AMD SEV-SNP: Trust Nobody, Encrypt Everything

Fri, 05 Jun 2026 00:00:00 +0000

Your cloud provider can read your VM’s memory. Full stop. I don’t care what their marketing page says. If you’re running on standard hardware with standard virtualization, the hypervisor has god-mode access to every byte of your guest’s RAM. Your encryption-at-rest doesn’t matter. Your TLS doesn’t matter. The moment your data is in memory, it’s naked and the hypervisor is watching.

This is the problem AMD set out to solve with SEV-SNP, and after deploying this stuff in production across multiple clusters, I’m going to walk you through exactly how it works — all five generations of it — because understanding the evolution explains why the final product looks the way it does.

I wrote a Rust crate for abuse reporting because apparently Python wasn't enough

Tue, 19 May 2026 00:00:00 +0000

You know that feeling when you’re reading a spec, see “reference implementation: Python” and “reference implementation: JavaScript”, and think “huh, nobody bothered with Rust for this”?

That was me reading the XARF v4 spec.

XARF — the eXtended Abuse Reporting Format — is a JSON schema for describing abuse incidents. Spam. DDoS. Phishing. Malware. Copyright violations. Compromised servers. Botnets. All the things that keep abuse desks awake at night, but in a machine-readable format that two organizations can actually exchange without someone sending a PDF attachment.

Security on Hunter Wigelsworth

AMD SEV-SNP: Trust Nobody, Encrypt Everything

I wrote a Rust crate for abuse reporting because apparently Python wasn't enough