Josh and Kurt talk about a presentation Josh recently gave that was supposed to be about how open source works. The talk was the wrong topic for a security crowd, but there’s a lot of interesting details in the questions and comments that emerged. It’s clear a lot of security people don’t really care about the fine details about what open source is, their primary goal is to help keep development secure. ...
Josh and Kurt talk about a story talking about the “graying” of open source. There doesn’t seem to be many young people working on open source, but we don’t really know why that is. There are many thoughts, but a better question is why should anyone get involved in open source anymore? The world has changed quite a lot since open source was created. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_439_Where_are_all_the_youth_in_open_source.mp3 Show Notes The graying open source community needs fresh blood OSPOs for Good 2024 Day 1 Part 1 Day 1 Part 2 Day 2 Part 1 Day 2 Part 2 FFmpeg bug JSON Editor Online https://rfc3339.com/
Josh and Kurt talk about two documents from the US government that discuss open source in very different ways. The CISA document lays out a way to measure open source, but we take issue with the idea of trying to measure which open source projects are “good”. The Whitehouse on the other hand takes an approach that is very open source, get involved. Trying to measure open source isn’t producing anything actionable, but getting involved is very actionable, and very much how open source works. ...
Josh and Kurt talk about a pretty big bug found in CocoPods ownership. We also touch on a paper that discusses the technical debt that open source should have. We discuss what the long term sustainability of open source. There aren’t any good solutions for open source today, but talking about these problems is important, we have to start to understand what’s going on before we can plausibly discuss solutions. If you’re an open source project that needs to put things on pause, or even walk way, that’s OK. ...
Josh and Kurt talk about the recent OpenSSH vulnerability and the node-ip project owner taking their project private. They’re quasi related in the context of two open source projects handled bugs very differently. The OpenSSH bug isn’t really as serious as it seems, but you still want to patch. The node-ip bug is a very different story. The relationship between users and open source developers is one experiencing more strain now than we’ve ever seen. It’s a weird conversation and we don’t have good answers. Security in general is a collection of unsolvable problems. ...
Josh and Kurt talk about the latest polyfill.io mess. Apparently someone took over a very popular project and started to serve malware. First XZ, now this. What does it mean for open source? We don’t have any answers, and it’s hard to even talk about this problem because it’s so big. The thing is though, even if we can’t fix open source, it’s here to stay. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_435_polyfill_io_open_source_is_too_big_to_fix.mp3 Show Notes Polyfill supply chain attack hits 100K+ sites OpenSSF Scorecard
Josh and Kurt talk about three wangles of responsibility. We start with a story about a bike theft ring, bike theft doesn’t usually get any attention, but this one is special. Then we ask why it seems like everyone is getting hacked, it’s because they have to tell us now. And finally we have a story about the huge number of unreported vulnerabilities in open source projects. This statistic probably affects all software, but there’s some numbers for open source specifically. ...
Josh and Kurt talk about a new proposal from OpenSSH to add a timeout to penalize clients misbehaving. But this then brings up the typical security conversation of “if it’s not perfect we shouldn’t do it”. Trying new things is a good thing, even if something fails, we learn a lesson that we can use in the future. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_433_Should_OpenSSH_block_misbehaving_clients.mp3 Show Notes OpenSSH introduces options to penalize undesirable behavior Hacker News comments
Josh and Kurt talk to Alex Kulagin from Flipper about the Flipper Zero. It’s one of the coolest hacker devices that exists on the market. We talk about what it is, how it started, what it can (and can’t) do. It’s a really fun conversation. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_432_Flipper_Zero_with_Alex_Kulagin.mp3 Show Notes Flipper Zero Website Headphone jack radio capture Flipper Zero on Tik Tok
Updated 2025-01-16: Since writing this post, there’s now a vulnerability focused discord you can join to discuss vulnerabilities. You can join with this link If you follow the vulnerability world, 2024 is starting to feel like we’ve become trapped in the mirror universe. NVD collapsed, the Linux kernel is generating a huge number of CVE IDs, CISA is maybe enriching the CVE data, and the growth rate of CVE is higher than its ever been. It feels like we’re careening off a cliff in the clown car where half the people are trapped inside trying to get out, and the other half are laughing at the clown honking its nose. ...