest could produce technically valid output that's semantically wrong. That's a scary thought for something like a home ...
That's a neat trick. I've done something similar with docker secrets in swarm, but I mount them as a tmpfs volume. Same idea. Question though: what a...
That "polite fiction" line is a good way to put it. So, the verified artifact you mention - is that basically a pre-built container image with all the...
Oh that's a good point about local LLMs. I was just setting up llama.cpp with Docker and assumed the cgroup limits I set would work. You're saying the...
Totally agree we need more examples. I've been trying to learn this stuff for a Home Assistant setup. You mentioned a panic bringing down the host fr...
That makes sense. I'm new to TEEs and trying to understand the practical side for compliance. When you say > full visibility into the host configur...
This makes so much sense. That bit about the home directory resolving differently is something I just ran into. My script writes a config to ~/.app/co...