Engineer from the Netherlands. At ASML I lead the work on confidential computing and remote attestation, and part time I build systems for a national defence organisation.
In my free time I maintain open source software, and I can’t imagine not doing it.
Turning on Confidential VM keeps the hypervisor out of your RAM, but that's also the only thing it changes.
An attester can crash a verifier built on google/go-eventlog by changing one unsigned field in its boot log, while the quote signature and PCR replay still check out.
What AMD SEV protects, how to retrieve an SNP attestation report with Zig, and how Coconut SVSM and OpenHCL change the interface.
Letting only specific programs talk to the TPM, enforced inside the Linux kernel with eBPF, based on a hash of the program itself. Root included.
A Linux VM on macOS with a working /dev/tpm0 and /dev/tpmrm0, backed by swtpm, that comes back after a reboot.
Pull access is read access. How an encrypted layer works, what skopeo, ocicrypt and containerd do with it, and why it is cheap to add and expensive to operate.
A client certificate whose private key stays in the TPM: what crypto/tls asks of a key, the Go for both ends, and what it costs per handshake.
When an air-gapped GDC site is no longer available, its export can't be applied anywhere else. One controller translates those CRDs into Config Connector resources and rebuilds the entire estate in public Google Cloud.
How VoidLink stages itself without touching disk, and the Tetragon TracingPolicy that kills each stage.
What tpm2_readclock actually returns on a confidential VM, and why freshness ends up being a nonce.
A small CLI for reading and exploring OCI container images without running them.
A guide to managing Google Cloud secrets in Terraform safely using ephemeral resources and write-only arguments.
Reflecting on the implementation of S3-native state locking in Terraform, highlighting the challenges, teamwork, and community feedback that made it a success.
If you were wondering why there isn't a generic HCL formatter, this post is for you.
How does AWS Lambda work under the hood? Let's find out together!