Santiago Torres-Arias
where else to find them
website:https://badhomb.re
github:SantiagoTorres
linkedin:santiago-torres-arias-477a517b
devto:santiagotorres
what they talk about
where they keep going back
- KubeCon + CloudNativeCon North America2 editions2019–2022
all 8 in the filters
on a stage with
all 15 in the filters
who talks about the same things
- John Kjell16 talks
- Dan Lorenc21 talks
- Aditya Sirish A Yelgundhalli9 talks
- Justin Cappos23 talks
- Michael Lieberman36 talks
- Asra Ali7 talks
| title | conference | date |
|---|---|---|
| An Industry Interview Study of Software Signing for Supply Chain Security | USENIX Security '25 | 2025-08-13 |
Eighteen semi‑structured interviews across 13 organizations produce a refined software factory model that maps where signatures are created versus where they… | ||
| Open Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate | KubeCon + CloudNativeCon Europe 2025 | 2025-04-01 |
Claims that the ecosystem already hosts 828,000 malicious components and that attackers publish about 18,000 new packages per week (mostly npm, then Python)… | ||
| Lightning Talk: Software Dark Matter is the Enemy of Software Transparency | CloudNativeSecurityCon North America 2023 | 2023-02-01 |
Claims that untracked files — called software dark matter — make SBOMs incomplete and reduce scanner utility. Uses the static analysis tool Trevi and a… | ||
| Closing + Community Awards | SigstoreCon North America 2022 | 2022-10-25 |
GitHub issues collect nominations, people vote with emojis, and the TSC picks winners across categories; winners include Best user adopter (GitHub generators… | ||
| Welcome + Opening Remarks | SigstoreCon North America 2022 | 2022-10-25 |
Conference opens by announcing General availability for Sigstore with specific promises: heading 1.0 for recore and fusio, a public-good instance SLA of 99.5%… | ||
| Achieving End-To-End Software Supply Chain Security With in-toto | KubeCon + CloudNativeCon North America 2022 | 2022-10-24 |
Claims that in-toto provides end-to-end provenance that ties Git commits, PR reviews, tags, builds and OCI images into verifiable artifacts; implementations… | ||
| State of the Art Supply Chain Security | SupplyChainSecurityCon North America 2021 | 2021-10-11 |
Claim: a transparent, compromise‑resilient supply chain is practical today. Implementation stitches in-toto, TUF, and SigStore (cosign/fulcio/rekor) into CI/CD… | ||
| Software Supply Chain Security | Continuous Delivery Summit 2019 - San Diego | 2019-11-18 |
Industry effort defines a concrete pipeline: producers publish artifact metadata into repositories, consumers enforce policies that check identities, hashes… | ||
| Securing the Software Supply Chain with in-toto | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
in-toto provides an explicit supply-chain model that declares steps, participants and accepted inputs then records what actually happens using layout and link… | ||
| Using TUF and in-toto to Tighten the Release Process. | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
Describes a concrete pipeline hardening: use TUF to enforce root / targets / snapshot / timestamp roles with separated keys, threshold signing and built-in… | ||
| On Omitting Commits and Committing Omissions: Preventing Git Metadata... | USENIX Security '16 | 2016-08-10 |
Catalogs seven metadata-manipulation attacks and demonstrates how tampering with Git reference files enables subtle exploits like teleport attack and rollback… | ||
| nothing matches | ||