Episode 199 – Special cases are special: DNS, Websockets, and CSV

Josh and Kurt talk about a grab bag of topics. A DNS security flaw, port scanning your machine from a web browser, and CSV files running arbitrary code. All of these things end up being the result of corner cases. Letting a corner case be part of a default setup is always a mistake. YesContinue reading “Episode 199 – Special cases are special: DNS, Websockets, and CSV”

Episode 198 – Good advice or bad advice? Hang up, look up, and call back

Josh and Kurt talk about the Krebs blog post titled “When in Doubt: Hang Up, Look Up, & Call Back”. In the world of security there isn’t a lot of actionable advice, it’s worth discussing if something like this will work, or ever if it’s the right way to handle these situations. Show Notes When in Doubt:Continue reading “Episode 198 – Good advice or bad advice? Hang up, look up, and call back”

Episode 197 – Beer, security, and consistency; the newer, better, triad

Josh and Kurt talk about what beer and reproducible builds have in common. It’s a lot more than you think, and it mostly comes down to quality control. If you can’t reproduce what you do, you’re not a mature organization and you need maturity to have quality. Show Notes Reinheitsgebot Josh’s Blog Post Ken Thompson’s reflections onContinue reading “Episode 197 – Beer, security, and consistency; the newer, better, triad”

Episode 196 – Pounding square solutions into round holes: forced updates from Ubuntu

Josh and Kurt talk about automatic updates. Specifically we discuss a recent decision by Ubuntu to enable forced automatic updates. There are lessons here for the security community. We have a history of jumping to solutions rather than defining and understanding problems. Sometimes our solutions aren’t the best. Also murder bees. Show Notes The Oatmeal giant beeContinue reading “Episode 196 – Pounding square solutions into round holes: forced updates from Ubuntu”

Episode 195 – Is BGP actually insecure?

Josh and Kurt talk about the uproar around Cloudflare’s “Is BGP safe yet” site. It’s always interesting watching how much people will push back on new things, even if the new things is probably a step in the right direction. The clever thing Cloudflare is doing in this instance is they are making the BGP problem somethingContinue reading “Episode 195 – Is BGP actually insecure?”