having audited tons of high risk orgs, and being on calls with companies daily, i always find it shocking at the level of security maintained internally vs the level of security companies communicate externally. most companies still run their security programs in a negligent manner, and worse yet don’t actually care about security. the most important goal for them is to appear secure. expert security theatre, and this is part of what motivates me to bring new levels of transparency to how software systems are built

can you mail me a bit of whatever you’re smoking?

would love to hear more of your thoughts around why / which part

ah you’re one of those haha

tee.fail is a great resource, but people often misinterpret it. most of the attacks are side channels or implementation bugs, not “tees don’t work.” compared to a regular server, a tee is still a massive security improvement

who here knows about TEEs. trying to see something

you might find stagex useful on the supply chain security side: https://stagex.tools. happy to answer any questions (i’m a core maintainer)

what’s new on nostr? heard some buzz about a nice new piece of software 🐝