The Curious Engineer

All blogs / Security

Open Source Security

opensourcesecurity.io

Recent content on Open Source Security

SecurityLinux / Unix

’05’10’15’20’25
Posts
712 from 1 Jan 2001 to 30 Oct 2026
Posting
weekly (60 in the last year)
Kind
personal blog
Feed
https://opensourcesecurity.io/feed.xml

2026 50

  1. Blog - CVE Rat Mode
  2. Blog - Dear Open Source Developers: It's OK not to embargo
  3. Dependency attacks in 2026 with James Matchett
  4. Sovereignty, policy, and OpenUK with Amanda Brock
  5. The curl summer of Bliss with Daniel and Stefan
  6. CRA vulnerability reporting with Daniel Thompson
  7. Finding difficult vulnerabilities with Jaya Baloo from AISLE
  8. Sovereign Tech Agency with Erik Möller
  9. CVEs vs Advisories with Paul Asadoorian
  10. Maintaining EOL Open Source with Commonhaus and HeroDevs
  11. Cleanup, Speedup, Levelup open source at e18e
  12. VulnCheck's State of Exploitation Report with Patrick Garrity
  13. Blog - You don't have a supply chain, you have supply soup
  14. Securing critical infrastructure with Josh Corman
  15. Abandoned open source with Josh Marpet
  16. Red Hat's Project Lightwell with Mo Duffy
  17. Rust Foundation Maintainers Fund with Lori and Niko
  18. AIBOM, CBOM, and HBOM with Allan Friedman
  19. Packagist and Composer security with Jordi Boggiano
  20. Sustaining Open VSX with Mike and Thabang
  21. Blog - We have to change the rules of security
  22. Hacking your CI/CD with François Proulx
  23. Open source verification with Sal Kimmich
  24. Vulnerability disclosure with Casey Ellis
  25. F-Droid the open app store with Hans
  26. Open source is critical infrastructure with Kat Cosgrove
  27. How to actually test a disaster plan with David Bernstein
  28. The lopsided economics of vulnerabilities
  29. Linus's Law, but vulnerabilities
  30. Open Source Pledge with Vlad-Stefan Harbuz
  31. Building a plan for disaster with David Bernstein
  32. Open Source Malware with Paul McCarty
  33. Open source was never about trust
  34. Package management challenges with Andrew Nesbitt
  35. Open Source Security at scale with Michael Winser
  36. Eulogy for open source
  37. 2026 State of the Software Supply Chain with Brian Fox
  38. MCP and Agent security with Luke Hinds
  39. The State of OpenSSL for pyca/cryptography with Alex Gaynor and Paul Kehrer
  40. Rust coreutils with Sylvestre Ledru
  41. Goose and the Agentic AI Foundation with Brad Axen
  42. The Global Vulnerability Intelligence Platform with Olle E. Johansson
  43. Digital Sovereignty and Nextcloud with Frank Karlitschek
  44. The Art of Crisis Management with David Bernstein
  45. Is software ever done?
  46. WTF is a passkey with William Brown
  47. All about Suricata with Victor Julien
  48. The Cathedral, the Megachurch, and the Bazaar
  49. Iocaine poisons bots with Gergely Nagy
  50. Anubis with Xe Iaso

2025 53

  1. Rustls with Dirkjan and Joe
  2. Daniel Thompson answers: Does the CRA apply to Santa?
  3. Linux Foundation Europe with Gabriele Columbro
  4. Updating open source dependencies with Jamie Tanna
  5. TARmageddon with Alex Zenla
  6. Can AI replace our dependencies?
  7. Python Security with Seth Larson
  8. Linux Vendor Firmware Service with Richard Hughes
  9. NPM supply chain attacks with Charlie Eriksen
  10. Detecting XZ in Debian with Otto Kekäläinen
  11. Eclipse Foundation SBOMs with Mikael Barbero
  12. Actually finding vulnerabilities using AI with Joshua Rogers
  13. Sustaining Package Repositories with Brian Fox
  14. Arch Linux Security with Foxboron and Anthraxx
  15. OpenSSL with Hana Andersen and Anton Arapov
  16. The Python Software Foundation with Deb Nicholson
  17. Using Mercator to map assets with Didier Barzin
  18. Talos Linux security with Andrey Smirnov
  19. Open Source is one person
  20. Discussing the Open Source, Open Threats? paper with Behzad and Ali
  21. crates.io trusted publishing with Tobias Bieniek
  22. CVE update with Patrick Garrity
  23. GCVE with Cédric Bonhomme and Alexandre Dulaunoy
  24. EU Regulations will change everything with Daniel Thompson
  25. Open source microprocessors with Jan Pleskac
  26. Package URLs with Philippe Ombredanne
  27. Hobbyist Maintainers with Thomas DePierre
  28. STIG automation with Aaron Lippold
  29. Ecosyste.ms with Andrew Nesbitt
  30. Curl vs AI with Daniel Stenberg
  31. Repository signing with Kairo De Araujo
  32. Securing GitHub Actions with William Woodruff
  33. Embedded Security with Paul Asadoorian
  34. tj-actions with Endor Lab's Dimitri Stiliadis
  35. What's happening with CVE
  36. Syft, Grype, and Grant with Alan Pope
  37. Can we trust CVE?
  38. CVE for EOL with Aaron Frost
  39. Why I didn't go to VulnCon
  40. cargo-semver-checks with Predrag Gruevski
  41. Distributed CI and Git with Lars Wirzenius
  42. FIDO authentication with William Brown
  43. CRA with Luis Villa
  44. Open Source Malware with Brian Fox
  45. Open Source Foundations with Kelley Misata of Suricata
  46. Forking Open Source Projects with Sheogorath
  47. Patching EOL Open Source with Aaron Frost
  48. Why do we keep ignoring CI security with François Proulx
  49. Modern day authentication with Marc Boorshtein
  50. CVEs for End of Life?
  51. Open Source Maintenance with Gary Kramlich
  52. Safety vs Security with Thomas Depierre
  53. The Future of Open Source Security

2024 56

  1. Episode 461 - The new NIST password guidance
  2. Episode 460 - Santa's Supply Chain Security
  3. Episode 459 - CWE Top 25 List
  4. Episode 458 - FBI endorses E2E encryption
  5. Episode 457 - The D-Link D-bacle
  6. Episode 456 - What if XZ happened to a company? The openness of open source
  7. Episode 455 - Wordpress plugin security
  8. Episode 454 - The state of open source with Brian Fox from Sonatype and Donald Fischer from Tidelift
  9. Episode 453 - Software Liability
  10. Episode 452 - All about Meshtastic
  11. Episode 451 - Python security with Seth Larson
  12. The useful uselessness of SBOMs
  13. Episode 450 - What's Wrong With WordPress
  14. Episode 449 - The CUPSpocalypse
  15. Episode 448 - What's wrong with CISA?
  16. Episode 447 - The Tidelift 2024 open source maintainer report
  17. Episode 446 - Researchers took over .MOBI TLD
  18. Episode 445 - EPSS with Jay Jacobs
  19. Episode 444 - Open Source and End of Life
  20. Episode 443 - The Supply Chain Security Crisis
  21. Episode 442 - The foundation of society, TLS certificates are a mess
  22. Episode 441 - Is CWE useful?
  23. Episode 440 - "What is open source" talk Josh gave
  24. Episode 439 - Where are all the youth in open source?
  25. Episode 438 - CISA's bad OSS advice vs the Whitehouse good advice
  26. Episode 437 - CocoPods and proper funding for open source
  27. Episode 436 - OpenSSH and node-ip - it's all exponential growth
  28. Episode 435 - polyfill.io - open source is too big to fix
  29. Episode 434 - Unreported vulnerabilities and everyone is getting hacked
  30. Episode 433 - Should OpenSSH block misbehaving clients?
  31. Episode 432 - Flipper Zero with Alex Kulagin
  32. Why are vulnerabilities out of control in 2024?
  33. Episode 431 - Redirecting HTTP to HTTPS
  34. Episode 430 - Frozen kernel security
  35. Episode 429 - The autonomy of open source developers
  36. Episode 428 - GitHub artifact attestation
  37. Episode 427 - Will run0 replace sudo?
  38. Episode 426 - Automatically exploiting CVEs with AI
  39. Episode 425 - Video game cheaters, also pretendo
  40. Episode 424 - The Notepad++ Parasite Website
  41. Episode 423 - FCC cybersecurity label for consumer devices
  42. XZ Bonus Spectacular Episode
  43. Episode 422 - Do you have a security.txt file?
  44. Episode 421 - CISA's new SSDF attestation form
  45. Episode 420 - What's going on at NVD
  46. Episode 419 - Malicious GitHub repositories
  47. Episode 418 - Being right all the time is hard
  48. Episode 417 - Linux Kernel security with Greg K-H
  49. Episode 416 - Thomas Depierre on open source in Europe
  50. Episode 415 - Reducing attack surface for less security
  51. Episode 414 - The exploited ecosystem of open source
  52. Episode 413 - PyTorch and NPM get attacked, but it's OK
  53. Episode 412 - Blame the users for bad passwords!
  54. Episode 411 - The security tools that started it all
  55. Episode 410 - Package identifiers are really hard
  56. Episode 409 - You wouldn't hack a train?

2023 54

  1. Episode 408 - Does Kubernetes need long term support?
  2. Episode 407 - Should Santa use AI?
  3. Episode 406 - The security of radio
  4. Episode 405 - Modding games isn't cheating and security isn't fair
  5. Episode 403 - Does the government banning apps work?
  6. Episode 402 - The EU's eIDAS regulation is a terrible idea
  7. Episode 401 - Security skills shortage - We've tried nothing and the same thing keeps happening
  8. Episode 400 - When can the government hack a victim?
  9. Episode 399 - Curl, Security, and Daniel Stenberg
  10. Episode 398 - Is only 11% of open source maintained?
  11. Episode 397 - The curl and glibc vulnerabilities
  12. Episode 396 - CLAs are bad, Mkay?
  13. Episode 395 - Uncertainty, trust, and security
  14. Episode 394 - The lie anyone can contribute to open source
  15. Episode 393 - Can you secure something you don't own?
  16. Episode 392 - Curl and the calamity of CVE
  17. Episode 391 - The Wordpress 100 year disaster recovery problem
  18. Episode 390 - Rust shipping binaries doesn't matter
  19. Episode 389 - What would HashiCorp do?
  20. Episode 388 - Video game vulnerabilities
  21. Episode 387 - Enterprise open source is different
  22. Episode 386 - We are watching web 2.0 burn
  23. Episode 385 - Is open source an insider threat?
  24. Episode 384 - What's next for open source?
  25. Episode 383 - Is open source dying?
  26. Episode 382 - Red Hat, you were the chosen one!
  27. Episode 381 - WTF Reddit, APIs and risk
  28. Episode 380 - A new Sovereign Tech Fund program and the BBC on destroying hard drives
  29. Episode 379 - Will open source save the world, again?
  30. Rocket ships and radishes
  31. Episode 378 - Naming things is harder than security
  32. Episode 377 - The world is changing too fast for humans to understand
  33. Episode 376 - Open Source Summit, who built your open source, and AI
  34. Episode 375 - The market forces of left-pad, Episode 77 remaster part 2
  35. Episode 374 - The event we called left-pad, Episode 77 remaster part 1
  36. Episode 373 – HHGG security, Episode 42 remaster part 2
  37. Episode 372 - HHGG security, Episode 42 remaster part 1
  38. Episode 371 - pip install is the tool we deserve but not the tool we need
  39. Episode 370 - Open Source is bigger than you can imagine
  40. Episode 369 - OpenAI broke ChatGPT then tried to blame open source
  41. Episode 368 - The Sovereign Tech Fund with Fiona Krakenbürger
  42. Episode 367 - Open source will never be the same
  43. Episode 366 - Software liability is coming
  44. Episode 365 - "I am not your supplier" with Thomas Depierre
  45. Episode 364 - Using SBOMs is hard
  46. Episode 363 - Joylynn Kirui from Microsoft on DevSecOps
  47. Episode 362 - A lesson in Rust from Carol Nichols
  48. Episode 361 - GitHub got pwnt, but it wasn't very exciting
  49. Episode 360 - Memory safety and the NSA
  50. Episode 359 - The NOTAM outage and other legacy technology
  51. Episode 358 - Furby vs Alexa
  52. Episode 357 - Is open source being overexploited?
  53. The perverse incentive of vulnerability counting
  54. Episode 356 - LastPass ducked up, now what?

2022 55

  1. Episode 355 - Security Boxing Day
  2. Episode 354 - Jerry Bell tells us why Mastodon is awesome and MFA is hard
  3. Episode 353 - Jill Moné-Corallo on GitHub's bug bounty program
  4. Episode 352 - Stylometry removes anonymity
  5. Episode 351 - Is security or usability a law of the universe?
  6. Episode 350 - Spam, Email, Content Moderation, and Infrastructure Oh My
  7. Episode 349 - The cyber is coming from inside the house - the UK is scanning itself
  8. Episode 348 - OpenSSL is the new lead paint
  9. Episode 347 - Airtags in luggage and weasel security - two peas in a suitcase
  10. Episode 346 - Security and working from home have terrible things in common
  11. Episode 345 - Cheap hacking devices turn security upside down
  12. Episode 344 - Python tarfile - 2022 is nothing like 2007
  13. Episode 343 - Stop trying to fix the open source software supply chain
  14. Episode 342 - Programming languages are the new operating system
  15. Holding open source to a higher standard
  16. Episode 341 - Time till open source alternative
  17. Episode 340 - Let's chat about Let's Encrypt with Josh Aas
  18. Why has software supply chain security exploded?
  19. Episode 339 - Is a network problem a security vulnerability
  20. Episode 338 - The government didn't make vulnerabilities illegal. Yet.
  21. Episode 337 - Security patches are getting worse - Dustin Childs from ZDI tells us why
  22. Episode 336 - We don't have data, we have security biases
  23. Episode 335 - Bull*&$% security ideas
  24. Episode 334 - Leap seconds break everything
  25. Episode 333 - Open Source is unfair
  26. Episode 332 - PyPI: 2FA or not 2FA, that is the question
  27. Episode 331 - GPG, but nothing makes sense
  28. Episode 330 - The sliding scale of risk: seeing the forest for the trees
  29. Episode 329 - Signing (What is it good for)
  30. Episode 328 - The Security of Jobs or Job Security
  31. Episode 327 - The security of alert fatigue
  32. Episode 326 - Big fat containers
  33. Episode 325 - Is one open source maintainer enough?
  34. Episode 324 - WTF is up with WFH
  35. Episode 323 - The fake 7-Zip vulnerability and SBOM
  36. Episode 322 - Adam Shostack on the security of Star Wars
  37. Episode 321 - Relativistic Security: Project Zero on 0day
  38. Episode 320 - Security Twitter is not the real world
  39. Episode 319 - Patch Tuesday with a capital T
  40. Episode 318 - Social engineering and why zlib got a 2018 CVE ID
  41. Episode 317 - The lack of compromise in security
  42. Episode 316 - You have to use open source
  43. Facts vs Feelings
  44. Episode 315 - Who even makes all these terrible decisions?
  45. Episode 314 - The Linux Dirty Pipe vulnerability
  46. Episode 313 - Insecurity at scale
  47. Episode 312 - The Legend of the SBOM
  48. Episode 311 - Did you scan the QR code?
  49. Episode 310 - Hayley Tsukayama from the EFF talks about privacy
  50. Episode 309 - The bright future of open source secuirty
  51. Episode 308 - Welcome to the jungle - How to talk about open source security
  52. Episode 307 - Got vulnerabilities? Introducing GSD
  53. Episode 306 - Open source isn't broken, it's an experience
  54. Episode 305 - Norton, Ethereum, NFT, and Apes
  55. Episode 304 - Will we ever fix all the vulnerabilities?

2021 58

  1. Episode 303 - Log4j Christmas Spectacular!
  2. Episode 302 - Log4j is a mess
  3. Episode 301 - You're holding it wrong: the importance of unlearning
  4. log4j is hard to find and harder to fix
  5. Episode 300 - Apple vs NSO: What can copyright do for you?
  6. Episode 299 - Experts From A World That No Longer Exists
  7. Episode 298 - David A Wheeler discusses the OpenSSF
  8. Episode 297 - 25 years of smashing stacks, fun, and profit
  9. Episode 296 - Is Trojan Source a vulnerability?
  10. Episode 295 - Open source security isn't free
  11. Episode 294 - Chris Wysopal on the state of security education
  12. Episode 293 - Scoring OpenSSF Security Scoring
  13. Episode 292 - Apache RCE and Twitch epic pwn
  14. Episode 291 - Everyone sucks at vulnerability disclosure
  15. Episode 290 - The security of the Matrix
  16. Episode 289 - Who left this 0day on the floor?
  17. Episode 288 - Linux Kernel compiler warnings considered dangerous
  18. Episode 287 - Is GitHub's Copilot the new Clippy?
  19. Episode 286 - Open source supply chain with Google's Dan Lorenc
  20. Episode 285 - Open source owes you nothing!
  21. Episode 284 - What happens when we DRM power tools?
  22. Episode 283 - When vulnerability disclosure becomes dangerous
  23. Episode 282 - The security of Rust: who left all this awesome in here?
  24. Episode 281 - If you spy on journalists, you're the bad guys
  25. Episode 280 - The perils of Single Sign On
  26. The future of DWF
  27. Episode 279 - The audacity of Audacity: When open source goes rogue
  28. Episode 278 - Could SELinux have stopped SolarWinds?
  29. Episode 277 - Privacy and activism with Chris Weiland
  30. Episode 276 - Security, behavior, and the environment
  31. Episode 275 - What in the @#$% is going on with ransomware?
  32. Episode 274 - Mr. Amazon's Neighborhood
  33. Episode 273 - Can we stop the coming artificial unintelligence deluge?
  34. Episode 272 - The Biden Cybersecurity Executive Order
  35. Episode 271 - Pipeline security: There is no problem humans can't make worse
  36. Episode 270 - Hello dark patterns my old friend
  37. Episode 269 - Do not experiment on the Linux Kernel
  38. Episode 268 - Can we trust any 3rd parties?
  39. Episode 267 - Does 0day still mean 0day?
  40. Episode 266 - The future of security scanning with Debricked
  41. Episode 265 - The lies closed source can tell, open source can't
  42. It's time to fix CVE
  43. Episode 264 - DevSecOps with GitLab's Mark Loveless
  44. Episode 263 - GitHub pulls exploits, LinuxFoundation sign all the things
  45. Episode 262 - A discussion with Loris and Pop from Sysdig
  46. Episode 261 - DWF is back! Welcome to community powered CVE
  47. Episode 260 - Dave Jevans tells us what CipherTrace is up to
  48. Episode 259 - What even is open source anymore?
  49. The Titanic of security
  50. Episode 258 - Stop using C
  51. Episode 257 - The sudo and libgcrypt vulnerabilities
  52. It's the community, stupid
  53. Episode 256 - 9 bits of podcast, 8 bits of computing
  54. You cannot manage your supply chain
  55. Episode 255 - What if security wasn't joyless?
  56. Episode 254 - Right to Repair Security
  57. Episode 253 - Defenders only need to be right once
  58. Episode 252 - Is open source dangerous? Open source won, who cares, shut up!

2020 89

  1. Episode 251 - Communication is hard, security communication is more hard
  2. Episode 250 - Door 25: Why do we do the things we do? Question everything
  3. Episode 249 - Door 24: Information wants to be free
  4. Episode 248 - Door 23: How to report 1000 security flaws
  5. Episode 247 - Door 22: How to report one security flaw
  6. Episode 246 - Door 21: Bug bounties
  7. Episode 245 - Door 20: Is SMS 2FA better than no 2FA?
  8. Episode 244 - Door 19: TLS certificate trust
  9. Episode 243 - Door 18: Don't roll your own crypto or auth
  10. Episode 242 - Door 17: Vulnerability response
  11. Episode 241 - Door 16: 16 bits of change
  12. Episode 240 - Door 15: Supplier compliance
  13. Committee or Community: Slowing down the future
  14. Episode 239 - Door 14: Backdoors
  15. Episode 238 - Door 13: Unlucky or survivor bias?
  16. Episode 237 - Door 12: Video game hacking
  17. Episode 236 - Door 11: Should you get on a 737?
  18. Episode 235 - Door 10: Deciding what information matters
  19. Episode 234 - Door 09: public key cryptography
  20. Episode 233 - Door 08: man 8 security
  21. Episode 232 - Door 07: 7 is the best prime, 2 is the dumbest
  22. Episode 231 - Door 06: 6 wifi risks ... that don't actually matter
  23. Episode 230 - Door 05: 5 reasons you need 24/7 robot monitoring
  24. Episode 229 - Door 04: EFF's Cover Your Tracks
  25. Episode 228 - Door 03: Do all vulnerabilities matter equally?
  26. Episode 227 - Door 02: Marketing department or selection bias?
  27. Episode 226 - Door 01: Advent calendars
  28. Episode 225 - Who is responsible if IoT burns down your house?
  29. We can't move forward by looking back
  30. Episode 224 - Are old Android devices dangerous?
  31. Episode 223 - Full disclosure won, deal with it
  32. Episode 222 - HashiCorp Boundary with Jeff Mitchell
  33. Episode 221 - Security, magic, and FaceID
  34. Episode 220 - Securing network time and IoT
  35. Episode 219 - Chat with Larry Cashdollar
  36. Episode 218 - The past was a terrible place
  37. A bug by any other name
  38. Episode 217 - How to tell your story with Travis Murdock
  39. Episode 216 - Security didn't find life on Venus
  40. Episode 215 - Real security is boring
  41. Episode 213 - Security Signals: What are you telling the world
  42. We take security seriously, VERY SRSLY!
  43. Episode 212 - Grab Bag: The Security We Deserve Edition
  44. 2020 CWE Top 25 I mean 10 or maybe 4.5
  45. Episode 211 - The only thing harder than signing files is managing users
  46. Episode 210 - Cult of Information Security
  47. Episode 209 - Secure Boot isn't Secure
  48. Episode 208 - Passwords are pollution
  49. Episode 207 - Weaponized attention
  50. Episode 206 - Confidential Virtual Machines; The future of cloud computing
  51. Episode 205 - The State of Open Source Security with Alyssa Miller from Snyk
  52. Episode 204 - What Would Apple Do?
  53. Episode 203 - Humans, conferences, and security: let me think and get back to you in a bit
  54. The ineffective CISO
  55. Episode 202 - The convergence of application security
  56. Episode 201 - We broke CVSSv3, now how do we fix it?
  57. Episode 200 - Talking Container Security with Liz Rice
  58. Episode 199 - Special cases are special: DNS, Websockets, and CSV
  59. Broken vulnerability severities
  60. Episode 198 - Good advice or bad advice? Hang up, look up, and call back
  61. Episode 197 - Beer, security, and consistency; the newer, better, triad
  62. Episode 196 - Pounding square solutions into round holes: forced updates from Ubuntu
  63. Episode 195 - Is BGP actually insecure?
  64. Episode 194 - Working from home security: resistance is futile
  65. Episode 193 - Security lessons from space: Apollo 13 edition
  66. Episode 192 - Work without progress - what Infosec can learn from treadmills
  67. Episode 191 - Security scanners are all terrible
  68. Who are the experts
  69. Episode 190 - Building a talent "ecosystem"
  70. Episode 189 - Video game hackers - speedrunning
  71. Part 6: What do we do now?
  72. Part 5: Which of these security problems do I need to care about?
  73. Part 4: Application scanning
  74. Episode 188 - Depressing news sucks, we're talking about cheating in video games
  75. Episode 187 - Wireguard vs IPsec: the OK Boomer of security
  76. Part 3: Composition scanning
  77. Part 2: Scanning the code
  78. Part 1: Is your security scanner running? You better go catch it!
  79. The Security Scanner Problem
  80. Episode 186 - Endpoint security with Tony Meehan
  81. Episode 185 - Is it even possible to fix open source security?
  82. Episode 184 - It’s DNS. It's always DNS
  83. Episode 183 - The great working from home experiment
  84. Episode 182 - Does open source owe us anything?
  85. Episode 181 - The security of SIM swapping
  86. Episode 180 - A Tale of Two Vulnerabilities
  87. Episode 179 - Google Project Zero and the 90 day clock
  88. Episode 178 - Are CVEs important and will ransomware put you out of business?
  89. Episode 177 - Fake or real? The security of counterfeit goods

2019 56

  1. Episode 176 - The 'predictions are stupid' prediction episode
  2. Episode 175 - Defenders will always be one step behind
  3. Episode 174 - GitHub turns security up to 11; A discussion with Rob Schultheis
  4. Episode 173 - Ho Ho Homeland Security
  5. Episode 172 - The security of planned obsolescence
  6. Episode 171 - Measuring cybersecurity with Kathryn Waldron
  7. Episode 170 - Until that quantum computer is cracking RSA keys, go sit back down!
  8. Episode 169 - What happens when leadership doesn't care about security?
  9. Episode 168 - The draconian draconians of DRM
  10. Episode 167 - Security is terrible because digital literacy is terrible
  11. Episode 166 - Every day should be cybersecurity awareness month!
  12. Episode 165 - Grab Bag of Microsoft Security News
  13. Episode 164 - DNS over HTTPS: Probably not the end of the world
  14. Episode 163 - Death to Python 2
  15. Episode 162 - SBOM with Allan Friedman
  16. Episode 161 - Human nature and ad powered open source
  17. Episode 160 - Disclosing security issues is insanely complicated: Part 2
  18. Episode 159 - Disclosing security issues is insanely complicated: Part 1
  19. Backdoors in open source are here to stay
  20. Episode 158 - The mess that we call credit agencies in the US
  21. Episode 157 - Backdoors and snake oil in our cryptography
  22. Appsec isn't people
  23. Episode 156 - What if we MitM a whole country?
  24. Why you can't backdoor cryptography
  25. Episode 155 - Stealing cars and ransomware
  26. Episode 154 - Chat with the authors of the book "The Fifth Domain"
  27. Episode 153 - The unexpected security of AI, photographs, and VPN
  28. Episode 152 - Tavis breaks the world ... again
  29. Episode 151 - The DARPA Cyber Grand Challenge with David Brumley
  30. Episode 150 - Our ad funded dystopian present
  31. Episode 149 - Chat with Michael Coates about data security
  32. Episode 148 - You just got pwnt, what now?
  33. Episode 147 - Scams and operations as part of the supply chain
  34. Episode 146 - What the @#$% happened to Microsoft?
  35. Episode 145 - What do security and fire have in common?
  36. Episode 144 - The security of money, which one is best?
  37. Episode 143 - Security lessons from the phone book
  38. Episode 142 - Hypothetical security: what if you find a USB flash drive?
  39. Episode 141 - Timezones are hard, security is harder
  40. The security of dependencies
  41. Episode 140 - Good enough security is a pretty high bar
  42. Supplying the supply chain
  43. Episode 139 - Secure voting, firefox send, and toxic comments on the internet
  44. Episode 138 - Information wants to be free
  45. Episode 137.5 - Holy cow Beto was in the cDc, this is awesome!
  46. Episode 137 - When the IoT attacks!
  47. Episode 136 - How people feel is more important than being right
  48. Episode 135 - Passwords, AI, and cloud strategy
  49. Episode 134 - What's up with the container runc security flaw?
  50. Episode 133 - Smart locks and the government hacking devices
  51. Episode 132 - Bird Scooter: 0, Cory Doctorow: 1
  52. Episode 131 - Windows micropatches, Google's privacy fine, and Mastercard fixes trial abuse
  53. Episode 130 - Chat with Snyk co-founder Danny Grander
  54. Security isn't a feature
  55. Episode 129 - The EU bug bounty program
  56. Episode 128 - Australia's encryption backdoor bill

2018 66

  1. Misguided misguidings over the EU bug bounty
  2. 2018 Christmas Special - Is Santa GDPR compliant?
  3. Episode 127 - Walled gardens, appstores, and more
  4. Episode 126 - The not so dire future of supply chain security
  5. Episode 125 - Open Source, supply chains, npm, and you
  6. What's up with backdoored npm packages?
  7. Episode 124 - Cloudflare's service workers and the economics of security
  8. Dependencies in open source
  9. Episode 123 - Talking about Kubernetes and container security with Liz Rice
  10. Episode 122 - What will Apple's T2 chip mean for the rest of us?
  11. Episode 121 - All about the security of voting
  12. Episode 120 - Bloomberg and hardware backdoors - it's already happening
  13. Targeted vs General purpose security
  14. Episode 119 - The Google+ and Facebook incidents, it's not your data anymore
  15. Episode 118 - Cloudflare's IPFS and onion service
  16. Episode 117 - Will security follow Linus' lead on being nice?
  17. Millions of unfixed security flaws is a lie
  18. Episode 116 - The future of the CISO with Michael Piacente
  19. Episode 115 - Discussion with Brian Hajost from SteelCloud
  20. Episode 114 - Review of "Click Here to Kill Everybody"
  21. Episode 113 - Actual real security advice
  22. Episode 112 - Google's Titan Key and the latest Struts issue
  23. Security reviews and microservices
  24. Episode 111 - The TLS 1.3 and DNS episode
  25. Actionable Advice
  26. Episode 110 - Review of Black Hat, Defcon, and the effect of security policies
  27. Episode 109 - OSCon and actionable advice
  28. Episode 108 - Bluetooth, phishing, airgaps, and eating soup off the floor
  29. Episode 107 - The year of the Linux Desktop and other hardware stories
  30. Episode 106 - Data isn't oil, it's nuclear waste
  31. Episode 105 - More backdoors in open source
  32. The father of modern security: B. F. Skinner
  33. Episode 104 - The Gentoo security incident
  34. Episode 103 - The Seven Properties of Highly Secure Devices
  35. Episode 102 - Michael Feiertag from tCell
  36. Episode 101 - Our unregulated future is here to stay
  37. Episode 100 - You're bad at buying security, we can help!
  38. Security ROI isn't impossible, we suck at measuring
  39. Episode 99 - Consumer security is too broken to fix, and it doesn't matter
  40. Episode 98 - When IT decisions kill people
  41. Episode 97 - Automation: Humans are slow and dumb
  42. Helicopter security
  43. Episode 96 - Are legal backdoors a good idea?
  44. Episode 95 - Twitter passwords and npm backdoors
  45. Episode 94 - DNSSEC, BGP, and reality
  46. Episode 93 - Security flaws in beep and patch, how did we get here?
  47. Episode 92 - Chat with Rami Saas the CEO of WhiteSource
  48. Episode 91 - Security lessons from a 7 year old
  49. Spend until you're secure
  50. Episode 90 - Humans and misinformation
  51. Episode 89 - Short selling AMD security flaws
  52. Episode 88 - Chat with Chris Rosen from IBM about Container Security
  53. Episode 87 - Chat with Let's Encrypt co-founder Josh Aas
  54. But that's not my job!
  55. Episode 86 - What happens when 23 thousand certificates leak?
  56. Episode 85 - NPM ate my files
  57. Episode 84 - Have I been pwned?
  58. Episode 83 - XKCD + CVE = XKCVE
  59. Episode 82 - RSA, TLS, Chrome HTTP, and PCI
  60. Episode 81 - Autosploit, bug bounties, and the future of security
  61. Episode 80 - GPS tracking and jamming
  62. Episode 79 - Skyfall: please don't yell 'fire'
  63. Episode 78 - Risk lessons from Hawaii
  64. Episode 77 - npm and the supply chain
  65. Episode 76 - Meltdown aftermath
  66. Security and privacy are the same thing

2017 78

  1. Episode 75 - Security Planner review
  2. Episode 74 - Facial recognition and physical security
  3. Episode 73 - Security from Santa
  4. Episode 72 - Bitcoin: It's over 9000
  5. Episode 71 - GitHub's Security Scanner
  6. Episode 70 - The security of Intel ME
  7. Episode 69 - Actionable security advice
  8. Episode 68 - Ruining the Internet
  9. Episode 67 - Cyber won
  10. Episode 66 - Objects in mirror are less terrible than they appear
  11. Episode 65 - Will aliens overthrow us before AI?
  12. Episode 64 - Networks and Dnsmasq and IoT oh my
  13. Episode 63 - Shoot, Shovel, and Bury
  14. Episode 62 - All about the Equifax hack
  15. Episode 61 - Market driven security
  16. Episode 60 - The official blockchain episode
  17. Episode 59 - The VPN Episode
  18. Episode 58 - Backwards compatibility to the point of insanity
  19. Episode 57 - We may never see amazing security research ever again
  20. Summer is coming
  21. Episode 56 - Devil's Advocate and other fuzzy topics
  22. Episode 55 - Good docs ruin my story
  23. Who's got your hack back?
  24. Episode 54 - Turning into an old person
  25. Episode 53 - A plane isn't like a car
  26. When in doubt, blame open source
  27. Episode 52 - You could have done it right, but you didn't
  28. Thought leaders aren't leaders
  29. Episode 51 - All about CVE
  30. Humanity isn't proactive
  31. Episode 50 - This is a security podcast after all
  32. Free Market Security
  33. Episode 49 - Testing software is impossible
  34. Stealing from customers
  35. You know how to fix enterprise patching? Please tell me more!!!
  36. Episode 48 - Machine Learning: Not actually magic
  37. Episode 47 - WannaCry: Everything is basically broken
  38. Episode 46 - Turns out I'm not a bad guy
  39. Security like it's 2005!
  40. Episode 45 - Trust is more important now than the truth
  41. Security fail is people
  42. Episode 44 - Bug Bounties vs Pen Testing
  43. I have seen the future, and it is bug bounties
  44. Episode 43 - We are totally immature
  45. Crawl, Walk, Drive
  46. Episode 42 - Hitchhiker's Guide to Security
  47. The obvious answer is never the secure answer
  48. Episode 41 - All your money are belong to us
  49. The expectation of security
  50. Episode 40 - Let's fork bitcoin, again
  51. Remember kids, if you're going to disclose, disclose responsibly!
  52. Episode 39 - Flash on your dishwasher
  53. Inverse Law of CVEs
  54. Episode 38 - We Ruin Everything
  55. Security, Consumer Reports, and Failure
  56. Episode 37 - Your bathtub is more dangerous than a shark
  57. Episode 36 - A Good Enough Podcast
  58. What the Oscars can teach us about security
  59. Episode 35 - Crazy Cosmic Accident
  60. SHA-1 is dead, long live SHA-1!
  61. Episode 34 - Bathing in Ebola Virus
  62. Episode 33 - Everybody who went to the circus is in the circus (RSA 2017)
  63. Reality Based Security
  64. Episode 32 - Gambling as a Service
  65. Episode 31 - XML is never the solution
  66. Everything you know about security is wrong, stop protecting your empire!
  67. Episode 30 - I'm not an expert but I've been yelled at by experts
  68. Return on Risk Investment
  69. Episode 29 - The Security of Rogue One
  70. Episode 28 - RSA Conference 2017
  71. What does security and USB-C have in common?
  72. Episode 27 - Prove to me you are human
  73. Episode 26 - Tell your sister, Stallman was right
  74. Episode 25 - The future is now
  75. Security Advice: Bad, Terrible, or Awful
  76. Looks like you have a bad case of embedded libraries
  77. Episode 24 - The 2016 prediction edition! (yeah, that's right, 2016)
  78. Future Proof Security

2016 77

  1. Episode 23 - We can't patch people
  2. The art of cutting edge, Doom 2 vs the modern Security Industry
  3. Episode 22 - IoT Wild West
  4. Episode 21 - CVE 10K Extravaganza
  5. Does "real" security matter?
  6. Episode 20 - The Death of PGP
  7. Episode 19 - A field full of razor blades and monsters
  8. Episode 18 - The Security of Santa
  9. Episode 17 - Cyphercon Interview with Korgo
  10. Airports, Goats, Computers, and Users
  11. Episode 16 - Cat and mouse
  12. Episode 15 - Cyber Black Monday
  13. The Economics of stealing a Tesla with a phone
  14. Episode 14 - David A Wheeler: CII Badges
  15. Fast security is the best security
  16. Episode 13 - CVE: The metric system of security
  17. Who cares if someone hacks my driveway camera?
  18. Episode 12 - Security Trebuchet
  19. Free security is the only security that really works
  20. Stop being the monkey's paw
  21. Episode 11 - The Poison Candy Episode
  22. Security is in the same leaky boat as the sysadmins
  23. Episode 10 - The super botnet that nobody can stop
  24. Everything you know about security is wrong
  25. IoT Can Never Be Fixed
  26. Episode 9 - Are bug bounties measuring the wrong things?
  27. Can I interest you in talking about Security?
  28. Episode 8 - The primality of prime numbers
  29. Episode 7 - More Powerful than root!
  30. Impossible is impossible!
  31. Episode 6 - Foundational Knowledge of Security
  32. Episode 5 - OpenSSL: The library we deserve
  33. Who left all this fire everywhere?
  34. Episode 4 - Dead squirrel in a box
  35. Is dialup still an option?
  36. Why do we do security?
  37. Episode 3 - The Lockpicking Sewing Circle
  38. On Experts
  39. Episode 2 - Instills the proper amount of fear
  40. Episode 1 - Rich History of Security Flaws
  41. You can't weigh risk if you don't know what you don't know
  42. How do we explain email to an "expert"?
  43. The cost of mentoring, or why we need heroes
  44. Can't Trust This!
  45. We're figuring out the security problem (finally)
  46. Everyone has been hacked
  47. Using a HooToo Nano as a magic VPN box
  48. Entry level AI
  49. But I have work to do!
  50. The future of security
  51. Decentralized Security
  52. Ready to form Voltron! why security is like a giant robot make of lions
  53. Is there a future view that isn't a security dystopia?
  54. Regulation can fix security, except you can't regulate security
  55. Thoughts on our security bubble
  56. Security will fix itself, eventually
  57. Security isn't a feature, it's a part of everything
  58. Trusting, Trusting Trust
  59. Can we train our way out of security flaws?
  60. Software end of life matters!
  61. What happened with Badlock?
  62. Cybersecurity education isn't good, nobody is shocked
  63. Security is really about Risk vs Reward
  64. Ransomware is scary, but not for the reasons you think it is
  65. I'm going to do something really cool in 3 weeks! ... Probably.
  66. Everything is fine, nothing to see here!
  67. Containers are like sandwiches
  68. The interesting things from RSA are what didn't happen, and containers are sandwiches
  69. Let's talk about soft skills at RSA, plus some other things
  70. Thinking about glibc and Heartbleed, how do fix things
  71. Change direction, increase speed! (or why glibc changes nothing)
  72. glibc for humans
  73. Does the market care about security?
  74. Security and Tribal Knowledge
  75. OpenSSH, security, and everyone else
  76. What the lottery and security have in common
  77. A security analogy that works

2015 18

  1. Security reminds me of the gym on January 2
  2. A Christmas Cyber
  3. Security is the new paperless office!
  4. Security lacks patience
  5. Where is the physical trust boundary?
  6. If your outcome is perfect or nothing, nothing always wins
  7. Your containers were built in some guy's barn!
  8. Is the Linux ransomware the first of many?
  9. The Third Group
  10. How do we talk to normal people?
  11. How do we talk to business?
  12. What's filling the vacuum?
  13. We're losing the battle for security
  14. How to build trust
  15. How can we describe a buffer overflow in common terms?
  16. Being a nice security person
  17. Everyone is afraid of us
  18. You are bad at talking to people

2001 2

  1. Contact Info
  2. Feeds