@nprofile1q... you're not wrong. Unfortunately the one I had to work on one that was developed by people who were experienced at neither.

@nprofile1q... Microsoft Access anyone?

@nprofile1q... which alternative search engines have an independent search index that does not rely on Google or Microsoft/Bing?

@nprofile1q... you're right but simultaneously I've seen more than one open source project poop the deck by not thinking at all how their communication would be perceived by both users and the developer community. I know it's sometimes difficult as with everything being public you got to not only be a developer but also wear many other hats. In some cases it's quite astonishing though how much projects fail to read the room and consider the most obvious optics. See e.g. the Anthropic and Blender example. Though obviously the same can be set about some community members crossing the line with harassment.

@nprofile1q... it's looking really good! I like the premise of an insider threat, the false trail of information, different approaches one can take, and various ways intrusion may get detected. It seems to be well-suited for good story telling and mechanics that drive the story forward. Haven't had the chance to run it yet, but shared it with fellow friends who are into TTRPGs.

@nprofile1q... do you know of any charitable organizations helping with the protest or community support that you consider worth donating to? Asking as someone not from the U.S.

@nprofile1q... I guess even watchtowr isn't above using situations like this for marketing.

@nprofile1q... apart from controlling their lifecycle they don't fundamentally change anything about the security of your data. The assumption is still that your cloud provider is unable to extract them from the HSM. Additionally, there is a difference between having a CMK that is merely used for wrapping data keys and actually controlling the key used for encrypting, decrypting, signing, or verifying the data.

@nprofile1q... how did none of the intelligence agencies raise an alarm about this?

@nprofile1q... @nprofile1q... Example can be seen here: https://github.com/CycloneDX/bom-examples/blob/master/SaaSBOM/apigateway-microservices-datastores/bom.json

@nprofile1q... @nprofile1q... AFAIK you could in theory with CycloneDX, but I have not yet seen that in practice. The spec provides an option for declaring endpoints. It's what is being used in what they call a SaaSBOM.

@nprofile1q... maybe I'm misunderstanding what you are saying but since when do SBOMs contain network destinations?