nscur0
nscur0@infosec.exchange
<p>Co-Lead of <span class="h-card" translate="no"><a href="https://infosec.exchange/@DependencyTrack" class="u-url mention">@<span>DependencyTrack</span></a></span>.<br />Maintainer of a bunch of <span class="h-card" translate="no"><a href="https://infosec.exchange/@CycloneDX" class="u-url mention">@<span>CycloneDX</span></a></span> tooling.<br />AppSec, supply chain security, bill of materials opinion-haver.<br />Plant muncher 🌱.</p>
Posts
-
View post
With Error Prone, NullAway, and Spotless, you can get a JVM project quite far to what you'd have in Go with its fantastic linter and formatter ecosystem. Obviously it'd be better if all that would ship with the JDK, but the tooling is mature and works well, and that's all that counts in the end. Error Prone being a compiler plugin means you pay the linting price on every build though. Most other ecosystems separate compilation from linting, which ofc makes builds faster but also l...
-
View post
RE: https://infosec.exchange/@nscur0/117254750212873843 Anyway, the upcoming version of @DependencyTrack@infosec.exchange will support workload identity federation, making long-lived API keys entirely obsolete for deployments where OIDC (e.g. through GitHub Actions) or SPIFFE is available. Long live short-lived credentials! Ergh, I mean...
-
View post
implementing workload identity federation. how hard can it be? i'm sure the token exchange will be super straightforward because IdPs all provide a small set of uniform claims, and it won't be necessary to use an expression language to deal with them, right?
-
View post
Getting really fucking tired of obscenely verbose Claude output being dumped verbatim into GitHub issues. If you can't be arsed to even write a comment yourself, why should I spend time interacting with it?