puerco

etcd has published a high-priority security update: etcd.io/blog/2026/oc... Yes, this #PatchRelease Friday is brutal today, thanks to eMudhra and PHP, as well as less-covered golang and Node.js fixes. #kubernetes #security #etcd

Incredible

Great to see @ostifofficial.bsky.social mentioned as part of @thephpf.bsky.social hardening efforts 🤗 thephp.foundation/blog/2026/10...

Mexico’s fight for independence is the triumph of a people determined to shape their own future. Today, I was proud to be the first New York City Mayor to march in Sunset Park’s Mexican Independence Day Parade alongside a community that has fostered cultural pride across generations.

The sun is out, making it a really nice day. Naturally Kleo decided to come out and say hi to everybody 🤗

I had a lot of fun building some cool, futuristic stuff with Marina to achieve builds with attested hermeticity.

SLSA says builds should run isolated. Can you prove yours did? Aug 19, 11am ET: Marina Moore & @puerco.mx show how to verify hermetic builds: cryptographic proof, full SBOM coverage, provenance to the exact VM that ran it. Powered by Cocoon in Edera Protect zones. edera.link/vev-820

Excited to see that NYU Tandon is starting a new program to teach students about supply chain security and to help bridge the existing gaps. This is the area where most of the incidents have occured in the past and will in the future. engineering.nyu.edu/news/nyu-tan...

We have just released Protobom v0.6.0 with full support for SPDX 3.0.1 🥳 This release also includes important bug fixes and improvements to the graph API. Protobom is @openssf.org's universal library for SBOM I/O that serves as the format-neutral foundation of many SBOM tools.

Kubernetes v1.37: Garhwal-

Its that time of the year again 😮‍💨 (kidding, much love @golangci-lint.run 💙)

Hi, community friends! Did you know the #Kubernetes Steering election is running for the next six weeks? 💻🗳️ If your GitHub handle appears in github.com/kubernetes/c... (or if it should!), please take a look at elections.k8s.io/app/election... and vote to select the newest members of #K8s Steering!

I wasn't expecting to spend my day writing google apps scripts but here we are :/

We have a ton of new cool stuff ready to show in Prague! Join us for @openssf.org community day, the highlight of Open Source Summit 🪿

Bus factor is a pain in the (open source) butt.

And you thought the simulation was already malfunctioning? The matrix is about to implode.

I'm joining Jenn Gile and Paul McCarty on The @opensourcemalware.bsky.social Show to talk about securing Open VSX and the Eclipse Foundation! 🗓️ Thu, July 9, 2:35pm PST LinkedIn event: www.linkedin.com/events/74785... YouTube livestream: youtube.com/live/l3YE9Yi...

“We’re all trying to find the guy who did this” - ChatGPT

oh no, my little coworker here just learned how to sneak in the kitchen to steal the avocados 🥑🐶

This is great to hear !

I regularly have people ask me about Mythos these days, so here are my thoughts: Finding bugs is never the hard part. Fixing them is. How’s your organizational alignment? Are your engineers burned out? How is your production resilience? Before you worry about the new shiny, focus on your basics

Open Source Summit, here we gooooo 🇲🇽MEX ⮕ 🇺🇸ORD ⮕ 🇺🇸MSP I'm incredibly excited to be back in Minneapolis and getting a couple of days to enjoyb the city, the world owes so much to Minnesotans 👊

Can't have a conflict of interest if you don't have interests!

Yaaa🤘🤘🤘🤘

Oh what fun with case insensitive filesystems and git.

Fixed this :)

Ok French friends. No. Just don't. Corn tortillas have a purpose. Wheat tortillas have a purpose.

Good bye ingress-nginx #KubeCon

LONG LIVE INGRESS NGINX 🪦 @strongjz.bsky.social archiving ingress nginx live on the #KubeConEU stage with @youngnick.net and other gateway API maintainers 👑 #KubeCon #CloudNativeCon

It’s done. #KubeCon

Found @strongjz.bsky.social looking at ingress-nginx. #KubeCon

This 👇

Reminder: if your community does not have an enforced code of conduct, it becomes possible to subvert it to attack or ostracise individuals and spread a whole lot of ugly that marginalised people will run screaming away from.

Rejekts, let's goooooo 🚀

TinyGo 0.40 is out with many improvements to close out the year. Plenty of bugfixes and stability enhancements to make your life better and easier. New updates to the GC that are up to 10% faster! New boards! Go get it right now! github.com/tinygo-org/t... #tinygo #golang

Sorry for the hiccup with our tag in the previous post! Our thanks again to @ostifofficial.bsky.social for their help with this important audit, which you can again read about in our blog post: blog.thunderbird.net/2025/12/thun...

🎉 10 years of open source Swift! A decade ago today, we opened Swift to the world with a simple blog post: swift.org/blog/welcome What's grown since—thanks to an incredible community of contributors—has been extraordinary. Here's to the next ten years. 🧡

apk-tools 3.0.0 final is out

🌟 New OpenSSF Project Spotlight 💃 In this interview, SLSA Steering Committee member Tom Hennen (Google) breaks down how SLSA is helping organizations strengthen trust across the software supply chain. Watch the full Project Spotlight: 🔗 www.youtube.com/watch?v=gdYl... #OpenSSF #SLSA #OSSSecurity

The only thing that beats having some of your best friends at home for dinner is when one of them is a friggin cocktail master. México City SIG Release dinner with @veronicalg.bsky.social and @cpanato.dev .

Back from #KubeCon with a replenished heart from seeing so many good friends IRL again. I feel so grateful for all the support from folks around the @carabiner.dev projects. I think our supply chain security ecosystem is about to crack a very important milestone in usability as we advance together!

Obligatory yearly notice: This #KubeCon would be so much better if @parisinbmore.bsky.social was here 🥲 #missyou

@puerco.mx kicking off Open Source SecurityCon by demonstrating how to prevent cats messing with your training data.

Headed to Atlanta with @staceypotter.bsky.social for the most epic keynote ever on Tuesday. You don't want to miss it, it's going to be action-packed 💥 (and yes 🫲🏽🫲🏽🫲🏽)

As if there wasn't enough to do already, next week I will present on the role @protobom.dev plays in making SBOMit's verifiable SBOMs consumable. See you there!

⚞NEW⚟ “Trailblazing Python Security” dedicated talk track coming for #PyConUS 🛡️ 🐍🔥 We are looking for sponsors interested in supporting security in the Python ecosystem: pycon.blogspot.com/2025/10/pyco... bsky.app/profile/pyco... #python #opensource #oss #security #supplychain

Wow this is a match made in heaven 🤩