Open Source Security

Josh and Kurt talk about what's going on at the National Vulnerability Database. NVD suddenly stopped enriching vulnerabilities, and it's sent shock-waves through the vulnerability management space. While there are many unknowns right now, the one thing we can count on is things won't go back to the way they were.

• Anchore's Blog
• Grype
• Josh's Cyphercon Talk
• Ecosyste.ms
• Episode 266 – The future of security scanning with Debricked

Josh and Kurt talk about an attack against GitHub where attackers are creating malicious repositories then artificially inflating the number of stars and forks. This is really a discussion about how can we try to find signal in all the noise of a massive ecosystem like GitHub.

• GitHub besieged by millions of malicious repositories in ongoing attack

Josh and Kurt talk about recent stories about data breaches, flipper zero banning, and realistic security. We have a lot of weird challenges in the world of security, but hard problems aren't impossible problems. Sometimes we forget that.

• Mon Dieu! Nearly half the French population have data nabbed in massive breach
• Feds move to ban auto theft tech device 'Flipper Zero'
• Gmail and Yahoo's 2024 inbox protections and what they mean for your email program
• Vending machine error reveals secret face image database of college students

Josh and Kurt talk to GregKH about Linux Kernel security. We most focus on the topic of vulnerabilities in the Linux Kernel, and what being a CNA will mean for the future of Linux Kernel security vulnerabilities. The future of Linux Kernel security vulnerabilities is going to be very interesting.

• Greg K-H
• Linux Kernel is a CNA
• Machine learning and stable kernels
• Bug reporting for Linux

Josh and Kurt talk to Thomas Depierre about some of the European efforts to secure software. We touch on the CRA, MDA, FOSDEM, and more. As expected Thomas drops a huge amount of knowledge on what's happening in open source. We close the show with a lot of ideas around how to move the needle for open source. It's not easy, but it is possible.

• Thomas Depierre
• I am not a supplier
• Open Source In The European Legislative Landscape devroom
• Cyber Resilience Act
• The 2023 Tidelift state of the open source maintainer report

Josh and Kurt talk about a blog post explaining how to create a very very small container image. Generally in the world of security less is more, but it's possible to remove too much. A lot of today's security tooling relies on certain things to exist in a container image, if we remove them we could actually result in worse security than leaving it in. It's a weird topic, but probably pretty important.

• How I reduced the size of my very first published docker image by 40% - A lesson in dockerizing shell scripts
• Hacker News Discussion
• Episode 293 – Scoring OpenSSF Security Scoring

Josh and Kurt talk about open source projects proving builds, and things nobody wants to pay for in open source. It's easy to have unrealistic expectations for open source projects, but we have the open source capitalism demands.

• Open Source Doesn't Require Providing Builds
• The things nobody wants to pay for
• Audacity privacy policy update has caused an outcry
• The History of X11

Josh and Kurt talk about an attack against PyTorch and NPM. The PyTorch attack shows the difficulty of trying to operate a large open source project. The NPM problem is one of the difficulty in trying to backdoor open source. A lot of people are watching and it only takes one person to notice a problem and we all benefit.

• Peanut Butter the dog plays Gyromite
• The Wizard movie
• PyTorch supply chain attack
• npm Package Found Delivering Sophisticated RAT
• Deceptive Deprecation: The Truth About npm Deprecated Packages
• Changing a lightbulb
• Spelunking the Bitcoin Blockchain with Josh Bressers | CypherCon 4.0
• Operation Triangulation - What You Get When Attack iPhones of Researchers
• 9th Annual State of the Software Supply Chain

Josh and Kurt talk about the 23andMe compromise and how they are blaming the users. It's obviously the the fault of the users, but there's still a lot of things to discuss on this one. Every company has to care about cybersecurity now, even if they don't want to.

• Security leaders weigh in on 23andme hack
• Don't need a gun when you have a Donk - Crocodile Dundee 2
• Hackers can infect network-connected wrenches to install ransomware
• My disappointment is immeasurable, and my day is ruined

Josh and Kurt talk about a grab bag of old technologies that defined the security industry. Technology like SELinux, SSH, Snort, ModSecurity and more all started with humble beginnings, and many of them created new security industries.

• SELinux
• AppArmor
• SSH
• ModSecurity
• Snort
• Nmap
• Nessus
• What comes after open source