Open Source Security

Josh and Kurt talk about the University of Minnesota experimenting on the Linux Kernel. There's a lot to unpack in this one, but the TL;DR is you probably don't want to experiment on the kernel.

• Linux Bans University of Minnesota for Sending Buggy Patches in the Name of Research
• University of Minnesota security researchers apologize for deliberately buggy Linux patches
• The International Obfuscated C Code Contest

Josh and Kurt talk about what 3rd party means in the current world. From 5G suppliers, to the Codecov and Solarwinds breaches. Is there anyone we can trust?

• Europe and 5G
• Codecov
• Codecov Reuters story
• Red Hat OpenSSH advisory

Josh and Kurt talk about 0day security vulnerabilities. What are they? What were they? And why the name has taken on a new meaning, and that's OK.

• Hacker History Podcast
• Chrome 0day
• NTFS Documentation

Josh and Kurt talk to Emil Wåreus from Debricked about the future of security scanners. Debricked is doing some incredibly cool things to avoid relying on humans for vulnerability identification and cataloging. Learn what the future of security scanning is going to look like.

Show Notes

• Debricked
• Emil's Linkedin

Josh and Kurt talk about the PHP backdoor and the Ubiquity whistleblower. The key takeaway is to note how an open source project cannot cover up an incident, but closed source can and will cover up damaging information.

• PHP backdoor
• Ubiquity coverup
• 3D printed TSA keys
• LockPickingLaywer
• Determining Key Shape from Sound
• Lock camera

Josh and Kurt talk to Mark Loveless from GitLab. We touch on DevSecOps, what GitLab is doing, threat modeling, and the time Mark tested positive for TNT at the airport. It's a great conversation.

Show Notes

• Mark Loveless Twitter
• GitLab
• GitLab Handbook
• How we approach open source security
• PASTA threat modeling
• GitLab security features
• Tales from the Past - "You Tested Positive for TNT"

Josh and Kurt talk about how terrible daylight savings is. GitHub yanking some exploit code. And the Linux Foundation new project to sign all the things.

• Researcher Publishes Code to Exploit Microsoft Exchange Vulnerabilities on Github
• GitHub content restrictions
• Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Josh and Kurt talk to Loris Degioanni and Dan from Sysdig. Sysdig are the minds behind Falco, an amazing open source runtime security engine. We talk about where their technology came from, they huge code donation to the CNCF and what securing a modern infrastructure looks like today.

• Sysdig
• Falco
• Loris' Twitter
• Dan "Pop" Popandrea's Twitter
• Sysdig contributes Falco's kernel module, eBPF probe, and libraries to the CNCF
• pdig
• Sysdig 2021 container security and usage report: Shifting left is not enough

Josh and Kurt talk about DWF. It's back and the intention is to have real community driven security identifiers!

Show Notes

• Committee vs Community
• dwflist repo
• dwf-request tooling repo
• dwf-workflow policy repo
• CVE plateua graph
• iwantacve.org

Josh and Kurt talk with Dave Jevans CEO of CipherTrace and chairman of the anti-phishing working group about the challenges of keeping track of cryptocurrency in the modern age.

Show Notes

• Dave's Twitter
• CipherTrace
• Anti Phishing Working Group