Security

A top local-to-jump-to-target route keeps target authentication local; a lower remote socket exchanges requests and signatures with the local agent.

Forwarding an SSH agent

Agent forwarding is not the agent itself. A local agent can answer authentication requests without sending the private key to the server. Forwarding additionally makes that service reachable through a socket on a remote host. Keeping key material local therefore does not mean keeping its authentication capability local. ...

A signed issuer response is cached before the client checks it, with a limited freshness timeline.

OCSP stapling delivers status evidence under a client policy

OCSP stapling lets a TLS server deliver a signed certificate-status response during a handshake. A client that would otherwise make an online OCSP request may avoid that request. The saving depends on the client’s revocation policy: not every browser performs an OCSP lookup for every connection, and not every certificate issuer still operates an OCSP service. Stapling is one transport for status evidence, not a replacement for certificate validation. ...

A constrained process cannot write to the read-only root but can use its designated writable working volume.

Security context defines constraints that need runtime evidence

A Kubernetes securityContext configures process identity and selected operating-system constraints. It can reduce what a compromised application is permitted to do, but it does not establish a complete security boundary by itself. Start with the operations the application actually needs, configure the appropriate fields, and test both a permitted operation and a forbidden one in the resulting container. ...

An unbalanced Merkle tree combines leaves A and B on the left and C on the right under a trusted root. B is the target; A and C are its ordered proof siblings in the fixed synthetic tree.

Certificate transparency makes issuance observable

Certificate Transparency makes public TLS certificate issuance observable. It does not determine whether a domain owner authorized an issuance, replace certificate-chain validation, or guarantee that every certificate everywhere is logged. A misissued certificate can have valid transparency evidence. The benefit is a public trail that monitors and affected owners can investigate. ...

A verified SYN cookie reaches the separate accept queue only if admitted. The application must still call accept().

SYN cookies answer when the queue overflows

A Linux TCP listener distinguishes pending handshake requests from established connections waiting for accept(). These are commonly called the SYN queue and accept queue. Their capacity limits and overflow paths differ, so diagnosing a connection failure requires identifying which stage is under pressure. ...

A time axis separates an earlier correctly authenticated fresh ECDHE session from later theft of the long-term signing key. That key alone cannot recover past secrets if the ephemeral secrets stayed private.

The forward-secrecy boundary of TLS ECDHE

Forward secrecy limits the damage from later compromise of a long-term authentication key. For a correctly authenticated ephemeral Diffie-Hellman exchange, that key alone does not reveal earlier session secrets. The claim assumes those ephemeral secrets were not also captured. It does not make a compromised endpoint, key log, or recorded plaintext safe. ...

Version-scoped input mixing and initialization credit lead to a generator; a nonblocking request branches on readiness.

Kernel entropy turns device noise into keys

Linux applications normally obtain cryptographic randomness from a kernel generator, rather than consuming one newly collected physical bit for every output bit. Initialization and state reuse still matter. A busy machine is not automatically safe, and a quiet machine is not automatically broken. Diagnose the interface, kernel version, and boot or cloning process before deciding that a counter proves a security failure. ...

A digest is bound to a signer while build provenance remains a separate evidence lane.

Image signatures bind a digest to a trusted signer

A container image tag is a mutable pointer; a digest identifies content. A valid signature binds a signed statement about that digest to a signing key. Whether that key represents an authorized person or workload is a trust-policy decision. Signing alone does not prove who built the image, that the build followed a claimed process, or that the resulting software is safe. ...