Podcast Episodes
Back to Search
CISA's new SSDF attestation form
Episode 421
Josh and Kurt talk about the new SSDF attestation form from CISA. The current form isn't very complicated, and the SSDF has a lot of room for interpr…
1 year, 11 months ago
What's going on at NVD
Episode 420
Josh and Kurt talk about what's going on at the National Vulnerability Database. NVD suddenly stopped enriching vulnerabilities, and it's sent shock-…
1 year, 11 months ago
Malicious GitHub repositories
Episode 419
Josh and Kurt talk about an attack against GitHub where attackers are creating malicious repositories then artificially inflating the number of stars…
2 years ago
Being right all the time is hard
Episode 418
Josh and Kurt talk about recent stories about data breaches, flipper zero banning, and realistic security. We have a lot of weird challenges in the w…
2 years ago
Linux Kernel security with Greg K-H
Episode 417
Josh and Kurt talk to GregKH about Linux Kernel security. We most focus on the topic of vulnerabilities in the Linux Kernel, and what being a CNA wil…
2 years ago
Thomas Depierre on open source in Europe
Episode 416
Josh and Kurt talk to Thomas Depierre about some of the European efforts to secure software. We touch on the CRA, MDA, FOSDEM, and more. As expected …
2 years ago
Reducing attack surface for less security
Episode 415
Josh and Kurt talk about a blog post explaining how to create a very very small container image. Generally in the world of security less is more, but…
2 years, 1 month ago
The exploited ecosystem of open source
Episode 414
Josh and Kurt talk about open source projects proving builds, and things nobody wants to pay for in open source. It's easy to have unrealistic expect…
2 years, 1 month ago
PyTorch and NPM get attacked, but it's OK
Episode 413
Josh and Kurt talk about an attack against PyTorch and NPM. The PyTorch attack shows the difficulty of trying to operate a large open source project.…
2 years, 1 month ago
Blame the users for bad passwords!
Episode 412
Josh and Kurt talk about the 23andMe compromise and how they are blaming the users. It's obviously the the fault of the users, but there's still a lo…
2 years, 1 month ago