Josh and Kurt talk about the faker and colors NPM events. There is a lot of discussion around open source being broken or somehow failing because of these events. The real answer is open source is an experience. How we interact with our dependencies determines what the experience looks like. Show Notes Developer corrupts colors and faker WillContinue reading “Episode 306 – Open source isn’t broken, it’s an experience”
Category Archives: Security
Episode 305 – Norton, Ethereum, NFT, and Apes
Josh and Kurt talk about Norton creating an Ethereum mining pool. This is almost certainly a bad idea, we explain why. We then discuss the reality of NFTs and the case of stolen apes. NFTs can be very confusing. The whole world of cryptocurrency is very confusing for normal people. None of this is new, there have alwaysContinue reading “Episode 305 – Norton, Ethereum, NFT, and Apes”
Episode 304 – Will we ever fix all the vulnerabilities?
Josh and Kurt talk about the question will we ever fix all the vulnerabilities? The question came from Reddit and is very reasonable, but it turns out this is REALLY hard to discuss. The answer is of course “no”, but why it is no is very complicated. Far more complicated than either of us thought it would be.Continue reading “Episode 304 – Will we ever fix all the vulnerabilities?”
Episode 303 – Log4j Christmas Spectacular!
Josh and Kurt start the show with the reading of a security themed Christmas poem. We then discuss some of the new happenings around Log4j. The basic theme is that even if we were over-investing in Log4j, it probably wouldn’t have caught this. There are still a lot of things to unpack with this event. We are sureContinue reading “Episode 303 – Log4j Christmas Spectacular!”
Episode 302 – Log4j is a mess
Josh and Kurt talk about the same topic everyone is talking about, Log4j. This episode was recorded on the Wednesday after the first Log4j issue. We point out all the gaps and difficulties for the defenders. The situation has gotten worse since then. Good luck to everyone dealign with this thing Show Notes Log4j GSD entry Minecraft serverContinue reading “Episode 302 – Log4j is a mess”
Episode 301 – You’re holding it wrong: the importance of unlearning
Josh and Kurt talk about the epic failure that was episode 300. But this ties nicely into the topic of the day which is new ways to do things. The example is a new way to hold a controller when playing Tetris. There are always new tools and new ideas in security. Sometimes we have to abandon theContinue reading “Episode 301 – You’re holding it wrong: the importance of unlearning”
log4j is hard to find and harder to fix
If you pay attention to tech news, you know what’s going on with log4j right now. It’s being called Log4Shell which is a great name. I’ll spare you repeating the details of the issue, there are many many stories about it at this point. What I’ve not seen is a good explanation about why knowingContinue reading “log4j is hard to find and harder to fix”
Episode 300 – Apple vs NSO: What can copyright do for you?
This episode need a huge disclaimer: we got almost all of the details of this wrong, the lawsuit is based on CFAA, not on copyright. We apologize for this enormous oversight. Josh and Kurt talk about Apple suing NSO using a copyright claim as their vehicle. Copyright is often used as a reason to bring lawsuits, even whenContinue reading “Episode 300 – Apple vs NSO: What can copyright do for you?”
Episode 299 – Experts From A World That No Longer Exists
Josh and Kurt talk about an article about how expertise has a limited lifetime. We are all experts in something, but some of us will find our expert knowledge to be outdated eventually. We discuss what that means in the context of security and tech and disagree about how to best keep your skills up to date. ShowContinue reading “Episode 299 – Experts From A World That No Longer Exists”
Episode 298 – David A Wheeler discusses the OpenSSF
Josh and Kurt talk to David A. Wheeler about everything OpenSSF. The Open Source Security Foundation is part of the Linux Foundation, and there are 6 OpenSSF working groups. David does a great job explaining how the OpenSSF works and what the 6 working groups are doing. The working group are (in no particular order): Identifying Security Threats,Continue reading “Episode 298 – David A Wheeler discusses the OpenSSF”
Open Source Security 