Sotabase

Career

· PhD in Computer Science, New York University2015–2020
· Master of Science in Cybersecurity, New York University2014–2015
· Assistant Professor of Electrical and Computer Engineering, Purdue University
· Bachelor of Science in Electrical and Telecommunications Engineering, Universidad Iberoamericana

Publications (68)

in-toto: Providing farm-to-table guarantees for bits and bytes
USENIX Security Symposium · 2019
80
cited
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
SCORED@CCS · 2022
66
cited
Sigstore: Software Signing for Everybody
Conference on Computer and Communications Security · 2022
58
cited
Diplomat: Using Delegations to Protect Community Repositories
Symposium on Networked Systems Design and Implementation · 2016
46
cited
On Omitting Commits and Committing Omissions: Preventing Git Metadata Tampering That (Re)introduces Software Vulnerabilities
USENIX Security Symposium · 2016
32
cited
Speranza: Usable, Privacy-friendly Software Signing
Conference on Computer and Communications Security · 2023
18
cited
An Industry Interview Study of Software Signing for Supply Chain Security
USENIX Security Symposium · 2024
15
cited
Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors
IEEE Symposium on Security and Privacy · 2024
15
cited
A Viewpoint on Knowing Software: Bill of Materials Quality When You See It
IEEE Security and Privacy · 2023
14
cited
ZTD$_{JAVA}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
2023
14
cited
Rust for Embedded Systems: Current State and Open Problems
Conference on Computer and Communications Security · 2024
13
cited
Commit Signatures for Centralized Version Control Systems
IFIP International Information Security Conference · 2019
8
cited
le-git-imate: Towards Verifiable Web-based Git Repositories
ACM Asia Conference on Computer and Communications Security · 2018
7
cited
A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation?
IEEE Security and Privacy · 2023
5
cited
Establishing Provenance Before Coding: Traditional and Next-Generation Software Signing
IEEE Security and Privacy · 2025
5
cited
Rust for Embedded Systems: Current State, Challenges and Open Problems
arXiv.org · 2023
5
cited
SoK: A Defense-Oriented Evaluation of Software Supply Chain Security
arXiv.org · 2024
4
cited
ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
arXiv.org · 2025
3
cited
DiVerify: Hardening Identity-Based Software Signing with Programmable Diverse-Context Scopes
2
cited
Establishing Provenance Before Coding: Traditional and Next-Gen Signing
arXiv.org · 2024
2
cited
Sotabase
Santiago Torres-Arias | Researcher Profile | Sotabase | Sotabase