Security

Josh and Kurt about a number of Microsoft security news items. They’ve changed how they are handling encrypted disks and are now forcing cloud logins on Windows users. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_165_Grab_Bag_of_Microsoft_Security_News.mp3 Show Notes Microsoft KB 4516071 A Security Market for Lemons Kurt’s file wiping advisory Lock Picking Lawyer vs Consumer Reports Sun Ray Linux Gamers: 20% of auto reported crashes Comment on Twitter with the #osspodcast hashtag

Josh and Kurt about DNS over HTTPS and how it may or may not destroy civilization. We also discuss the disruption of cloud in the context of security and touch on the news that GitHub is now a CVE CNA! https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_164_DNS_over_HTTPS_Probably_not_the_end_of_the_world.mp3 Show Notes DNS over HTTPS California Privacy Law Defensive Security Podcast GitHub is a CNA Show Tags #DoH #DNSOverHTTPS Comment on Twitter with the #osspodcast hashtag

Josh and Kurt about the upcoming Python 2 EOL. What does it mean, why does it matter, and what you can you do? https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_163_Death_to_python_2.mp3 Show Notes Python Clock Python’s statement about sunsetting Python 2 wifi 6 Comment on Twitter with the #osspodcast hashtag

Josh and Kurt speak with Allan Friedman of the US National Telecommunications and Information Administration about Software Bill of Materials. Where are we today, where are things going, and how you can help. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_162_SBOM_with_Allan_Friedman.mp3 Show Notes Allan Friedman NTIA NTIA Software Component Transparency Comment on Twitter with the #osspodcast hashtag

Josh and Kurt start out discussing human nature and how it affects how we view security. A lot of things that look easy are actually really hard. We also talk about the npm library Standard showing command line ads. Are ads part of the future of open source? https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_161_Human_nature_and_ad_powered_open_source.mp3 Show Notes thegrugq secure android DoD JEDI program Firefox privacy settings Standard ads Max Headroom Comment on Twitter with the #osspodcast hashtag ...

Josh and Kurt talk about disclosing security flaws in open source. This is part two of a discussion around how to disclose security issues. This episode focuses on some expectations and behaviors for open source projects as well as researchers trying to disclose a problem to a project. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_160_Disclosing_security_issues_is_insanely_complicated_Part_2.mp3 Show Notes webmin backdoor Github security advisories Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about disclosing security flaws. It’s a topic that’s come up a few times in the last few weeks and it’s more complicated than it’s ever been. We certainly ask more questions than we answer in this episode, there will be a part 2 that focuses on open source disclosure. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_159_Disclosing_security_issues_is_insanely_complicated_Part_1.mp3 Show Notes Lock Picking Lawyer Tavis’ Windows flaw Comment on Twitter with the #osspodcast hashtag ...

Unless you’ve been living under a rock for the past few … forever, you may have noticed that open source is taking took over the world. If software ate the world, open source is the dessert course. As of late there have been an uptick in stories about backdoors in open source software. These backdoors were put there by what is assumed to be “bad people” which is probably accurate since everyone is a villain in some way. ...

Josh and Kurt talk about the current state of credit security freezes in the US. We recount a thrilling tale of all the things Josh had to do to get new Internet service. It was all quite silly really. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_158_The_mess_that_we_call_credit_agencies_in_the_US.mp3 Show Notes Weak security freeze pins ’null’ license plate Comment on Twitter with the #osspodcast hashtag

Josh and Kurt talk about snakeoil cryptography at Black Hat and the new backdoored cryptography fight. Both of these problems will be with us for a very long time. These are fights worth fighting because it’s the right thing to do. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_157_Backdoors_and_snake_oil_in_our_cryptography.mp3 Show Notes Time AI video Kurt’s Tweet about technical explanations Josh’s blog post about bug training Schneier on Barr’s encryption discussion Comment on Twitter with the #osspodcast hashtag ...