Podcast

Josh and Kurt talk about Beto being in the Cult of the Dead Cow (cDc). This is a pretty big deal in a very good way. We hit on some history, why it’s a great thing, what we can probably expect from opponents. There’s even some advice at the end how we can all help. We need more politicians with backgrounds like this. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_137_5_Holy_cow_Beto_was_in_the_cDc_this_is_awesome.mp3 Show Notes Cult of the Dead Cow Phrack Beto in the cDc 2600 Off the Hook Stallman Hacker Song Comment on Twitter with the #osspodcast hashtag ...

Josh and Kurt talk about when devices attack! It’s not quite that exciting, but there have been a slew of news about physical devices causing problems for humans. We end on the note that we’re getting closer to a point when lawyers and regulators will start to pay attention. We’re not there yet, so we still have a horrible insecure future on the horizon. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_137_When_the_IoT_attacks.mp3 Show Notes Bricking a shoe Lime scooters throwing passengers off Malicious USB cables Comment on Twitter with the #osspodcast hashtag ...

Josh and Kurt talk about github blocking the Deepfakes repository. There’s a far bigger discussion about how people feel, and sometimes security fails to understand that making people feel happy or safer is more important than being right. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_136_How_people_feel_is_more_important_than_being_right.mp3 Show Notes Github Deepfakes discussion Cloudflare’s SOCKMAP blog Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about change your password day (what a terrible day). Google’s password checkup (not a terrible idea), an AI finding new spice flavors we expect will one day take over the world, and we finish up on a new DoD cloud strategy. Also Josh burnt his finger, but is going to be OK. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_135_Passwords_AI_and_cloud_strategy.mp3 Show Notes Change your password day Google password checkup AI finds new flavors DoD cloud strategy Comment on Twitter with the #osspodcast hashtag ...

Josh and Kurt talk about the new runc container security flaw. How does the flaw work, what can you do about it, what should you do about it, and what the future of container security may look like. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_134_Whats_up_with_the_container_runc_security_flaw.mp3 Show Notes runc security flaw - CVE-2019-5736 Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about the fiasco hacks4pancakes described on Twitter and what the future of smart locks will look like. We then discuss what it means if the Japanese government starts hacking consumer IoT gear, is it ethical? Will it make anything better? https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_133_Smart_locks_and_the_government_hacking_devices.mp3 Show Notes @hacks4pancakes smart lock fiasco LockPickingLawyer Japanese government hacking devices Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about the Bird Scooter vs Corey Doctorow incident. We then get into some of the social norms around new technology and what lessons the security industry can take from something new like shared scooters. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_132_Bird_Scooter_0_Cory_Doctorow_1.mp3 Show Notes Bird vs Corey Doctorow Josh’s CES blog Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about non-Microsoft Windows micropatches. The days of pretending closed source matters are long gone. Google gets hit with a privacy fine, that probably won’t matter. And Mastercard makes it easier for consumers to not accidentally sign up for services they don’t want. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_131_Windows_micropatches_Googles_privacy_fine_and_Mastercard_fixes_trial_abuse.mp3 Show Notes 3 Windows micropatches Google fined $57 million Mastercard free trial abuse Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk to Danny Grander one of the co-founders of Snyk about Zip Slip, what it is, how to fix it, and how they disclosed everything. We also touch on plenty of other open source security topics as Danny is involved in many aspects of open source security. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_130_Chat_with_Snyk_cofounder_Danny__Grander.mp3 Show Notes Danny’s Twitter Danny’s LinkedIn Snyk Zip Slip Snyk state of open source security Comment on Twitter with the #osspodcast hashtag ...

Josh and Kurt talk about the EU bug bounty program. There have been a fair number of people complaining it’s solving the wrong problem, but it’s the only way the EU has to spend money on open source today. If that doesn’t change this program will fail. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_129_The_EU_bug_bounty_program.mp3 Show Notes Josh’s blog post Julia Reda EU bug bounty site Tidelift What motivates us Comment on Twitter with the #osspodcast hashtag ...