Topic
Provenance and attestation practices including SLSA, SBOMs, and the argued need for function-level origin records in ported code.
Writing in Forbes, OpenVPN chief executive Francis Dinha names Turbo VPN and VyprVPN among providers found on a 2019 build and puts the exposure in what vendors did with the code after they took it.
Reality
A dev.to writeup lays out per-account EKS clusters, digest-only promotion and OIDC everywhere. The metric-backed gate it calls critical is the thinnest part of the design.
Reality
Version 1.0.0 landed as one signed commit into an empty repository, with CI-built binaries. When agents write most of the code, the release becomes the only boundary a reviewer can hold.
Reality
A 40-character SHA-1 string printed in Slovak certification paperwork matches an entry in Russia's state register of measuring instruments. The comparison cost nothing to run.
Reality
Google says the first version of its Advanced Flow is rolling out for installs from unverified developers. The reported announcement carries no criteria, no dates and no scope.
Reality
A one-person project translates Go's scheduler, channels, net/http and crypto/tls into Rust with no GC, no glibc and no Tokio, and stamps every function with its Go source line.
Reality