Dan Lorenc
As seen in:
Medium,
TechCrunch,
VentureBeat,
InfoWorld,
InfoQ,
Dark Reading,
CyberScoop,
The New Stack,
Federal Times,
C4ISRNET
and
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Dan Lorenc
The TeamPCP attacks are a warning: Your CI/CD pipeline is the new front line
We built the modern software supply chain on a flawed assumption: that the systems and dependencies we rely on are trustworthy by default. Attackers figured out a while ago that this assumption is wrong, and they’ve been exploiting it ever since. The fastest way to distribute malware at scale isn’t to attack your production systems directly; it’s to hijack the pipelines that build and ship your software in the first place. TeamPCP just made this obvious to everyone else.
2025 Year In Review
It feels like the world moves faster and faster with each passing year. As investors, it’s our job to help drive innovation forward. From agents and robotics to novel energy sources and defense tech, AI is reshaping our world faster than we ever thought possible. At Salesforce Ventures, we remain driven by our mission to nurture these world-changing ideas and teams — and we bring decades of collective experience to that mission.
Why SBOMs aren't a silver bullet
Content Paint Get the full story: Subscribe for free Join peers managing over $100 billion in annual IT spend and subscribe to unlock full access to The Stack’s analysis and events. Your link has expired. Please request a new one. Your link has expired. Please request a new one. Your link has expired. Please request a new one. Great! You've successfully signed up. Great! You've successfully signed up.
Hardened containers don’t fix a broken software supply chain
The software supply chain is broken, and the recent explosion of hardened container offerings is the industry’s reaction. A few years ago, secure container images were a niche concern. Today, they’re everywhere. The industry has responded by tightening inspection at the end of the assembly line (more checks, more scanners) while largely ignoring how the parts get sourced, assembled, and verified upstream.
Put a Fork in It: The Future of Open Source That’s 'Done'
Working in open source software (OSS) sometimes feels like running on a treadmill that never stops. The projects you depend on keep moving, but if you miss a step, you get flung off the back. For many developers, it’s an endless race to keep up with shifting dependencies, urgent common vulnerabilities and exposures (CVEs) and new features. But not all open source moves at that speed. It exists on a spectrum from fast-moving, feature-rich projects to quietly abandoned ones.
Open Source Is Worth Defending
Open source software (OSS) is under attack — and not just from the usual suspects inserting malware or gaming vulnerability scanners. Today, the definition of what it means to be “open source” is quietly eroding. Companies are rebranding “source-available” code as open source, creating downstream effects on the community and the broader ecosystem. When these lines blur, trust breaks — and open source doesn’t work without trust.
Unverified code is the next national security threat
Skip to content NEW Security news and analysis brought to you by the McCrary Institute | READ MORE → By Dan Lorenc • Jun 10, 2025 American infrastructure is powered by open-source software and no one knows who wrote it. That’s not hyperbole. It’s a structural vulnerability.
Chainguard Raises $356M to Protect Open-Source Supply Chain
10 minutes ago bankinfosecurity Series D Round Comes at $3.5B Valuation, Fuels Product Expansion Beyond Containers Michael Novinson (MichaelNovinson) • April 23, 2025 A supply chain security startup led by an ex-Google Cloud engineer raised $356 million to mitigate accidental and malicious vulnerabilities in widely used software components.
Projecting the next decade of software supply chain security
With the rapid pace of innovation accelerating under a new administration, discussions over whether software security will be sidelined in favor of speed are heating up. However, security leaders have long been saying that security protocols shouldn’t slow down development plans — and they don’t when done correctly. This perception must be adopted more widely so that innovation and security can happen in tandem. Currently, the software industry stands at a crossroads.
Securing the Software Supply Chain: A 2035 Blueprint
The software industry stands at a crossroads. The rise of supply-chain attacks over the past decade has left an indelible mark on the industry. High-profile incidents such as SolarWinds and the exploitation of the Log4Shell vulnerability have exposed systemic weaknesses in the way we build and distribute software. These events transformed trusted tools into attack vectors, leaving organizations powerless to respond until after the damage was done.
Rust Will Explode, SBOMs Will Be Duds: Open Source Predictions
This has been an extraordinary year for open source software. From groundbreaking advancements in programming tools to heated debates on the future of licensing and standards, the open source ecosystem continues to evolve at an unprecedented pace. With 2025 approaching, it’s an ideal time to reflect on where we’ve been and where we’re heading. Here are my thoughts, predictions and hot takes for the year ahead, covering what I’m most bullish about and where I foresee stagnation or setbacks.
Ubuntu 24.10 Refreshes Gnome, Permission Prompts
For decades, Ubuntu has been considered one of the most user-friendly Linux distributions on the market. There are so many good reasons for that, such as a well-designed and executed desktop environment, the simplicity of the apt package manager (as well as the GUI frontend that goes with it), and the impeccable hardware detection. I’ve used Ubuntu (and Ubuntu-based distributions) for decades and can attest to how easy it is.
Pop!_OS: One of the Best Linux Distros For Creators of All Types
I’ve been using Linux for nearly 30 years, and I’ve witnessed every type of distribution come and go. There have been distributions ranging from the very basic to the gimmicky and everything in between. I spent years “distro hopping,” which included the likes of Caldera OpenLinux, Corel Linux, Red Hat (way before Fedora/RHEL), Ubuntu, elementary OS, Bodhi Linux, Ubuntu Budgie, Deepin, Fedora, Zorin OS and more.
Navigating the Turbulent Waters of AI Security
German physicist Werner Heisenberg, on his deathbed, said, “When I meet God, I am going to ask him two questions: Why relativity? And why turbulence? I really believe he will have an answer for the first.” It’s a quote commonly misattributed to Albert Einstein.
Chainguard Raises $140M to Drive AI Support, Global Growth
6 minutes ago bankinfosecurity Company Seeks to Expand Globally and Grow Its US Public Sector Presence Michael Novinson (MichaelNovinson) • July 25, 2024 A supply chain security startup led by an ex-Google Cloud engineer closed a Series C round to support AI workloads and expand its open-source software catalog.
Do Open Source Obligations Change with Packaging Ecosystems?
The world of open source software has evolved significantly over the years. What started as a way for developers to freely share code has turned into a complex ecosystem with its own set of norms, expectations and even obligations. Much has been written about what companies should and shouldn’t expect or demand from maintainers of open source projects, and related compensation considerations.
A more secure (and smaller) Big Bang
Over three years ago, when the container universe was young(er), Platform One created Big Bang, an open source tool to streamline the building and maintenance of secure, on-premise software factories. Big Bang’s goal was to empower those managing software factories with an easy “software factory in a box” experience. Since its inception, it has seen over 6,500 commits, 130 releases, and contributions from over 100 contributors.
Chainguard Images now available on Docker Hub
Today, Chainguard announced that it has become a Docker Verified Publisher (DVP), marking a significant milestone for our shared mission to enhance the security and reliability of all software supply chains. With this new partnership, Chainguard Developer Images are now available on Docker Hub, providing developers everywhere with access to minimal, secure, hardened images for a wide range of open source and cloud-native projects.
Chainguard Raises $61M to Protect More Open-Source Software
25 minutes ago bankinfosecurity Startup Can Secure 80% of Open-Source Software Existing Customers Run in Enterprise Michael Novinson (MichaelNovinson) • November 2, 2023 A software supply chain security startup led by a longtime Google Cloud engineer closed a Series B round to help protect more open-source software.
OpenPubkey and Sigstore
Disclaimer: The following is representative of the authors views, and not necessarily that of the sigstore community. OpenPubKey was announced October 4th by Docker and BastionZero as a new Linux Foundation project. It’s a new scheme for using OIDC providers to sign arbitrary objects. It bears a lot of resemblance to Sigstore, so I thought it would be worth taking some time to explain the differences, including some advantages and disadvantages.
So you want to check image signatures in Kubernetes…?
Signing containers, and checking their signatures, is an important security practice everyone should be using in today’s threat landscape. It’s also required by many regulatory frameworks enterprises are required to meet like FedRAMP, PCI-DSS, and HIPAA to name a few. When most organizations approach tackling signing and verifying signatures, it seems easier than it is and it can be tempting to try to build all of the infrastructure to do so yourself.
A CISO's Guide to Paying Down Software Supply Chain Security Debt
There has always been a tradeoff in IT between shipping new features and functionality versus paying down technical debt, which includes things like reliability, performance, testing … and yes, security. In this "ship fast and break things" era, accumulating security debt is a decision that organizations voluntarily make.
Celebrating 5 Years of NTIA’s SBOM Work
A few months ago, I sent out an illusive tweet about an upcoming birthday for a supply chain security project. That anniversary was for distroless images, but the tweet prompted several responses from other projects highlighting their upcoming milestone-aversarys, including the five year anniversary of the National Telecommunications and Information Administration's (NTIA) official Software Bill of Materials (SBOMs) work.
Is memory safety the killer use case for software bills of materials? Original
Last year, Cybersecurity and Infrastructure Security Agency Director Jen Easterly gave a speech at Carnegie Mellon that emphasized the "secure by default" future that federal agencies are aiming for when they talk about driving security into earlier phases of software design. What does this look like in practice, and how is this going to affect the federal government's software procurement policies?
Can SBOMs Save the Software Supply Chain?
Can SBOMs Save the Software Supply Chain? 1 February 2023 Security Technology, February 2023 A major problem in today’s software landscape is knowing what software you’re using, where it came from, and who built it. The software supply chain is, in many ways, similar to most physical supply chains. Take, for example, a salad. There are several steps before a dinner salad makes it to your plate: It must be grown, picked, cleaned, shipped, stocked, purchased, and then prepared.
Software supply chain security is broader than SolarWinds and Log4J
Dan Lorenc is CEO and co-founder of Chainguard. Previously he was staff software engineer and lead for Google’s Open Source Security Team (GOSST). He has founded projects like Minikube, Skaffold, TektonCD and Sigstore. SolarWinds and Log4j have made software supply chain security issues a topic of intense interest and scrutiny for businesses and governments alike.
Introducing Wolfi - the first Linux (Un)distro designed for securing the software supply chain
The massive push for software supply-chain integrity and transparency has left organizations struggling to secure their pipelines and manage vulnerabilities. Existing tooling doesn’t support supply chain security natively and requires users to bolt on critical features like signatures, provenance, and software bills of material (SBOM).
What your scanner doesn't know **can** hurt you
A common assumption made by developers and organizations wading into software supply chain security is -- doesn't my software composition analysis (SCA) tool take care of this problem by finding common vulnerabilities and exposures (CVEs)? Scanners aren’t magic. And if we are really going to solve the software supply chain security problem, we need to stop treating them like they are.
Announcing the First Images Designed for a Secure Software Supply Chain
We started Chainguard eight short months ago with a simple mission: to make the software supply chain secure by default. While we’d love for it to be otherwise, software supply chains (and supply chain attacks) are far too complex for a single solution to fully protect an organization. Instead, we need holistic changes at every stage of the application lifecycle. That’s why we’re building a suite of products with the goal of simplifying security for all developers.
Kubernetes signals massive adoption of Sigstore for protecting open source ecosystem
Kubernetes 1.24 will be the first release officially using Sigstore, enabling seamless verification of signatures to protect against supply chain attacks across the 5.6m developer community The Kubernetes and Sigstore communities today are announcing that Kubernetes is adopting Sigstore in production for signing artifacts and verifying signatures, enabling Kubernetes users for the first time to verify that the distribution they are using is exactly what it claims to be.
Secure Software Summit: The State of OSS Supply Chain Security
The open source software (OSS) supply chain is under attack. As evidenced by the recent Log4Shell vulnerability, the OSS supply chain is increasingly a focus for attackers seeking to exploit weak links in security. A number of research reports have recorded a significant increase in so-called ‘next-gen software supply chain attacks‘ over the past decade.
Architecting for Resilience Panel
Transcript Rettori: I'll ask each of you to do a quick introduction, and why are you passionate about the subject. Lorenc: My name is Dan Lorenc. I'm a software engineer at Google on our open source security team. I've been doing open source, particularly in the CI/CD area for a while now. I've been frustrated seeing this whole subject treated way less seriously than application runtimes.
Resilience in Supply Chain Security
Transcript Lorenc: My name is Dan Lorenc. I'm a software engineer at Google, on our open source security team. I'm going to be talking about resilience and the role it plays in supply chain security. If you've been following the software news lately, you've seen that there have been a ton of supply chain attacks. It hit everything from governments, to large companies and small companies alike. Open source has played a crucial role in preventing and causing a lot of this.
Signature Formats
There are a bunch of confusing formats and specifications that describe how to, well, format signatures and related information. This topic is confusing because terminology is hard and each specification tackles things at slightly different levels of abstraction, from slightly different angles. This blog post tries to explain them all, with a few recommendations for specific use cases.
Taking Open Source Supply Chain Security Seriously with Dan Lorenc
Episode 20 Share Page Embed Code Subscribe & Share RSS Feed Download (64.7 MB) Link with Timestamp Your Hosts Special Guest Tags RSS Apple Podcasts Google Podcasts Spotify Share Sponsored by Reblaze, creators of Curiefense Panelists Justin Dorfman | Richard Littauer Guest Dan Lorenc Software Engineering Lead, Google Show Notes Hello and welcome to Committing to Cloud Native Podcast! It’s the podcast by Reblaze where we talk about the confluence of Cloud Native and Open Source.
In Defense of Package Managers
Open Source package managers are one of the most maligned pieces of software in common use today. I’m here to correct that criticism and tell developers that it’s not the package managers you hate — it’s what they’ve made you become. This contains a bit of a history lesson to explain how we got here today, as well as what I think the package management world will look like in the future.
OCI Artifacts Explained
The OCI (Open Containers Initiative) manages a few specifications and projects related to the storage, distribution, and execution of container images. If you’ve ever run a docker container, you’ve interacted with these specifications, whether you know it or not. Photo by Erwan Hesry on Unsplash OCI registries are typically used for container images, but it’s actually possible (and even a good idea in some cases) to use them for storing and distributing other types of data.
Data security depends on a secure software-development supply chain
As 2020 finally came to an end and 2021 began, The New York Times reported that Russia used SolarWinds’ hacked program to infiltrate at least 18,000 government and private networks. As a result, it is presumed that the data within these networks (user IDs, passwords, financial records, source code), is in the hands of Russian intelligence agents.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Dan
Contact Dan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack