colek42
colek42 on Hacker News
This is the wrong way to look at the problem. Maybe they should have asked, "Why does our process need to do so many git checkouts?" Why can't you just run the tests where you already checked out the code?
Thank you. Agree, that was not the intention
Using CI as a gate does not scale. We really think you need to push that testing to the local system and use something like pushgate.dev to validate that the agents actually ran the tests and generated provenance.
We kept pushing to GitHub. Pushgate.dev is a gitproxy. It forces your agents to run tests and validates them. We keep the happy path as fast as possible and use Cloudflare's infrastructure for high resilience. Full disclosure: I am the founder of TestifySec; Pushgate is a new product.
Thanks! Early days of pushgate.dev -- Reach out if interested; email in my profile
We are working on something here, pushgate.dev. It forces the agent to run tests; we are also working on adding support for static analysis of bundles using Jev. Onboarding is a bit of a mess right now, but send me a message
[email protected] if you are interested.
CI needs to be decentralized, and the agents should run the test and verify the proof. This avoids all those API calls.
I'm working on something that removes CI completely and lets your agents certify their own tests. It is pretty rough right now but I'd love feedback -- pushgate.dev
I really wish they would support SPIFFE/SPIRE
Posted by
colek42 on Tuesday June 30, 2026 @12:50AM
from the show-hn dept.
https://cilock.dev/
I helped create Witness, donated it to the CNCF/in-toto ecosystem, and worked on the NIST 800-204D "pipeline observer" guidance. CI/Lock is the next version of that work, and it's under the Apache 2.0 license.Here's the gap it closes. In March, two supply-chain attacks hit within a week of each other. Someone force-pushed 75 of 76 version tags in aquasecurity/trivy-action, so every pipeline...
Posted by
colek42 on Tuesday June 09, 2026 @01:02PM
from the show-hn dept.
In 2016 I was working for an organization that wanted a video streaming web app, but could not tolerate any latency. In the past, we solved this with an NAPI extension in Firefox. They removed this for good security reasons, but it left our users without an option. They would have to move to an electron app. Distributing this app and updating it across 1000s of terminals worldwide was not something we were set up to do. I hacked together something like this and could not believe how well it worked. The initial POC is here:
https://github.com/colek42/streamingDemo.
There are ways to do it. Send me a message, and I can make an intro to the person we use.
We built
https://aflock.ai/ (open source) to help with this. Constraining activity tends to work well
DSSE is great for this, if you need more schema use in-toto
We started a "science project" taking concepts from Multi Level Security to constraining AI agents.
https://aflock.ai/. The idea is to have different data zones, and if an Agent accesses from a private zone, they should not be able to interact with the public zone.
Where is your line, copy editing, drafting, reorganizing? You are going to have a busy, boring, and angry life if you want to comment on every post that has signs AI touched it.
My job is to communicate quickly and clearly, AI helps me do my job faster and more efficiently. But thanks for telling me how I should do my job. You come off as both ignorant and arrogant.
That is quite an ignorant statement to make. I spent three years in combat, and am permanently disabled from my service.
Posted by
colek42 on Saturday February 28, 2026 @11:30AM
from the self-post dept.
I served 12 years infantry, then built targeting tools at JSOC vs ISIS. Now I lead a team building AI tools automating the compliance process. I’ve got opinions on Anthropic + DoDWhen people argue about “AI in weapons” like it’s a sci-fi trigger bot… I can’t take it seriously.A “kill chain” isn’t a vibe. It’s a processFind, Fix, Track, Target, Engage, Assess (F2T2EA) and most of it is...
Bingo, DoD does not want Anthropic to set guardrails on the technology it buys. If they don't want to abide they are free to deny service. We all know how that will turn our for them with the current administration. All while the DoD will just move to another provider that WILL abide. The only power really lies in whatever our elected officials want to do. Take the responsibility seriously.
The voters and congress tell the military how to use technology, not Anthropic. Shifting the decision to Anthropic takes away power from the citizenship.
Edit: The point is, go vote if you don't agree with what the administration is doing. Somebody will sell the DoD whatever they want no matter what Anthropic does.
When I saw the tj-actions attack, I decided it was time to finally implement action wrapping with our `witness-run-action`. This will generate signed attestations on exactly what the actions are doing.
We have some more testing to do before we cut an official release, but it is working correctly for the limited cases we have tested it with. I'd love this group's feedback.
https://github.com/testifysec/witness-run-action/tree/v1.0.1...
Posted by
colek42 on Sunday November 24, 2024 @12:45PM
from the productgovernance.substack.com dept.
Posted by
colek42 on Wednesday November 20, 2024 @01:11PM
from the productgovernance.substack.com dept.
Posted by
colek42 on Monday November 11, 2024 @11:06PM
from the substack.com dept.
I've been thinking about this a lot. First, the author should replace security with compliance. Currently they are two different things. There is a huge divide between compliance teams and developers, they speak completely different languages. I'm writing an entire series about it. I do think we can fix the problem, but it is going to be a lot more work than it was to get development and operations on the same page.
https://productgovernance.substack.com/publish/posts/detail/...
Posted by
colek42 on Tuesday November 05, 2024 @02:19PM
from the productgovernance.substack.com dept.