Secret Management

Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.

The shared buffer behind cut, copy, and paste, invented at Xerox PARC, which offers data in several formats at once and has become a channel for snooping and for commands that paste differently from how they looked.

Cryptographically attesting who produced a binary, and the operating-system checks built on it.

Packaging an application with its dependencies into an isolated, reproducible runtime unit.

Automatically releasing every change that passes validation.

A snapshot of a crashed program's memory saved for later inspection, how to get one, how to read one, and why it can leak secrets.

Time-based scheduling of recurring jobs, and the reasons scheduled jobs quietly stop working.

A substituted value that papers over a missing input and hides the misconfiguration that produced it.

The distributed directory translating names to addresses, and the layer where propagation delays live.

A tracked repository of personal configuration, making a machine setup reproducible.

A named value in a process's environment, inherited by its children — the standard configuration channel.

A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.

Crash at the point of misconfiguration rather than degrading quietly into a wrong state.

The Unix scheme of read, write, and execute rights for a file's owner, group, and everyone else, and the extensions that patch its gaps.

Scripts Git runs automatically at points such as committing or pushing, used to check formatting and messages locally, and on servers to enforce policy or trigger deploys.

The file of patterns telling Git which files to leave untracked, such as build output, dependencies, editor clutter, and local secrets, along with the traps of files that were already tracked and secrets already committed.

A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.

A system that runs containers across a cluster of machines by continually reconciling what is running with a declared desired state, powerful and notoriously complex.

Granting only the permissions actually required, so a compromise has a small ceiling.

Recording timestamped events from a running program so people can reconstruct what happened, and how structured logs, levels, and aggregation make them useful at scale.

The tool that resolves, fetches, and installs dependencies, and pins them for reproducibility.

Untrusted content that reaches a model's context and is treated as instruction.

The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.

The encrypted protocol for logging into and running commands on remote machines, authenticated by key pairs, that also tunnels other traffic and underpins Git.

A version-numbering convention where the number communicates the kind of change.

Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.

Protecting against compromise arriving through the code and tooling a project depends on.

A file that points at another path, resolved transparently by most operations.

An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.

A convention placing configuration, data, cache, and state in defined directories rather than the home directory.