Archive

2025  5

January  5

CVEs for End of Life?

January 28, 2025 · Josh Bressers

Government Security Requirements with Dick Brooks

January 27, 2025 · Josh Bressers

Open Source Maintenance with Gary Kramlich

January 20, 2025 · Josh Bressers

Safety vs Security with Thomas Depierre

January 13, 2025 · Josh Bressers

The Future of Open Source Security

January 1, 2025 · Josh Bressers

2024  56

December  5

Episode 461 - The new NIST password guidance

December 30, 2024

Episode 460 - Santa’s Supply Chain Security

December 23, 2024

Episode 459 - CWE Top 25 List

December 16, 2024

Episode 458 - FBI endorses E2E encryption

December 9, 2024

Episode 457 - The D-Link D-bacle

December 2, 2024

November  4

Episode 456 - What if XZ happened to a company? The openness of open source

November 25, 2024

Episode 455 - Wordpress plugin security

November 18, 2024

Episode 454 - The state of open source with Brian Fox from Sonatype and Donald Fischer from Tidelift

November 11, 2024

Episode 453 - Software Liability

November 4, 2024

October  5

Episode 452 - All about Meshtastic

October 28, 2024

Episode 451 - Python security with Seth Larson

October 21, 2024

The useful uselessness of SBOMs

October 15, 2024

Episode 450 - What’s Wrong With WordPress

October 14, 2024

Episode 449 - The CUPSpocalypse

October 7, 2024

September  5

Episode 448 - What’s wrong with CISA?

September 30, 2024

Episode 447 - The Tidelift 2024 open source maintainer report

September 23, 2024

Episode 446 - Researchers took over .MOBI TLD

September 16, 2024

Episode 445 - EPSS with Jay Jacobs

September 9, 2024

Episode 444 - Open Source and End of Life

September 2, 2024

August  4

Episode 443 - The Supply Chain Security Crisis

August 26, 2024

Episode 442 - The foundation of society, TLS certificates are a mess

August 19, 2024

Episode 441 - Is CWE useful?

August 12, 2024

Episode 440 - “What is open source” talk Josh gave

August 5, 2024

July  5

Episode 439 - Where are all the youth in open source?

July 29, 2024

Episode 438 - CISA’s bad OSS advice vs the Whitehouse good advice

July 22, 2024

Episode 437 - CocoPods and proper funding for open source

July 15, 2024

Episode 436 - OpenSSH and node-ip - it’s all exponential growth

July 8, 2024

Episode 435 - polyfill.io - open source is too big to fix

July 1, 2024

June  5

Episode 434 - Unreported vulnerabilities and everyone is getting hacked

June 24, 2024

Episode 433 - Should OpenSSH block misbehaving clients?

June 17, 2024

Episode 432 - Flipper Zero with Alex Kulagin

June 10, 2024

Why are vulnerabilities out of control in 2024?

June 3, 2024

Episode 431 - Redirecting HTTP to HTTPS

June 3, 2024

May  4

Episode 430 - Frozen kernel security

May 27, 2024

Episode 429 - The autonomy of open source developers

May 20, 2024

Episode 428 - GitHub artifact attestation

May 13, 2024

Episode 427 - Will run0 replace sudo?

May 6, 2024

April  6

Episode 426 - Automatically exploiting CVEs with AI

April 29, 2024

Episode 425 - Video game cheaters, also pretendo

April 22, 2024

Episode 424 - The Notepad++ Parasite Website

April 15, 2024

Episode 423 - FCC cybersecurity label for consumer devices

April 8, 2024

XZ Bonus Spectacular Episode

April 1, 2024

Episode 422 - Do you have a security.txt file?

April 1, 2024

March  4

Episode 421 - CISA’s new SSDF attestation form

March 25, 2024

Episode 420 - What’s going on at NVD

March 18, 2024

Episode 419 - Malicious GitHub repositories

March 11, 2024

Episode 418 - Being right all the time is hard

March 4, 2024

February  4

Episode 417 - Linux Kernel security with Greg K-H

February 26, 2024

Episode 416 - Thomas Depierre on open source in Europe

February 19, 2024

Episode 415 - Reducing attack surface for less security

February 12, 2024

Episode 414 - The exploited ecosystem of open source

February 5, 2024

January  5

Episode 413 - PyTorch and NPM get attacked, but it’s OK

January 29, 2024

Episode 412 - Blame the users for bad passwords!

January 22, 2024

Episode 411 - The security tools that started it all

January 15, 2024

Episode 410 - Package identifiers are really hard

January 8, 2024

Episode 409 - You wouldn’t hack a train?

January 1, 2024

2023  54

December  4

Episode 408 - Does Kubernetes need long term support?

December 25, 2023

Episode 407 - Should Santa use AI?

December 18, 2023

Episode 406 - The security of radio

December 11, 2023

Episode 405 - Modding games isn’t cheating and security isn’t fair

December 4, 2023

November  4

Episode 403 - Does the government banning apps work?

November 27, 2023

Episode 402 - The EU’s eIDAS regulation is a terrible idea

November 20, 2023

Episode 401 - Security skills shortage - We’ve tried nothing and the same thing keeps happening

November 13, 2023

Episode 400 - When can the government hack a victim?

November 6, 2023

October  5

Episode 399 - Curl, Security, and Daniel Stenberg

October 30, 2023

Episode 398 - Is only 11% of open source maintained?

October 23, 2023

Episode 397 - The curl and glibc vulnerabilities

October 16, 2023

Episode 396 - CLAs are bad, Mkay?

October 9, 2023

Episode 395 - Uncertainty, trust, and security

October 2, 2023

September  4

Episode 394 - The lie anyone can contribute to open source

September 25, 2023

Episode 393 - Can you secure something you don’t own?

September 18, 2023

Episode 392 - Curl and the calamity of CVE

September 11, 2023

Episode 391 - The Wordpress 100 year disaster recovery problem

September 4, 2023

August  4

Episode 390 - Rust shipping binaries doesn’t matter

August 28, 2023

Episode 389 - What would HashiCorp do?

August 21, 2023

Episode 388 - Video game vulnerabilities

August 14, 2023

Episode 387 - Enterprise open source is different

August 7, 2023

July  5

Episode 386 - We are watching web 2.0 burn

July 31, 2023

Episode 385 - Is open source an insider threat?

July 24, 2023

Episode 384 - What’s next for open source?

July 17, 2023

Episode 383 - Is open source dying?

July 10, 2023

Episode 382 - Red Hat, you were the chosen one!

July 3, 2023

June  5

Episode 381 - WTF Reddit, APIs and risk

June 26, 2023

Episode 380 - A new Sovereign Tech Fund program and the BBC on destroying hard drives

June 19, 2023

Episode 379 - Will open source save the world, again?

June 12, 2023

Rocket ships and radishes

June 7, 2023

Episode 378 - Naming things is harder than security

June 5, 2023

May  5

Episode 377 - The world is changing too fast for humans to understand

May 29, 2023

Episode 376 - Open Source Summit, who built your open source, and AI

May 22, 2023

Episode 375 - The market forces of left-pad, Episode 77 remaster part 2

May 15, 2023

Episode 374 - The event we called left-pad, Episode 77 remaster part 1

May 8, 2023

Episode 373 – HHGG security, Episode 42 remaster part 2

May 1, 2023

April  4

Episode 372 - HHGG security, Episode 42 remaster part 1

April 24, 2023

Episode 371 - pip install is the tool we deserve but not the tool we need

April 17, 2023

Episode 370 - Open Source is bigger than you can imagine

April 10, 2023

Episode 369 - OpenAI broke ChatGPT then tried to blame open source

April 3, 2023

March  4

Episode 368 - The Sovereign Tech Fund with Fiona Krakenbürger

March 27, 2023

Episode 367 - Open source will never be the same

March 20, 2023

Episode 366 - Software liability is coming

March 13, 2023

Episode 365 - “I am not your supplier” with Thomas Depierre

March 6, 2023

February  4

Episode 364 - Using SBOMs is hard

February 27, 2023

Episode 363 - Joylynn Kirui from Microsoft on DevSecOps

February 20, 2023

Episode 362 - A lesson in Rust from Carol Nichols

February 13, 2023

Episode 361 - GitHub got pwnt, but it wasn’t very exciting

February 6, 2023

January  6

Episode 360 - Memory safety and the NSA

January 30, 2023

Episode 359 - The NOTAM outage and other legacy technology

January 23, 2023

Episode 358 - Furby vs Alexa

January 16, 2023

Episode 357 - Is open source being overexploited?

January 9, 2023

The perverse incentive of vulnerability counting

January 3, 2023

Episode 356 - LastPass ducked up, now what?

January 2, 2023

2022  55

December  4

Episode 355 - Security Boxing Day

December 26, 2022

Episode 354 - Jerry Bell tells us why Mastodon is awesome and MFA is hard

December 19, 2022

Episode 353 - Jill Moné-Corallo on GitHub’s bug bounty program

December 12, 2022

Episode 352 - Stylometry removes anonymity

December 5, 2022

November  4

Episode 351 - Is security or usability a law of the universe?

November 28, 2022

Episode 350 - Spam, Email, Content Moderation, and Infrastructure Oh My

November 21, 2022

Episode 349 - The cyber is coming from inside the house - the UK is scanning itself

November 14, 2022

Episode 348 - OpenSSL is the new lead paint

November 7, 2022

October  5

Episode 347 - Airtags in luggage and weasel security - two peas in a suitcase

October 31, 2022

Episode 346 - Security and working from home have terrible things in common

October 24, 2022

Episode 345 - Cheap hacking devices turn security upside down

October 17, 2022

Episode 344 - Python tarfile - 2022 is nothing like 2007

October 10, 2022

Episode 343 - Stop trying to fix the open source software supply chain

October 3, 2022

September  6

Episode 342 - Programming languages are the new operating system

September 26, 2022

Holding open source to a higher standard

September 25, 2022

Episode 341 - Time till open source alternative

September 19, 2022

Episode 340 - Let’s chat about Let’s Encrypt with Josh Aas

September 12, 2022

Why has software supply chain security exploded?

September 6, 2022

Episode 339 - Is a network problem a security vulnerability

September 5, 2022

August  5

Episode 338 - The government didn’t make vulnerabilities illegal. Yet.

August 29, 2022

Episode 337 - Security patches are getting worse - Dustin Childs from ZDI tells us why

August 22, 2022

Episode 336 - We don’t have data, we have security biases

August 15, 2022

Episode 335 - Bull*&$% security ideas

August 8, 2022

Episode 334 - Leap seconds break everything

August 1, 2022

July  4

Episode 333 - Open Source is unfair

July 25, 2022

Episode 332 - PyPI: 2FA or not 2FA, that is the question

July 18, 2022

Episode 331 - GPG, but nothing makes sense

July 11, 2022

Episode 330 - The sliding scale of risk: seeing the forest for the trees

July 4, 2022

June  4

Episode 329 - Signing (What is it good for)

June 27, 2022

Episode 328 - The Security of Jobs or Job Security

June 20, 2022

Episode 327 - The security of alert fatigue

June 13, 2022

Episode 326 - Big fat containers

June 6, 2022

May  5

Episode 325 - Is one open source maintainer enough?

May 30, 2022

Episode 324 - WTF is up with WFH

May 23, 2022

Episode 323 - The fake 7-Zip vulnerability and SBOM

May 16, 2022

Episode 322 - Adam Shostack on the security of Star Wars

May 9, 2022

Episode 321 - Relativistic Security: Project Zero on 0day

May 2, 2022

April  4

Episode 320 - Security Twitter is not the real world

April 25, 2022

Episode 319 - Patch Tuesday with a capital T

April 18, 2022

Episode 318 - Social engineering and why zlib got a 2018 CVE ID

April 11, 2022

Episode 317 - The lack of compromise in security

April 4, 2022

March  5

Episode 316 - You have to use open source

March 28, 2022

Facts vs Feelings

March 21, 2022

Episode 315 - Who even makes all these terrible decisions?

March 21, 2022

Episode 314 - The Linux Dirty Pipe vulnerability

March 14, 2022

Episode 313 - Insecurity at scale

March 7, 2022

February  4

Episode 312 - The Legend of the SBOM

February 28, 2022

Episode 311 - Did you scan the QR code?

February 21, 2022

Episode 310 - Hayley Tsukayama from the EFF talks about privacy

February 14, 2022

Episode 309 - The bright future of open source secuirty

February 7, 2022

January  5

Episode 308 - Welcome to the jungle - How to talk about open source security

January 31, 2022

Episode 307 - Got vulnerabilities? Introducing GSD

January 24, 2022

Episode 306 - Open source isn’t broken, it’s an experience

January 17, 2022

Episode 305 - Norton, Ethereum, NFT, and Apes

January 10, 2022

Episode 304 - Will we ever fix all the vulnerabilities?

January 3, 2022

2021  58

December  5

Episode 303 - Log4j Christmas Spectacular!

December 27, 2021

Episode 302 - Log4j is a mess

December 20, 2021

Episode 301 - You’re holding it wrong: the importance of unlearning

December 13, 2021

log4j is hard to find and harder to fix

December 12, 2021

Episode 300 - Apple vs NSO: What can copyright do for you?

December 6, 2021

November  5

Episode 299 - Experts From A World That No Longer Exists

November 29, 2021

Episode 298 - David A Wheeler discusses the OpenSSF

November 22, 2021

Episode 297 - 25 years of smashing stacks, fun, and profit

November 15, 2021

Episode 296 - Is Trojan Source a vulnerability?

November 8, 2021

Episode 295 - Open source security isn’t free

November 1, 2021

October  4

Episode 294 - Chris Wysopal on the state of security education

October 25, 2021

Episode 293 - Scoring OpenSSF Security Scoring

October 18, 2021

Episode 292 - Apache RCE and Twitch epic pwn

October 11, 2021

Episode 291 - Everyone sucks at vulnerability disclosure

October 4, 2021

September  4

Episode 290 - The security of the Matrix

September 27, 2021

Episode 289 - Who left this 0day on the floor?

September 20, 2021

Episode 288 - Linux Kernel compiler warnings considered dangerous

September 13, 2021

Episode 287 - Is GitHub’s Copilot the new Clippy?

September 6, 2021

August  5

Episode 286 - Open source supply chain with Google’s Dan Lorenc

August 30, 2021

Episode 285 - Open source owes you nothing!

August 23, 2021

Episode 284 - What happens when we DRM power tools?

August 16, 2021

Episode 283 - When vulnerability disclosure becomes dangerous

August 8, 2021

Episode 282 - The security of Rust: who left all this awesome in here?

August 2, 2021

July  5

Episode 281 - If you spy on journalists, you’re the bad guys

July 26, 2021

Episode 280 - The perils of Single Sign On

July 19, 2021

The future of DWF

July 15, 2021 · kurtseifried

Episode 279 - The audacity of Audacity: When open source goes rogue

July 12, 2021

Episode 278 - Could SELinux have stopped SolarWinds?

July 5, 2021

June  4

Episode 277 - Privacy and activism with Chris Weiland

June 28, 2021

Episode 276 - Security, behavior, and the environment

June 21, 2021

Episode 275 - What in the @#$% is going on with ransomware?

June 14, 2021

Episode 274 - Mr. Amazon’s Neighborhood

June 7, 2021

May  5

Episode 273 - Can we stop the coming artificial unintelligence deluge?

May 31, 2021

Episode 272 - The Biden Cybersecurity Executive Order

May 24, 2021

Episode 271 - Pipeline security: There is no problem humans can’t make worse

May 17, 2021

Episode 270 - Hello dark patterns my old friend

May 10, 2021

Episode 269 - Do not experiment on the Linux Kernel

May 3, 2021

April  4

Episode 268 - Can we trust any 3rd parties?

April 26, 2021

Episode 267 - Does 0day still mean 0day?

April 19, 2021

Episode 266 - The future of security scanning with Debricked

April 12, 2021

Episode 265 - The lies closed source can tell, open source can’t

April 5, 2021

March  6

It’s time to fix CVE

March 30, 2021

Episode 264 - DevSecOps with GitLab’s Mark Loveless

March 29, 2021

Episode 263 - GitHub pulls exploits, LinuxFoundation sign all the things

March 22, 2021

Episode 262 - A discussion with Loris and Pop from Sysdig

March 15, 2021

Episode 261 - DWF is back! Welcome to community powered CVE

March 8, 2021

Episode 260 - Dave Jevans tells us what CipherTrace is up to

March 1, 2021

February  6

Episode 259 - What even is open source anymore?

February 22, 2021

The Titanic of security

February 15, 2021

Episode 258 - Stop using C

February 15, 2021

Episode 257 - The sudo and libgcrypt vulnerabilities

February 8, 2021

It’s the community, stupid

February 2, 2021

Episode 256 - 9 bits of podcast, 8 bits of computing

February 1, 2021

January  5

You cannot manage your supply chain

January 30, 2021

Episode 255 - What if security wasn’t joyless?

January 25, 2021

Episode 254 - Right to Repair Security

January 18, 2021

Episode 253 - Defenders only need to be right once

January 11, 2021

Episode 252 - Is open source dangerous? Open source won, who cares, shut up!

January 4, 2021

2020  89

December  27

Episode 251 - Communication is hard, security communication is more hard

December 28, 2020

Episode 250 - Door 25: Why do we do the things we do? Question everything

December 25, 2020

Episode 249 - Door 24: Information wants to be free

December 24, 2020

Episode 248 - Door 23: How to report 1000 security flaws

December 23, 2020

Episode 247 - Door 22: How to report one security flaw

December 22, 2020

Episode 246 - Door 21: Bug bounties

December 21, 2020

Episode 245 - Door 20: Is SMS 2FA better than no 2FA?

December 20, 2020

Episode 244 - Door 19: TLS certificate trust

December 19, 2020

Episode 243 - Door 18: Don’t roll your own crypto or auth

December 18, 2020

Episode 242 - Door 17: Vulnerability response

December 17, 2020

Episode 241 - Door 16: 16 bits of change

December 16, 2020

Episode 240 - Door 15: Supplier compliance

December 15, 2020

Committee or Community: Slowing down the future

December 14, 2020

Episode 239 - Door 14: Backdoors

December 14, 2020

Episode 238 - Door 13: Unlucky or survivor bias?

December 13, 2020

Episode 237 - Door 12: Video game hacking

December 12, 2020

Episode 236 - Door 11: Should you get on a 737?

December 11, 2020

Episode 235 - Door 10: Deciding what information matters

December 10, 2020

Episode 234 - Door 09: public key cryptography

December 9, 2020

Episode 233 - Door 08: man 8 security

December 8, 2020

Episode 232 - Door 07: 7 is the best prime, 2 is the dumbest

December 7, 2020

Episode 231 - Door 06: 6 wifi risks … that don’t actually matter

December 6, 2020

Episode 230 - Door 05: 5 reasons you need 24/7 robot monitoring

December 5, 2020

Episode 229 - Door 04: EFF’s Cover Your Tracks

December 4, 2020

Episode 228 - Door 03: Do all vulnerabilities matter equally?

December 3, 2020

Episode 227 - Door 02: Marketing department or selection bias?

December 2, 2020

Episode 226 - Door 01: Advent calendars

December 1, 2020

November  5

Episode 225 - Who is responsible if IoT burns down your house?

November 23, 2020

We can’t move forward by looking back

November 19, 2020

Episode 224 - Are old Android devices dangerous?

November 16, 2020

Episode 223 - Full disclosure won, deal with it

November 9, 2020

Episode 222 - HashiCorp Boundary with Jeff Mitchell

November 2, 2020

October  5

Episode 221 - Security, magic, and FaceID

October 26, 2020

Episode 220 - Securing network time and IoT

October 19, 2020

Episode 219 - Chat with Larry Cashdollar

October 12, 2020

Episode 218 - The past was a terrible place

October 5, 2020

A bug by any other name

October 1, 2020

September  4

Episode 217 - How to tell your story with Travis Murdock

September 28, 2020

Episode 216 - Security didn’t find life on Venus

September 21, 2020

Episode 215 - Real security is boring

September 14, 2020

Episode 213 - Security Signals: What are you telling the world

September 7, 2020

August  7

We take security seriously, VERY SRSLY!

August 31, 2020

Episode 212 - Grab Bag: The Security We Deserve Edition

August 31, 2020

2020 CWE Top 25 I mean 10 or maybe 4.5

August 24, 2020

Episode 211 - The only thing harder than signing files is managing users

August 24, 2020

Episode 210 - Cult of Information Security

August 17, 2020

Episode 209 - Secure Boot isn’t Secure

August 10, 2020

Episode 208 - Passwords are pollution

August 3, 2020

July  4

Episode 207 - Weaponized attention

July 27, 2020

Episode 206 - Confidential Virtual Machines; The future of cloud computing

July 20, 2020

Episode 205 - The State of Open Source Security with Alyssa Miller from Snyk

July 13, 2020

Episode 204 - What Would Apple Do?

July 6, 2020

June  6

Episode 203 - Humans, conferences, and security: let me think and get back to you in a bit

June 29, 2020

The ineffective CISO

June 23, 2020

Episode 202 - The convergence of application security

June 22, 2020

Episode 201 - We broke CVSSv3, now how do we fix it?

June 15, 2020

Episode 200 - Talking Container Security with Liz Rice

June 8, 2020

Episode 199 - Special cases are special: DNS, Websockets, and CSV

June 1, 2020

May  5

Broken vulnerability severities

May 27, 2020

Episode 198 - Good advice or bad advice? Hang up, look up, and call back

May 25, 2020

Episode 197 - Beer, security, and consistency; the newer, better, triad

May 17, 2020

Episode 196 - Pounding square solutions into round holes: forced updates from Ubuntu

May 11, 2020

Episode 195 - Is BGP actually insecure?

May 4, 2020

April  6

Episode 194 - Working from home security: resistance is futile

April 27, 2020

Episode 193 - Security lessons from space: Apollo 13 edition

April 20, 2020

Episode 192 - Work without progress - what Infosec can learn from treadmills

April 13, 2020

Episode 191 - Security scanners are all terrible

April 8, 2020

Who are the experts

April 7, 2020

Episode 190 - Building a talent "ecosystem"

April 5, 2020

March  12

Episode 189 - Video game hackers - speedrunning

March 30, 2020

Part 6: What do we do now?

March 26, 2020

Part 5: Which of these security problems do I need to care about?

March 25, 2020

Part 4: Application scanning

March 24, 2020

Episode 188 - Depressing news sucks, we’re talking about cheating in video games

March 23, 2020

Episode 187 - Wireguard vs IPsec: the OK Boomer of security

March 15, 2020

Part 3: Composition scanning

March 12, 2020

Part 2: Scanning the code

March 11, 2020

Part 1: Is your security scanner running? You better go catch it!

March 10, 2020

The Security Scanner Problem

March 10, 2020

Episode 186 - Endpoint security with Tony Meehan

March 8, 2020

Episode 185 - Is it even possible to fix open source security?

March 2, 2020

February  4

Episode 184 - It’s DNS. It’s always DNS

February 24, 2020

Episode 183 - The great working from home experiment

February 17, 2020

Episode 182 - Does open source owe us anything?

February 10, 2020

Episode 181 - The security of SIM swapping

February 3, 2020

January  4

Episode 180 - A Tale of Two Vulnerabilities

January 27, 2020

Episode 179 - Google Project Zero and the 90 day clock

January 20, 2020

Episode 178 - Are CVEs important and will ransomware put you out of business?

January 13, 2020

Episode 177 - Fake or real? The security of counterfeit goods

January 6, 2020

2019  56

December  5

Episode 176 - The ‘predictions are stupid’ prediction episode

December 30, 2019

Episode 175 - Defenders will always be one step behind

December 23, 2019

Episode 174 - GitHub turns security up to 11; A discussion with Rob Schultheis

December 16, 2019

Episode 173 - Ho Ho Homeland Security

December 9, 2019

Episode 172 - The security of planned obsolescence

December 2, 2019

November  4

Episode 171 - Measuring cybersecurity with Kathryn Waldron

November 25, 2019

Episode 170 - Until that quantum computer is cracking RSA keys, go sit back down!

November 18, 2019

Episode 169 - What happens when leadership doesn’t care about security?

November 11, 2019

Episode 168 - The draconian draconians of DRM

November 4, 2019

October  4

Episode 167 - Security is terrible because digital literacy is terrible

October 28, 2019

Episode 166 - Every day should be cybersecurity awareness month!

October 21, 2019

Episode 165 - Grab Bag of Microsoft Security News

October 13, 2019

Episode 164 - DNS over HTTPS: Probably not the end of the world

October 7, 2019

September  5

Episode 163 - Death to Python 2

September 30, 2019

Episode 162 - SBOM with Allan Friedman

September 23, 2019

Episode 161 - Human nature and ad powered open source

September 16, 2019

Episode 160 - Disclosing security issues is insanely complicated: Part 2

September 9, 2019

Episode 159 - Disclosing security issues is insanely complicated: Part 1

September 2, 2019

August  4

Backdoors in open source are here to stay

August 28, 2019

Episode 158 - The mess that we call credit agencies in the US

August 26, 2019

Episode 157 - Backdoors and snake oil in our cryptography

August 19, 2019

Appsec isn’t people

August 13, 2019

July  6

Episode 156 - What if we MitM a whole country?

July 29, 2019

Why you can’t backdoor cryptography

July 26, 2019

Episode 155 - Stealing cars and ransomware

July 22, 2019

Episode 154 - Chat with the authors of the book "The Fifth Domain"

July 16, 2019

Episode 153 - The unexpected security of AI, photographs, and VPN

July 8, 2019

Episode 152 - Tavis breaks the world … again

July 1, 2019

June  4

Episode 151 - The DARPA Cyber Grand Challenge with David Brumley

June 24, 2019

Episode 150 - Our ad funded dystopian present

June 17, 2019

Episode 149 - Chat with Michael Coates about data security

June 10, 2019

Episode 148 - You just got pwnt, what now?

June 3, 2019

May  4

Episode 147 - Scams and operations as part of the supply chain

May 27, 2019

Episode 146 - What the @#$% happened to Microsoft?

May 20, 2019

Episode 145 - What do security and fire have in common?

May 13, 2019

Episode 144 - The security of money, which one is best?

May 6, 2019

April  7

Episode 143 - Security lessons from the phone book

April 29, 2019

Episode 142 - Hypothetical security: what if you find a USB flash drive?

April 21, 2019

Episode 141 - Timezones are hard, security is harder

April 15, 2019

The security of dependencies

April 10, 2019

Episode 140 - Good enough security is a pretty high bar

April 8, 2019

Supplying the supply chain

April 2, 2019

Episode 139 - Secure voting, firefox send, and toxic comments on the internet

April 1, 2019

March  4

Episode 138 - Information wants to be free

March 25, 2019

Episode 137.5 - Holy cow Beto was in the cDc, this is awesome!

March 18, 2019

Episode 137 - When the IoT attacks!

March 11, 2019

Episode 136 - How people feel is more important than being right

March 4, 2019

February  4

Episode 135 - Passwords, AI, and cloud strategy

February 25, 2019

Episode 134 - What’s up with the container runc security flaw?

February 18, 2019

Episode 133 - Smart locks and the government hacking devices

February 11, 2019

Episode 132 - Bird Scooter: 0, Cory Doctorow: 1

February 4, 2019

January  5

Episode 131 - Windows micropatches, Google’s privacy fine, and Mastercard fixes trial abuse

January 28, 2019

Episode 130 - Chat with Snyk co-founder Danny Grander

January 21, 2019

Security isn’t a feature

January 15, 2019

Episode 129 - The EU bug bounty program

January 14, 2019

Episode 128 - Australia’s encryption backdoor bill

January 7, 2019

2018  66

December  5

Misguided misguidings over the EU bug bounty

December 30, 2018

2018 Christmas Special - Is Santa GDPR compliant?

December 24, 2018

Episode 127 - Walled gardens, appstores, and more

December 17, 2018

Episode 126 - The not so dire future of supply chain security

December 10, 2018

Episode 125 - Open Source, supply chains, npm, and you

December 3, 2018

November  6

What’s up with backdoored npm packages?

November 27, 2018

Episode 124 - Cloudflare’s service workers and the economics of security

November 26, 2018

Dependencies in open source

November 19, 2018

Episode 123 - Talking about Kubernetes and container security with Liz Rice

November 19, 2018

Episode 122 - What will Apple’s T2 chip mean for the rest of us?

November 12, 2018

Episode 121 - All about the security of voting

November 5, 2018

October  7

Episode 120 - Bloomberg and hardware backdoors - it’s already happening

October 29, 2018

Targeted vs General purpose security

October 23, 2018

Episode 119 - The Google+ and Facebook incidents, it’s not your data anymore

October 22, 2018

Episode 118 - Cloudflare’s IPFS and onion service

October 15, 2018

Episode 117 - Will security follow Linus’ lead on being nice?

October 8, 2018

Millions of unfixed security flaws is a lie

October 1, 2018

Episode 116 - The future of the CISO with Michael Piacente

October 1, 2018

September  4

Episode 115 - Discussion with Brian Hajost from SteelCloud

September 24, 2018

Episode 114 - Review of "Click Here to Kill Everybody"

September 17, 2018

Episode 113 - Actual real security advice

September 10, 2018

Episode 112 - Google’s Titan Key and the latest Struts issue

September 3, 2018

August  6

Security reviews and microservices

August 28, 2018

Episode 111 - The TLS 1.3 and DNS episode

August 27, 2018

Actionable Advice

August 22, 2018

Episode 110 - Review of Black Hat, Defcon, and the effect of security policies

August 20, 2018

Episode 109 - OSCon and actionable advice

August 13, 2018

Episode 108 - Bluetooth, phishing, airgaps, and eating soup off the floor

August 6, 2018

July  6

Episode 107 - The year of the Linux Desktop and other hardware stories

July 30, 2018

Episode 106 - Data isn’t oil, it’s nuclear waste

July 23, 2018

Episode 105 - More backdoors in open source

July 16, 2018

The father of modern security: B. F. Skinner

July 11, 2018

Episode 104 - The Gentoo security incident

July 9, 2018

Episode 103 - The Seven Properties of Highly Secure Devices

July 2, 2018

June  5

Episode 102 - Michael Feiertag from tCell

June 25, 2018

Episode 101 - Our unregulated future is here to stay

June 17, 2018

Episode 100 - You’re bad at buying security, we can help!

June 11, 2018

Security ROI isn’t impossible, we suck at measuring

June 5, 2018

Episode 99 - Consumer security is too broken to fix, and it doesn’t matter

June 4, 2018

May  5

Episode 98 - When IT decisions kill people

May 28, 2018

Episode 97 - Automation: Humans are slow and dumb

May 20, 2018

Helicopter security

May 17, 2018

Episode 96 - Are legal backdoors a good idea?

May 14, 2018

Episode 95 - Twitter passwords and npm backdoors

May 7, 2018

April  6

Episode 94 - DNSSEC, BGP, and reality

April 30, 2018

Episode 93 - Security flaws in beep and patch, how did we get here?

April 23, 2018

Episode 92 - Chat with Rami Saas the CEO of WhiteSource

April 15, 2018

Episode 91 - Security lessons from a 7 year old

April 8, 2018

Spend until you’re secure

April 5, 2018

Episode 90 - Humans and misinformation

April 2, 2018

March  5

Episode 89 - Short selling AMD security flaws

March 25, 2018

Episode 88 - Chat with Chris Rosen from IBM about Container Security

March 18, 2018

Episode 87 - Chat with Let’s Encrypt co-founder Josh Aas

March 11, 2018

But that’s not my job!

March 7, 2018

Episode 86 - What happens when 23 thousand certificates leak?

March 5, 2018

February  5

Episode 85 - NPM ate my files

February 28, 2018

Episode 84 - Have I been pwned?

February 25, 2018

Episode 83 - XKCD + CVE = XKCVE

February 21, 2018

Episode 82 - RSA, TLS, Chrome HTTP, and PCI

February 13, 2018

Episode 81 - Autosploit, bug bounties, and the future of security

February 7, 2018

January  6

Episode 80 - GPS tracking and jamming

January 31, 2018

Episode 79 - Skyfall: please don’t yell ‘fire’

January 24, 2018

Episode 78 - Risk lessons from Hawaii

January 16, 2018

Episode 77 - npm and the supply chain

January 11, 2018

Episode 76 - Meltdown aftermath

January 7, 2018

Security and privacy are the same thing

January 3, 2018

2017  78

December  3

Episode 75 - Security Planner review

December 19, 2017

Episode 74 - Facial recognition and physical security

December 13, 2017

Episode 73 - Security from Santa

December 6, 2017

November  5

Episode 72 - Bitcoin: It’s over 9000

November 28, 2017

Episode 71 - GitHub’s Security Scanner

November 21, 2017

Episode 70 - The security of Intel ME

November 14, 2017

Episode 69 - Actionable security advice

November 7, 2017

Episode 68 - Ruining the Internet

November 1, 2017

October  4

Episode 67 - Cyber won

October 24, 2017

Episode 66 - Objects in mirror are less terrible than they appear

October 16, 2017

Episode 65 - Will aliens overthrow us before AI?

October 9, 2017

Episode 64 - Networks and Dnsmasq and IoT oh my

October 3, 2017

September  3

Episode 63 - Shoot, Shovel, and Bury

September 26, 2017

Episode 62 - All about the Equifax hack

September 11, 2017

Episode 61 - Market driven security

September 5, 2017

August  4

Episode 60 - The official blockchain episode

August 30, 2017

Episode 59 - The VPN Episode

August 15, 2017

Episode 58 - Backwards compatibility to the point of insanity

August 9, 2017

Episode 57 - We may never see amazing security research ever again

August 1, 2017

July  5

Summer is coming

July 20, 2017

Episode 56 - Devil’s Advocate and other fuzzy topics

July 18, 2017

Episode 55 - Good docs ruin my story

July 12, 2017

Who’s got your hack back?

July 9, 2017

Episode 54 - Turning into an old person

July 4, 2017

June  8

Episode 53 - A plane isn’t like a car

June 28, 2017

When in doubt, blame open source

June 26, 2017

Episode 52 - You could have done it right, but you didn’t

June 20, 2017

Thought leaders aren’t leaders

June 18, 2017

Episode 51 - All about CVE

June 12, 2017

Humanity isn’t proactive

June 11, 2017

Episode 50 - This is a security podcast after all

June 6, 2017

Free Market Security

June 4, 2017

May  8

Episode 49 - Testing software is impossible

May 30, 2017

Stealing from customers

May 29, 2017

You know how to fix enterprise patching? Please tell me more!!!

May 22, 2017

Episode 48 - Machine Learning: Not actually magic

May 21, 2017

Episode 47 - WannaCry: Everything is basically broken

May 14, 2017

Episode 46 - Turns out I’m not a bad guy

May 4, 2017

Security like it’s 2005!

May 3, 2017

Episode 45 - Trust is more important now than the truth

May 2, 2017

April  10

Security fail is people

April 30, 2017

Episode 44 - Bug Bounties vs Pen Testing

April 25, 2017

I have seen the future, and it is bug bounties

April 24, 2017

Episode 43 - We are totally immature

April 19, 2017

Crawl, Walk, Drive

April 17, 2017

Episode 42 - Hitchhiker’s Guide to Security

April 13, 2017

The obvious answer is never the secure answer

April 10, 2017

Episode 41 - All your money are belong to us

April 10, 2017

The expectation of security

April 2, 2017

Episode 40 - Let’s fork bitcoin, again

April 2, 2017

March  8

Remember kids, if you’re going to disclose, disclose responsibly!

March 28, 2017

Episode 39 - Flash on your dishwasher

March 28, 2017

Inverse Law of CVEs

March 23, 2017

Episode 38 - We Ruin Everything

March 22, 2017

Security, Consumer Reports, and Failure

March 12, 2017

Episode 37 - Your bathtub is more dangerous than a shark

March 9, 2017

Episode 36 - A Good Enough Podcast

March 5, 2017

What the Oscars can teach us about security

March 2, 2017

February  7

Episode 35 - Crazy Cosmic Accident

February 28, 2017

SHA-1 is dead, long live SHA-1!

February 24, 2017

Episode 34 - Bathing in Ebola Virus

February 22, 2017

Episode 33 - Everybody who went to the circus is in the circus (RSA 2017)

February 15, 2017

Reality Based Security

February 12, 2017

Episode 32 - Gambling as a Service

February 8, 2017

Episode 31 - XML is never the solution

February 1, 2017

January  13

Everything you know about security is wrong, stop protecting your empire!

January 30, 2017

Episode 30 - I’m not an expert but I’ve been yelled at by experts

January 26, 2017

Return on Risk Investment

January 23, 2017

Episode 29 - The Security of Rogue One

January 22, 2017

Episode 28 - RSA Conference 2017

January 19, 2017

What does security and USB-C have in common?

January 16, 2017

Episode 27 - Prove to me you are human

January 16, 2017

Episode 26 - Tell your sister, Stallman was right

January 12, 2017

Episode 25 - The future is now

January 10, 2017

Security Advice: Bad, Terrible, or Awful

January 9, 2017

Looks like you have a bad case of embedded libraries

January 3, 2017

Episode 24 - The 2016 prediction edition! (yeah, that’s right, 2016)

January 3, 2017

Future Proof Security

January 2, 2017

2016  77

December  11

Episode 23 - We can’t patch people

December 28, 2016

The art of cutting edge, Doom 2 vs the modern Security Industry

December 25, 2016

Episode 22 - IoT Wild West

December 25, 2016

Episode 21 - CVE 10K Extravaganza

December 21, 2016

Does "real" security matter?

December 19, 2016

Episode 20 - The Death of PGP

December 19, 2016

Episode 19 - A field full of razor blades and monsters

December 14, 2016

Episode 18 - The Security of Santa

December 11, 2016

Episode 17 - Cyphercon Interview with Korgo

December 6, 2016

Airports, Goats, Computers, and Users

December 4, 2016

Episode 16 - Cat and mouse

December 2, 2016

November  8

Episode 15 - Cyber Black Monday

November 29, 2016

The Economics of stealing a Tesla with a phone

November 28, 2016

Episode 14 - David A Wheeler: CII Badges

November 22, 2016

Fast security is the best security

November 21, 2016

Episode 13 - CVE: The metric system of security

November 18, 2016

Who cares if someone hacks my driveway camera?

November 14, 2016

Episode 12 - Security Trebuchet

November 10, 2016

Free security is the only security that really works

November 6, 2016

October  11

Stop being the monkey’s paw

October 31, 2016

Episode 11 - The Poison Candy Episode

October 31, 2016

Security is in the same leaky boat as the sysadmins

October 31, 2016

Episode 10 - The super botnet that nobody can stop

October 24, 2016

Everything you know about security is wrong

October 23, 2016

IoT Can Never Be Fixed

October 22, 2016

Episode 9 - Are bug bounties measuring the wrong things?

October 18, 2016

Can I interest you in talking about Security?

October 17, 2016

Episode 8 - The primality of prime numbers

October 11, 2016

Episode 7 - More Powerful than root!

October 3, 2016

Impossible is impossible!

October 3, 2016

September  11

Episode 6 - Foundational Knowledge of Security

September 29, 2016

Episode 5 - OpenSSL: The library we deserve

September 29, 2016

Who left all this fire everywhere?

September 26, 2016

Episode 4 - Dead squirrel in a box

September 21, 2016

Is dialup still an option?

September 20, 2016

Why do we do security?

September 18, 2016

Episode 3 - The Lockpicking Sewing Circle

September 13, 2016

On Experts

September 12, 2016

Episode 2 - Instills the proper amount of fear

September 7, 2016

Episode 1 - Rich History of Security Flaws

September 7, 2016

You can’t weigh risk if you don’t know what you don’t know

September 6, 2016

August  5

How do we explain email to an "expert"?

August 29, 2016

The cost of mentoring, or why we need heroes

August 21, 2016

Can’t Trust This!

August 15, 2016

We’re figuring out the security problem (finally)

August 8, 2016

Everyone has been hacked

August 1, 2016

July  3

Using a HooToo Nano as a magic VPN box

July 18, 2016

Entry level AI

July 11, 2016

But I have work to do!

July 5, 2016

June  4

The future of security

June 27, 2016

Decentralized Security

June 20, 2016

Ready to form Voltron! why security is like a giant robot make of lions

June 13, 2016

Is there a future view that isn’t a security dystopia?

June 6, 2016

May  5

Regulation can fix security, except you can’t regulate security

May 29, 2016

Thoughts on our security bubble

May 23, 2016

Security will fix itself, eventually

May 15, 2016

Security isn’t a feature, it’s a part of everything

May 8, 2016

Trusting, Trusting Trust

May 1, 2016

April  5

Can we train our way out of security flaws?

April 24, 2016

Software end of life matters!

April 17, 2016

What happened with Badlock?

April 12, 2016

Cybersecurity education isn’t good, nobody is shocked

April 10, 2016

Security is really about Risk vs Reward

April 3, 2016

March  5

Ransomware is scary, but not for the reasons you think it is

March 29, 2016

I’m going to do something really cool in 3 weeks! … Probably.

March 23, 2016

Everything is fine, nothing to see here!

March 20, 2016

Containers are like sandwiches

March 13, 2016

The interesting things from RSA are what didn’t happen, and containers are sandwiches

March 7, 2016

February  4

Let’s talk about soft skills at RSA, plus some other things

February 29, 2016

Thinking about glibc and Heartbleed, how do fix things

February 23, 2016

Change direction, increase speed! (or why glibc changes nothing)

February 21, 2016

glibc for humans

February 19, 2016

January  5

Does the market care about security?

January 31, 2016

Security and Tribal Knowledge

January 25, 2016

OpenSSH, security, and everyone else

January 18, 2016

What the lottery and security have in common

January 10, 2016

A security analogy that works

January 4, 2016

2015  18

December  4

Security reminds me of the gym on January 2

December 29, 2015

A Christmas Cyber

December 21, 2015

Security is the new paperless office!

December 14, 2015

Security lacks patience

December 7, 2015

November  4

Where is the physical trust boundary?

November 30, 2015

If your outcome is perfect or nothing, nothing always wins

November 20, 2015

Your containers were built in some guy’s barn!

November 16, 2015

Is the Linux ransomware the first of many?

November 11, 2015

October  4

The Third Group

October 27, 2015

How do we talk to normal people?

October 20, 2015

How do we talk to business?

October 13, 2015

What’s filling the vacuum?

October 6, 2015

September  6

We’re losing the battle for security

September 29, 2015

How to build trust

September 22, 2015

How can we describe a buffer overflow in common terms?

September 13, 2015

Being a nice security person

September 8, 2015

Everyone is afraid of us

September 3, 2015

You are bad at talking to people

September 2, 2015