From the article, it doesn't seem like Go is trying to re-encode strings? Go is saying (correctly, IMO) that a UTF8String field in the Issuer is not the same as a PrintableString field in the Subject.
Stock grants (RSUs, like Google gives out) are taxed as ordinary income at the moment they vest.
If you sell them immediately, then you don't pay any additional capital gains tax, because there were no capital gains from the moment you got them to the moment you sold them.
If you hold on to them, you will eventually pay capital gains on any increase in value from the moment they vested until the moment you sell them.
Perhaps, once they are vested, you could take loans against them, to get some cash while avoiding selling them.
But no matter what, they are taxed at the moment you receive them, and again at the moment they leave your possession.
American laws also have universal jurisdiction (for example, the Bill of Rights doesn't say, "unless you are located outside the US"). Most countries do not explicitly recognize that their laws do not have universal jurisdiction.
In practice, it is easy to pick out the situations in which there is "practical" universal jurisdiction, vs "theoretical" universal jurisdiction.
A Colorado company selling locally in Colorado falls in the "theoretical" bucket.
I don't think this is true. It's something that could be useful, with some sort of ACME-like automated issuance, but should definitely be issued from a non-WebPKI certificate authority.
Kubernetes is such a huge project that there are few reviewers who would feel comfortable signing off an an arbitrary PR in a part of the codebase they are not very familiar with.
It's more like Linux, where you need to find the working group (Kubernetes SIG) who would be a good sponsor for a patch, and they can then assign a good reviewer.
(This is true even if you work for Google or Red Hat)
Various pieces support pieces for pod to pod mTLS are slowly being brought into the main Kubernetes project.
Take a look at https://github.com/kubernetes/enhancements/tree/master/keps/..., which is hopefully landing as alpha in Kubernetes 1.34. It lets you run a controller that issues certificates, and the certificates get automatically plumbed down into pod filesystems, and refresh is handled automatically.
Together with ClusterTrustBundles (KEP 3257), these are all the pieces that are needed for someone to put together a controller that distributes certificates and trust anchors to every pod in the cluster.
If they are using multitenant Docker / containerd containers with no additional sandboxing, then yes, then it's only a matter of time and attacker interest before a cross-tenant compromise occurs.
That page seems to be a community wiki, and I think the original authors are somewhat confused on that point.
If you salt and hash the password on the client side, how is the server going to verify the password. Everything I can think of either requires the server to store the plaintext password (bad) or basically makes the hashed bytes become the plaintext password (pointless).