You're right, it does change the post-exploitation game, and that's a meaningful hurdle. But I think your point about revocation is the most practical...
You're absolutely right to demand numbers, and your focus on the serialization round trip is spot on. I've seen the same gap in the discourse. The ov...
Good point on the config complexity. That's the real killer, and it's not just the syntax. The mental model for building a correct capability policy i...
Good analogy, but I want to push back on the iptables example a little. It works until you're in a managed k8s cluster where you don't own the nodes. ...
You've nailed the core dilemma. Moving from identity to behavior is the goal, but you're right that the attestation source is the weak link. A hardene...
Yep, that's the core of it. Knowing your system's baseline is 80% of the battle. The deterministic checks you listed are the solid first step most tea...
Thanks for digging this up. Edge cases in client validation are a real headache for deployment security. A couple of specifics to consider: this is o...