What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What do others use for ensuring the authenticity of images after downloading them with docker pull?

We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).

Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:

• https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/

Cosign is not secure

We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.

Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.

The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"

Notation (Notary v2)

I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.

Alternatives

Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?

What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?

What’s your favorite brand of BIFL cookware for induction?

I'm looking to upgrade my kitchen with industrial-quality pots and pans. After about a month of searching, I came to the conclusion that the most important requirements are:

1. 3-ply (or 5-ply). Fully clad (not just the bottom disc).
2. 18/8 or 18/10 stainless steel on the inside
3. 18/0 (or 200-grade or 400-grade) magnetic stainless steel on the outside.
4. Thick layers of metal (ideally >= 3mm of aluminum)
5. strong, serviceable rivets on handles (not welded)
6. Handles on both sides of the pot (helper handle)
7. Handles have a hole in them, for hanging
8. Fits a 28 cm (or 11”) lid (easily replaceable standard size that’s interchangeable between metric and dumb units)
9. Top rim should either have a pour spout or flared lip, for easier pouring
10. NSF certified

From what I’ve read, stainless steel isn’t a very good conductor (NIST says that aluminum transfers heat 16x better than aluminum). But stainless steel is a better surface to cook-on, because it’s less reactive and won’t absorb flavours. So, 3-ply sandwiches a thick aluminum layer between two different types of stainless steel (nickle-free [eg 18/0 or 200- or 400-grade] on the outside, which – though less corrosion resistant -- is important for induction) and either 18/8 or 18/10 on the inside.

5-ply is also a thing, but my research suggests that it doesn’t really matter how many layers. What’s more important is the thickness of the material.

And that’s why I’m here. Because, confidingly, the manufacturers of these pots don’t seem to even know how thick the layers of their 3-ply cookware is!

Ideally I’d just find the technical specifications of their cookware on their website, make a spreadsheet, and then buy the one with the thickest material (or close to the thickest, depending on my trade-off between quality vs weight & cost).

But I’ve called maybe a dozen manufacturers, and none seem to know the specifications of their own cookware :(

So, fediverse, I ask you: does anyone know what the thickness of the layers in these manufacturer’s 3-ply cookware is? Otherwise, what’s been your experience? How do you feel about these brands? Is there some other one (not listed) that you prefer?

• Browne Thermalloy
• All-Clad
• Made-in
• Tramontina
• Cuisinart
• Other?

Edit: I should be clear that I’m specifically asking about 3-ply or 5-ply stainless steel cookware. This is for a community house, so I need something that can be (ab)used by housemates who don’t know or care for the seasonings on the pans. And I don’t want cast iron, because it’s more likely to break the glass-topped induction cooktop.

What’s your favorite brand of BIFL cookware for induction?

I'm looking to upgrade my kitchen with industrial-quality pots and pans. After about a month of searching, I came to the conclusion that the most important requirements are:

1. 3-ply (or 5-ply). Fully clad (not just the bottom disc).
2. 18/8 or 18/10 stainless steel on the inside
3. 18/0 (or 200-grade or 400-grade) magnetic stainless steel on the outside.
4. Thick layers of metal (ideally >= 3mm of aluminum)
5. strong, serviceable rivets on handles (not welded)
6. Handles on both sides of the pot (helper handle)
7. Handles have a hole in them, for hanging
8. Fits a 28 cm (or 11”) lid (easily replaceable standard size that’s interchangeable between metric and dumb units)
9. Top rim should either have a pour spout or flared lip, for easier pouring
10. NSF certified

From what I’ve read, stainless steel isn’t a very good conductor (NIST says that aluminum transfers heat 16x better than aluminum). But stainless steel is a better surface to cook-on, because it’s less reactive and won’t absorb flavours. So, 3-ply sandwiches a thick aluminum layer between two different types of stainless steel (nickle-free [eg 18/0 or 200- or 400-grade] on the outside, which – though less corrosion resistant -- is important for induction) and either 18/8 or 18/10 on the inside.

5-ply is also a thing, but my research suggests that it doesn’t really matter how many layers. What’s more important is the thickness of the material.

And that’s why I’m here. Because, confidingly, the manufacturers of these pots don’t seem to even know how thick the layers of their 3-ply cookware is!

Ideally I’d just find the technical specifications of their cookware on their website, make a spreadsheet, and then buy the one with the thickest material (or close to the thickest, depending on my trade-off between quality vs weight & cost).

But I’ve called maybe a dozen manufacturers, and none seem to know the specifications of their own cookware :(

So, fediverse, I ask you: does anyone know what the thickness of the layers in these manufacturer’s 3-ply cookware is? Otherwise, what’s been your experience? How do you feel about these brands? Is there some other one (not listed) that you prefer?

• Browne Thermalloy
• All-Clad
• Made-in
• Tramontina
• Cuisinart
• Other?

Edit: I should be clear that I’m specifically asking about 3-ply or 5-ply stainless steel cookware. This is for a community house, so I need something that can be (ab)used by housemates who don’t know or care for the seasonings on the pans. And I don’t want cast iron, because it’s more likely to break the glass-topped induction cooktop.

What’s your favorite brand of BIFL cookware for induction?

I'm looking to upgrade my kitchen with industrial-quality pots and pans. After about a month of searching, I came to the conclusion that the most important requirements are:

1. 3-ply (or 5-ply). Fully clad (not just the bottom disc).
2. 18/8 or 18/10 stainless steel on the inside
3. 18/0 (or 200-grade or 400-grade) magnetic stainless steel on the outside.
4. Thick layers of metal (ideally >= 3mm of aluminum)
5. strong, serviceable rivets on handles (not welded)
6. Handles on both sides of the pot (helper handle)
7. Handles have a hole in them, for hanging
8. Fits a 28 cm (or 11”) lid (easily replaceable standard size that’s interchangeable between metric and dumb units)
9. Top rim should either have a pour spout or flared lip, for easier pouring
10. NSF certified

From what I’ve read, stainless steel isn’t a very good conductor (NIST says that aluminum transfers heat 16x better than aluminum). But stainless steel is a better surface to cook-on, because it’s less reactive and won’t absorb flavours. So, 3-ply sandwiches a thick aluminum layer between two different types of stainless steel (nickle-free [eg 18/0 or 200- or 400-grade] on the outside, which – though less corrosion resistant -- is important for induction) and either 18/8 or 18/10 on the inside.

5-ply is also a thing, but my research suggests that it doesn’t really matter how many layers. What’s more important is the thickness of the material.

And that’s why I’m here. Because, confidingly, the manufacturers of these pots don’t seem to even know how thick the layers of their 3-ply cookware is!

Ideally I’d just find the technical specifications of their cookware on their website, make a spreadsheet, and then buy the one with the thickest material (or close to the thickest, depending on my trade-off between quality vs weight & cost).

But I’ve called maybe a dozen manufacturers, and none seem to know the specifications of their own cookware :(

So, fediverse, I ask you: does anyone know what the thickness of the layers in these manufacturer’s 3-ply cookware is? Otherwise, what’s been your experience? How do you feel about these brands? Is there some other one (not listed) that you prefer?

• Browne Thermalloy
• All-Clad
• Made-in
• Tramontina
• Cuisinart
• Other?

Edit: I should be clear that I’m specifically asking about 3-ply or 5-ply stainless steel cookware. This is for a community house, so I need something that can be (ab)used by housemates who don’t know or care for the seasonings on the pans. And I don’t want cast iron, because it’s more likely to break the glass-topped induction cooktop.

What’s your favorite brand of BIFL cookware for induction?

I'm looking to upgrade my kitchen with industrial-quality pots and pans. After about a month of searching, I came to the conclusion that the most important requirements are:

1. 3-ply (or 5-ply). Fully clad (not just the bottom disc).
2. 18/8 or 18/10 stainless steel on the inside
3. 18/0 (or 200- or 400-grade) magnetic stainless steel on the outside.
4. Thick layers of metal (ideally >= 3mm of aluminum)
5. Strong, serviceable rivets on handles (not welded)
6. Handles on both sides of the pot (helper handle)
7. Handles have a hole in them on the end (for hanging)
8. Fits a 28 cm (or 11”) lid (easily replaceable standard size that’s interchangeable between metric and dumb units)
9. Top rim should either have a pour spout or flared lip (for easier pouring)
10. NSF certified

From what I’ve read, stainless steel isn’t a very good conductor (NIST says that aluminum transfers heat 16x better than stainless steel). But stainless steel is a better surface to cook-on, because it’s less reactive and won’t absorb flavours. So, 3-ply sandwiches a thick aluminum layer between two different types of stainless steel (nickle-free [eg 18/0 or 200- or 400-grade] on the outside, which – though less corrosion resistant -- is important for it to work on an induction cooktop) and either 18/8 or 18/10 on the inside.

5-ply is also a thing, but my research suggests that it doesn’t really matter how many layers. What’s more important is the thickness of the material.

And that’s why I’m here. Because, confoundedly, the manufacturers of these pots don’t seem to even know how thick the layers of their 3-ply cookware is!

Ideally I’d just find the technical specifications of their cookware on their website, make a spreadsheet, and then buy the one with the thickest material (or close to the thickest, depending on my trade-off between quality vs weight & cost).

But I’ve called maybe a dozen manufacturers, and none seem to know the specifications of their own cookware :(

So, fediverse, I ask you: does anyone know what the thickness of the layers in these manufacturer’s 3-ply cookware is? Otherwise, what’s been your experience? How do you feel about these brands? Is there some other one (not listed) that you prefer?

• Browne Thermalloy
• All-Clad
• Made-in
• Tramontina
• Cuisinart
• Other?

Edit: I should be clear that I’m specifically asking about 3-ply or 5-ply stainless steel cookware. This is for a community house, so I need something that can be (ab)used by housemates who don’t know or care for the seasonings on the pans. And I don’t want cast iron, because it’s more likely to break the glass-topped induction cooktop.