Top all-time · #18010
Riptides Blog
Company blog · riptides.io/blogsecuritysystems
Riptides Blog is the company blog at riptides.io, writing about security and systems. Since 2025, 4 different Hacker News readers have linked it 5 times. It is still writing: the last post was on 2026-10-05, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
Linked as prior art in a thread on using eBPF to inject credentials into agent network traffic. The linked post covers why the Riptides team moved away from eBPF for this approach.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Riptides secures non-human identities at the kernel level. SPIFFE-based workload identity, secretless credentials, automatic mTLS, and per-agent egress control, enforced at runtime with no SDKs and no code changes.
What Hacker News says?
It should be possible to do this w/ eBPF. Monitor network i/o & rewrite the request on the fly to include the proper tokens & signatures. The agent can just be given placeholder tokens. That way all the usual libraries work as expected & the secrets/signatures are handled w/o worrying about another abstraction layer. Here is some prior art: https://riptides.io/blog/when-ebpf-isnt-enough-why-we-went-w...
Comment linking /blog/when-ebpf-isnt-enough-why-we-went-with-a-kernel-module/
on “Show HN: Kontext CLI – Credential broker for AI coding agents in Go”Submitted WASM in the Kernel: Tales of Triumph and Trouble as a story · 7 points
HN discussionSubmitted We deleted every secret from our GitHub Actions workflows as a story · 4 points
HN discussionSubmitted When eBPF Isn't Enough: Why We Went with a Kernel Module as a story · 2 points
HN discussionSubmitted The Critical Role of Unique Workload Identity in Modern Infrastructure as a story · 1 points
HN discussion