Open Source Security

Josh and Kurt talk about really weird networking bugs. Josh tells a story about his home network problems that made no sense. There was also a qt5 bug that affected wireless networks that made virtually no sense. What should count as a security vulnerability?

• Resolving an unusual wifi issue
• Hacker News thread
• Global Security Database
• IdeaPad 5 14ARE05

Josh and Kurt talk about the recent National Defense Authorization Act that requires security vulnerabilities to be fixed. What does this mean for us, is it as bad as some people are claiming it is? It's actually not a huge deal, for most of us it's really just time to deal with product security.

• The Hacker Mind
• The Untold Stories of Open Source
• H.R.7900 - National Defense Authorization Act for Fiscal Year 2023
• Kurt's blog post

Josh and Kurt talk to Dustin Childs about the recent ZDI Black Hat talk where they discovered the current trend of security patches not actually fixing the security problem. We talk about what this problem means. Why is it happening, and what ZDI is doing to try nudge the industry in the right direction.

• Dustin Childs
• ZDI
• Sloppy Software Patches Are a 'Disturbing Trend'
• Zero Day Initiative launches new bug disclosure timelines
• ISO 28147

Josh and Kurt talk about our lack of security and some of the data bias problems that can emerge. A lot of what we think is security data is really just biased data. This is OK as long as we understand the data is broken and know this is the first step in a longer journey.

• Tweet about data
• The 6 most common types of bias when working with data
• Syft and Grype stars graph
• John Snow, Cholera, the Broad Street Pump
• Bob Lord tweet

Josh and Kurt talk about a tweet from @kmcquade3 asking the question "What's a concept in security that is generally accepted as true but is actually bull%$#*?" How many of the replies make sense? Most of them do. We go over some of the best replies as fast as we can.

• The tweet that started it all
• Mark Loveless
• Mark Manning
• Richard (Dick) Brooks
• @ImbecillicusRex
• What Train Have We Got?
• Dan
• Alejo 🏳️‍🌈
• postmodern
• 🇺🇸 Robert C. Seacord 🇺🇦
• Yip Wai Peng
• Sachin Shahi

Josh and Kurt talk about leap seconds. Every time there's a leap second, things break. Facebook wants to get rid of them because they break computers, but Google found a clever way to keep leap seconds without breaking anything. Corner cases are hard, security is often just one huge corner case. There are lessons we can learn here.

• How and why the leap second affected Cloudflare DNS
• Facebook wants to get rid of leap seconds
• Leap Smear
• Falsehoods programmers believe about time

Josh and Kurt talk about Microsoft creating a policy of not allowing anyone to charge for open source in their app store. This policy was walked back quickly, but it raises some questions about how fair or unfair open source really is. It's mostly unfair to developers if you look at the big picture.

• Syft
• Grype
• Microsoft bans and unbans open source
• Tidelift survey
• Bruce Perens - What comes after open source

Josh and Kurt talk about PyPI mandating two factor authentication for the top 1% of projects. It feels like a simple idea, but it's not when you start to think about it. What problems does 2FA solve? How common are these attacks? What are the second and third order effects of mandating 2FA? This episode should have something for everyone on all sides of this discussion to violently disagree with.

• PyPI announcement
• NPM expired domains
• Morten Linderud Tweet
• Congratulations: We Now Have Opinions on Your Open Source Contributions

Josh and Kurt talk about their very silly GPG key management from the past. This is sadly a very true story that details how both Kurt and Josh protected their GPG keys. Josh's setup is like something out of a very bad spy novel. It was very over the top for a key that really didn't matter.

• XKCD signed email
• Shire calendar
• Guardian editors destroy Snowden laptop

Josh and Kurt talk about the challenge of dealing with vulnerabilities at a large scale. We tend to treat every vulnerability equally when they are not equal at all. Some are trees we have to pay very close attention to, and some are part of a larger forest that can't be treated as individual vulnerabilities. We often treat risk as a binary measurement instead of a sliding scale.

• gsd.id
• The Register OpenSSL story
• OpenSSL bug