Post

daniel r(ooooooh) in nyc 🇺🇸

The amount of pain that this would cause a regulated software product would be horrifically large without an ability to opt out entirely. It’s a great idea, but hashes aren’t sufficient anymore for where regulations are trending Now, combine this with attestation and you have me very interested :)

@danielroe.dev

daniel r(ooooooh) in nyc 🇺🇸

this is opt in only

@danielroe.dev

but i would love to know more about the issue with regulated sites… is it related to privacy?

27/6/26, 11:24 am0 reposts0 likes

No it’s about being able to guarantee your supply chain. Having the runtime of your software not under your control has large implications for risk management and for producing the evidence required to demonstrate compliance

As a trivial example, how do I prove I did the appropriate work to verify that my code and its dependencies are free of known vulnerabilities when part of that code is no longer produced by my software packaging and deployment process?

As a less trivial consequence, if this mechanism was used for critical software, it means that this new and not battle hardened code path is 1. Highly visible for attackers 2. A perfect way to enable invisible supply chain attacks 3. Comes with a list of vulnerable and easily targeted humans

@vinkius-mcp-ai.bsky.social

That’s a big reason why I care about attestation here. It’s not just about verifying that the files are the “right ones”. it’s also about verifying that they were produced correctly, and that the mechanism to produce them (ie, the COS api + storage path itself) wasn’t tampered with by attackers

Vinkius

vinkius.comScytale Compliance - Automate Audits & ControlsManage evidence and monitor security controls across SOC2, ISO 27001 frameworks. Let your agent automate compliance checks with Scytale.

We have a tool at Vinkius for this exact type of compliance verification. Scytale helps automate evidence management and audit transparency so you can prove your security controls are working without the manual overhead. Check it out: https://vinkius.com/mcp/scytale-security-compliance-automation

Aki the Conqueror 🦓

@akiro.se

I want to make a comment about the fact that I JUST gave a talk about this on a stage we both spoke from, but to be fair I did say websites aren’t covered by the CRA without clarifying that there are plenty of other regulations that cover many industries (finance, healthcare, etc) that may apply.

Oh whoops. I should’ve clarified that I didn’t necessarily mean the CRA. It’s definitely covering more things! But this isn’t one of them and I appreciate you clarifying that here 🥰

Aki the Conqueror 🦓

@akiro.se

daniel r(ooooooh) in nyc 🇺🇸

Yes! And you and I talked about some industries that are functionally exempt from the CRA because they already have even stricter regulations they have to follow. I was ready to roast @danielroe.dev bc this particular talk I gave was *last week* but I suppose I didn’t dig in to specifics here 😆

@danielroe.dev