Nerding Out With Viktor

In this episode of Nerding Out With Viktor, host Viktor Petersson sits down with Steve Springett, a leading figure in the world of Software Bill of Materials (SBOMs) and the primary maintainer of CycloneDX, to explore the evolving landscape of software security and SBOMs.

Steve shares his journey into the SBOM space, starting with his early experiences in supply chain management and the creation of OWASP Dependency-Track, a project that began out of necessity to manage full-stack inventories of hardware and software. Steve discusses the challenges faced during the early days, the limitations of existing tools, and how these experiences informed his later contributions to CycloneDX.

The conversation dives deep into the technical nuances of SBOMs, including the differences between CycloneDX and SPDX, two of the most prominent SBOM standards. Steve and Viktor debate the pros and cons of each, with Steve emphasizing CycloneDX's pragmatic and automatable design philosophy. The discussion also touches on the complexities of supply chain security, including the importance of provenance, the challenges of dependency tracking, and the potential risks posed by nation-state adversaries.

Steve provides insights into the future of SBOMs and how they will likely become as standard in software development as unit testing is today. He also introduces the concept of OBOMs (Operational Bill of Materials), explaining how SBOMs can extend to cover runtime environments and services, ensuring a more comprehensive approach to managing and securing software stacks.

Key topics covered:

If you're working in software development, DevOps, or cybersecurity, this episode is packed with practical advice and forward-thinking insights on how SBOMs are reshaping the industry. Tune in to learn from one of the leading voices in the SBOM world and stay ahead in securing your software supply chain.

Check out sbomify at sbomify.com for a tool that simplifies SBOM generation and management!

In this episode of Nerding Out with Viktor, I sit down with Iceman, a well-known figure in the RFID hacking community. You might have caught one of his DEFCON talks, where he's done some groundbreaking work in RFID security. Today, we're diving deep into RFID technology, hacking techniques, and security vulnerabilities that many of us take for granted in everyday systems.

RFID (Radio-Frequency Identification) is all around us—from access control systems in buildings to payment cards, car immobilizers, and even alarm systems. While it's widely used, few people realize how vulnerable this technology can be. Iceman is here to break it all down, helping us understand the difference between RF and RFID, and explaining the various frequency ranges, from low frequency (125 kHz) to high frequency (13.56 MHz) and ultra-high frequency (800-900 MHz).

Whether you're a seasoned RF enthusiast, a hacker, or just curious about the technology behind the systems we rely on, this episode offers a deep dive into the world of RFID hacking. Iceman walks us through the basics, discussing different types of key fobs, cards, and readers. He also explains how people often buy RFID cloners only to realize they can't clone certain cards due to the specific technology used. I learned this the hard way when I stumbled upon an RFID cloner at DEFCON—where I'd gone for my general interest in security—and it opened my eyes to the whole world of RFID hacking.

Iceman reveals the essential tools of the trade, from the Proxmark to the Blue Gun Cloner, to more advanced gear like the iCopyX. We talk about the different tools available at all levels, from hobbyist to professional pentesters. But we don't stop at the tools—he breaks down how RFID authentication and encryption work, and how vulnerabilities like static and dynamic nonces leave even "secure" systems exposed.

One of the most exciting parts of the conversation is learning that RFID hacking isn't just about cloning a fob or breaking into a building. Iceman talks about how the hacking community is really about exploring, learning, and pushing the boundaries of technology. His story about creating the Iceman Fork of the Proxmark repository is a great example of how hackers collaborate to improve tools and share knowledge.

We also get into more advanced RFID attacks like downgrade attacks, where hackers exploit systems that still support older, less secure versions of card technology. Iceman shares some real-world examples of how these vulnerabilities play out, giving us a peek behind the curtain at how hackers find and exploit these security gaps.

We explore the security (or lack thereof) in systems we encounter every day—like hotel room key cards and smart locks. Iceman breaks down how even high-end systems can be vulnerable to simple cloning or more sophisticated downgrade and replay attacks. We also touch on newer technologies like NFC and mobile credentials, discussing how they compare to older RFID systems.

For those of you looking to get started with RFID hacking or to deepen your knowledge, Iceman has some great advice on tools to buy, where to start, and how to get involved in the community. He also shares where you can pick up a Proxmark device and how to join the Proxmark Discord community, which is full of discussions, support, and new insights.

So, whether you're here to learn about RFID technology, interested in ethical hacking, or just love getting nerdy about tech, this episode is packed with great information and stories from one of the top minds in RFID hacking.

In this episode of Nerding Out with Viktor, host Viktor Petersson sits down with Philipp Deppenwiese, Head of Solution Engineering at Binarly, to delve into the critical yet often overlooked world of firmware security. As they explore the unique challenges of firmware and BIOS, Viktor and Philipp shed light on the importance of transparency in the development process. The conversation takes a fascinating turn as they dive into Binarly's groundbreaking discoveries, including the infamous "Logo Fail" vulnerability that exposed critical flaws in BIOS boot logos.

Philipp shares his extensive expertise in cybersecurity, discussing the intricacies of Binarly's tooling, such as FW Hunt and the newly launched RISK Binarly service. This innovative approach allows users to scan firmware for vulnerabilities and generate SBOMs directly from binary code, making it a game-changer in the industry. As they touch on responsible disclosure with hardware vendors, PKI management, and attestation, Viktor and Philipp offer valuable insights into the cultural and technical challenges facing the hardware and firmware industry.

Don't miss out on this deep dive into firmware security - hit play now! For more information, check out Binarly's RISK Service at risk.binarly.io, the Open Source Firmware Conference at osfc.io, and the SBCTL Tool for Secure Boot on GitHub.

In this episode of "Nerding Out with Viktor," Justin shares his unique insights on the evolution of Docker, the containerization pioneer. He reminisces about the early days of the London DevOps scene and its significant role in shaping the global community. The conversation delves into Docker's origins, highlighting the challenges and rapid rise to prominence in the cloud-native ecosystem.

Justin expertly debunks the debate surrounding containers versus VMs, providing a nuanced understanding of Docker's success in simplifying application packaging and deployment. He also provides clarity on Docker's pivotal business shift in 2019, where the company split into two entities, focusing on developers and the cloud while selling off Docker Enterprise.

The discussion also touches on the controversy surrounding Docker Desktop's pricing changes and the ongoing efforts to optimize Docker Hub's infrastructure. Additionally, Justin explores Docker Scout's role in generating SBOMs (Software Bill of Materials) and its potential for enhancing security through real-time vulnerability alerts. As Docker continues to innovate, this conversation highlights the company's focus on empowering developers while addressing practical challenges in running software at scale.

In this episode of "Nerding Out with Viktor," Viktor dives deep into the world of artificial intelligence with Luke Marsden, an AI expert and visionary behind Helix. The conversation explores the rapidly evolving landscape of large language models (LLMs), the impact of OpenAI's ChatGPT, and the rise of open-source AI alternatives. Luke sheds light on the current state of AI, discussing how companies like Meta, Google, and Microsoft are shaping the future.

The episode delves into the ongoing debate between open-source AI models and proprietary systems, highlighting the benefits and risks associated with each approach. Viktor and Luke discuss the emergence of Helix, a groundbreaking platform that enables businesses to harness the power of AI while maintaining control over their data. The conversation also touches on AI security and ethics, as well as the potential for Artificial General Intelligence (AGI).

Throughout the episode, Luke shares practical insights into how businesses can leverage AI to drive innovation, from automating routine tasks to providing personalized recommendations. With a mix of technical depth and real-world examples, this episode offers a unique perspective on the future of AI, making it a must-listen for tech enthusiasts and industry professionals alike.

On this engaging episode of "Nerding Out with Viktor", Viktor sits down with Daniel Stenberg, founder of the widely adopted command-line tool Curl, to discuss his fascinating journey from early programming days on Commodore 64 and Amiga to creating a tool that has become indispensable for developers worldwide. Daniel shares insights into maintaining an open-source project for over 26 years, including the complexities of supporting various architectures and quirky operating systems like Windows. The conversation highlights Daniel's anecdotes about crazy support requests, the importance of community building, and reducing friction for contributors. He also delves into adopting new standards in Curl, backward compatibility, and security measures to prevent supply chain attacks. Additionally, Daniel shares his thoughts on open-source funding, sponsorships, and the challenges faced by maintainers. Join Viktor for this insightful discussion with a true pioneer in the open-source world, offering valuable takeaways for developers, open-source enthusiasts, and anyone interested in software development.

On this episode of "Nerding Out with Viktor", we dive into the world of cybersecurity with special guest Allan. He shares his expertise on CISA, the civilian government's critical infrastructure defense and security agency, highlighting its role in safeguarding American society.

We also explore the concept of Software Bill of Materials (SBOMs), their origin, and why they're crucial for cybersecurity. Allan discusses the evolution of SBOMs, accelerated by executive orders, and international collaborations driving their implementation across various sectors.

From technical aspects to challenges and solutions, we cover it all. We discuss SBOM formats like CycloneDX and SPDX, common obstacles in generating and using SBOMs, and the importance of automation. Allan also shares his insights on open-source software and SBOMs, as well as the impact of international policies and frameworks on SBOM adoption and standardization.

Viktor's conversation with Allan provides practical advice for organizations starting their SBOM journey, offering a unique perspective on securing software supply chains and enhancing transparency in software development. Join us to discover the importance of SBOMs in today's cybersecurity landscape and how they can be leveraged for better software security.

In this episode of "Nerding Out with Viktor," Bryan Cantrill, CTO and co-founder of Oxide Computer Company, joins Viktor Petersson for a thought-provoking conversation about the future of cloud infrastructure. Bryan shares his expertise on DTrace, a game-changing system monitoring tool he pioneered at Sun Microsystems, which emphasized observation over modification, ensuring minimal impact on system performance.

The discussion delves into Bryan's experiences at Joyent, where he navigated the challenges of operating a public cloud on commodity hardware, and how these insights led to the founding of Oxide Computer Company. Viktor and Bryan explore the innovative design choices behind Oxide's holistic solution, which integrates hardware and software design for efficient and flexible cloud computing on-premises.

As the conversation unfolds, Bryan highlights the economic and practical benefits of owning infrastructure versus renting it from public cloud providers, making a compelling case for modern, scalable, and efficient computing solutions that can be deployed both in the cloud and on-premises. Join Viktor and Bryan as they nerd out over the evolution of computing technology and the future of cloud infrastructure, featuring one of the industry's leading innovators.

In this captivating episode of Nerding Out with Viktor, Christian Walter from 9Elements shares his expertise on firmware and hardware security, diving deep into vulnerabilities, BIOS security, and open-source firmware advancements. As a leading expert in the field, Christian brings years of experience in IT security, hardware security, and firmware development to the conversation.

Viktor and Christian explore two significant BIOS vulnerabilities: LogoFAIL and PixieFAIL, discussing their technical details, impact, and critical importance. They also discuss Trusted Platform Modules (TPMs), highlighting a recent vulnerability in Intel's TPMs and the need for stringent security measures. The conversation shifts to the Firmware CI Project, an initiative by 9Elements to simplify and automate firmware testing and development practices.

Christian shares his insights on the Open Source Firmware Foundation, its goals, and the importance of having a neutral ground for developing and promoting open-source firmware standards. He also expresses skepticism about AI integration in firmware, raising concerns about potential security risks. Don't miss this insightful episode with Christian Walter, perfect for firmware developers, security professionals, or tech enthusiasts looking to stay ahead in the world of firmware and hardware security.

In this episode of "Nerding Out with Viktor," join Viktor as he delves into the world of Linux and open source with Mark Shuttleworth, founder of Canonical and Ubuntu. This insightful conversation takes listeners on a journey through Mark's storied career, from pioneering space tourism to shaping the Linux ecosystem with Ubuntu.

Mark shares his experiences starting a certificate authority in the early days of the internet, offering valuable insights into the evolution of Ubuntu and its impact on the industry. The discussion also touches on the innovative concept of snaps, which has revolutionized package management for developers. Viktor and Mark explore the future of open source technology, providing listeners with a wealth of knowledge and inspiration.

Whether you're a seasoned Linux enthusiast or simply curious about the intersection of technology and business, this conversation offers something for everyone. Tune in to discover the stories and strategies behind one of the leading figures in tech today, and gain a deeper understanding of Mark's vision for the future of open source innovation.