Open Source Security
de Josh Bressers
TecnologiaE · Explícito
Episódio mais recente
Trusting your computing with Lance and Anton
Trusting your computing with Lance and Anton
Sobre este podcast
Open Source Security is a media project to help showcase and educate on open source security. Our goal is to give the community a platform educate both developers and users on how open source security works.
There's a lot of good work happening that doesn't get attention because there's no marketing department behind it, they don't have a developer relations team posting on LinkedIn every two hours. Let's focus on those people and teams then learn what they do and how they do it. The goal is to hear from the people doing the work, they know what's up, they have a lot to teach us. We just have to listen.
Episódios
Os 50 episódios mais recentes de 551
- Trusting your computing with Lance and Anton · 38 minJosh chats with Lance and Anton from Caution about verifiable computing. We start out discussing all the challenges in bootstrapping software that almost nobody thinks about…
- Finding missing security backports with Roi Nisimi · 30 minJosh chat with Roi Nisimi about some research he's done into missing backport security fixes. Roi calls these Backport Gaps. The idea is looking for security fixes on the main…
- Dependency attacks in 2026 with James Matchett · 32 minJosh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There…
- Sovereignty, policy, and OpenUK with Amanda Brock · 35 minJosh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions…
- The curl summer of Bliss with Daniel and Stefan · 33 minJosh chats with Daniel and Stefan from curl about their summer of bliss. Curl stopped taking vulnerability reports for a month and nothing much happened really. Daniel and Stefan…
- CRA vulnerability reporting with Daniel Thompson · 41 minJosh welcomes back Daniel Thompson to explain what just happened regarding vulnerability reporting and the CRA on September 11. The very first CRA requirements kicked in, but…
- Finding difficult vulnerabilities with Jaya Baloo from AISLE · 29 minJosh chats with Jaya Baloo from AISLE about their vulnerability scanner. If you follow open source vulnerabilities AISLE is a name you've seen popping up recently. They have a…
- Sovereign Tech Agency with Erik Möller · 36 minJosh chats with Erik Möller from the Sovereign Tech Agency about what they're doing. The Sovereign Tech Agency is doing some amazing work around funding open source maintainers…
- CVEs vs Advisories with Paul Asadoorian · 38 minJosh chats with Paul Asadoorian about a tool he wrote called fettle and a recent report Paul published on CVEs. Fettle is a tool to help update and manage Linux systems. The big…
- Maintaining EOL Open Source with Commonhaus and HeroDevs · 34 minJosh chats with Erin Schnabel and Rob Nalen about a new effort from Commonhaus and HeroDevs for maintaining end of life open source. This project, the Open Source Sustainability…
- Cleanup, Speedup, Levelup open source at e18e · 35 minJosh chats with James from e18e. This is a project that is working on improving Javascript packages by cleaning up, speeding up, and leveling up the dependencies. The way the…
- VulnCheck's State of Exploitation Report with Patrick Garrity · 37 minJosh chats with Patrick Garrity about the VulnCheck State of Exploitation 1H-2026 report. Patrick explains the current trends we are seeing around vulnerabilities right now…
- Securing critical infrastructure with Josh Corman · 36 minOpen Source Security welcomes Josh Corman to talk about the challenges around securing our critical infrastructure. Specifically the discussion centers around our water supplies…
- Abandoned open source with Josh Marpet · 34 minJosh welcomes Josh Marpet for a discussion about abandoned open source packages. Josh Marpet has a foundation called Value Chain Risk Institute that has a report discussion how…
- Red Hat's Project Lightwell with Mo Duffy · 33 minJosh welcomes Mo Duffy from Red Hat to chat about project Lightwell. The idea is to leverage the resources and understanding Red Hat has built up over the years to help deal with…
- Rust Foundation Maintainers Fund with Lori and Niko · 33 minJosh chats with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund. This is a new project the Rust Foundation has create to help fund Rust maintainers…
- AIBOM, CBOM, and HBOM with Allan Friedman · 35 minJosh chats with Allan Friedman about all things Bill of Materials. Allan did a ton of work to help turn SBOM into what it is today. He has many thoughts and ideas around the new…
- Packagist and Composer security with Jordi Boggiano · 35 minJosh welcomes Jordi Boggiano the lead maintainer of Composer and Packagist to explain the truckload of security features they've recently added. Packagist is the PHP package…
- Sustaining Open VSX with Mike and Thabang · 37 minJosh welcomes Mike Milinkovich and Thabang Mashologu from the Eclipse Foundation to talk about their new managed Open VSX registry. This is the first open source package registry…
- Hacking your CI/CD with François Proulx · 36 minJosh welcomes back François Proulx to talk about the absolute madness in the CI/CD universe right now. We also learn about François' new project SmokedMeat which is a tool to…
- Open source verification with Sal Kimmich · 32 minJosh chats with Sal Kimmich about the current state of everything, and what we can expect next. Sal has some incredible insight into what we can expect to see due to the current…
- Vulnerability disclosure with Casey Ellis · 38 minJosh talks to Casey Ellis about why vulnerability disclosure is so hard, and also so important. Casey is one of the best in this space having been a Bugcrowd founder. There are…
- F-Droid the open app store with Hans · 37 minJosh talks to Hans-Christoph Steiner about F-Droid, the Free and Open Source Android App Repository. The way F-Droid works looks a lot like a Linux distribution which has some…
- Open source is critical infrastructure with Kat Cosgrove · 38 minJosh talks to Kat Cosgrove about a how companies should be treating open source more like their critical infrastructure than free stuff. Kat has a ton of knowledge about how the…
- How to actually test a disaster plan with David Bernstein · 35 minJosh and David finish up the disaster recovery and emergency planning trilogy. In this one David tells us how to test the plan he told us how to build in the last episode. There…
- Open Source Pledge with Vlad-Stefan Harbuz · 35 minJosh has a discussion with Vlad-Stefan Harbuz about the Open Source Pledge as well as his recent FOSDEM talk. The Open Source Pledge is all about trying to build a sustainable…
- Building a plan for disaster with David Bernstein · 39 minJosh welcomes back David Bernstein to talk about creating a disaster recover plan. It's a very timely topic given all the current events. There are more supply chain attacks and…
- Open Source Malware with Paul McCarty · 38 minJosh talks to Paul McCarty of Open Source Malware about ... open source malware. Paul explains why there aren't many good open source malware datasets. We discuss why the…
- Package management challenges with Andrew Nesbitt · 36 minJosh welcomes back Andrew Nesbitt to discuss some recent blog posts he wrote about the challenges of new ecosystems as well as challenges of no ecosystems like C. There aren't…
- Open Source Security at scale with Michael Winser · 43 minJosh talks to Michael Winser about a talk he gave at FOSDEM as well as his work on Alpha Omega at the Linux Foundation. Michael is approaching open source security in a way that…
- 2026 State of the Software Supply Chain with Brian Fox · 36 minJosh chats with Brian Fox from Sonatype about their 2026 State of the Software Supply Chain report. Most of the number continue to grow at alarming rates, but there's some new…
- MCP and Agent security with Luke Hinds · 36 minJosh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke's new tool, nono which is a sandboxing tool that has AI agents in…
- The State of OpenSSL for pyca/cryptography with Alex Gaynor and Paul Kehrer · 34 minJosh talks to Paul Kehrer and Alex Gaynor, from the Python Cryptographic Authority. Alex and Paul recently published a statement discuss the challenges posed by modern OpenSSL…
- Rust coreutils with Sylvestre Ledru · 31 minJosh talks to Sylvestre Ledru about the Rust coreutils project. We've been using GNU coreutils for decades now, and the goal of Rust coreutils is to rewrite these utilities in…
- Goose and the Agentic AI Foundation with Brad Axen · 30 minJosh chats with Brad Axen from Block about his creation Goose as well as the Agentic AI Foundation (AAIF). I am quite skeptical of many AI claims, but Brad has a very pragmatic…
- The Global Vulnerability Intelligence Platform with Olle E. Johansson · 34 minJosh chats with Olle E. Johansson about the Global Vulnerability Intelligence Platform (GVIP). It's no secret the current vulnerability systems are reaching a breaking point…
- Digital Sovereignty and Nextcloud with Frank Karlitschek · 32 minJosh talk to the founder and CEO of Nextcloud, Frank Karlitschek about digital sovereignty. There's a lot of attention lately around digital sovereignty and often that…
- The Art of Crisis Management with David Bernstein · 36 minJosh talks to David Bernstein about the world of crisis management and business continuity. David is a certified emergency manager and tell us about preparing for both digital…
- WTF is a passkey with William Brown · 1 h 2 minWilliam Brown is back! This time Josh chats with him about Passkeys. WTF are they? A Passkey is a form of multi factor authentication, but it's not super obvious what that really…
- All about Suricata with Victor Julien · 32 minJosh discusses Suricata with Victor Julien, the founder and lead developer of the project. Victor explains the history of the project, its impact on cybersecurity, and the…
- Iocaine poisons bots with Gergely Nagy · 40 minJosh talks to Gergely Nagy (algernon) about his tool Iocaine. Iocaine creates a maze to trap scraping bots in a world a fake pages they cannot escape. algernon tells us how…
- Anubis with Xe Iaso · 34 minJosh chats with Xe Iaso, the creator of Anubis the web AI firewall. We discuss how Anubis is tackling bots and scrapers. The discussion around the scrapers is fascinating and…
- Rustls with Dirkjan and Joe · 30 minJosh talk to Dirkjan and Joe about Rustls (pronounced rustles), a Rust-based TLS library. Dirkjan and Joe are developers on Rustls. We talk about the history that got us to this…
- Daniel Thompson answers: Does the CRA apply to Santa? · 47 minJosh welcomes back Daniel Thompson explore the rather silly question of whether Santa Claus needs to be compliant with the Cyber Resilience Act (CRA). This episode was intended…
- Linux Foundation Europe with Gabriele Columbro · 33 minJosh has a chat with Gabriele Columbro, Executive Director of the Fintech Open Source Foundation and General Manager of Linux Foundation Europe. We of course discuss the Cyber…
- Updating open source dependencies with Jamie Tanna · 30 minJosh discusses updating open source dependencies with Jamie Tanna. Jamie works on Renovate which gives them a lot of insight into the challenges of keeping your open source…
- TARmageddon with Alex Zenla · 43 minJosh discusses the TARmageddon vulnerability with Alex Zenla, CTO of Edera. In this episode, we explore the discovery of the TARmageddon vulnerability. It's especially…
- Python Security with Seth Larson · 32 minIn this episode Seth Larson gives us a cornucopia of topics relating to Python security. Seth discusses the Python Software Foundation's decision to reject a significant grant…
- Linux Vendor Firmware Service with Richard Hughes · 36 minJosh talks to Richard Hughes about the world of firmware. We cover how Richard's journey from developing the ColorHug led to the creation of the Linux Vendor Firmware Service…
- NPM supply chain attacks with Charlie Eriksen · 35 minJosh chats with Charlie Eriksen, a security researcher at Aikido Security. We discuss the recent NPM supply chain attacks that affect hundreds of packages. Charlie shares his…
