Most in-depth SunBurst analysis we've seen so far: blog.reversinglabs.com/blog/… Build systems and code singing are primary targets for suply chain attacks, allowing hackers to "evade millions of dollars of security investment" at their eventual targets. 1/4

When autocorrect feels the need to remind you that you're German ;-)

Problem: policy mgmt is designed for enterprises, but b/c of huge share of @nuget projects, requires OSS prj buy-in. SignPath.io aims to turn this around by offering real trust to OSS: signature connects the binary to the source repo, not just sbdy's reputation.

We're not quite ready to make the big announcement... but getting there. Condition is using a supported CI service (currently AppVeyor. Azure Pipelines is... in our pipeline). Please DM me @stefan_wenig or @paul_savoie for early access.

Let's get all that great OSS code signed, shall we?

Thanks for working with us! We strongly believe that all delivered OSS software must be signed, and signatures must be meaningful. We're getting there!

Well, thanks to you! We're almost at the point where we can scale free OSS signing beyond a few handpicked projects. You guys have been super helpful with this!