Open Source Security

Josh and Kurt talk about the Krebs blog post titled "When in Doubt: Hang Up, Look Up, & Call Back". In the world of security there isn't a lot of actionable advice, it's worth discussing if something like this will work, or ever if it's the right way to handle these situations.

Show notes

• When in Doubt: Hang Up, Look Up, & Call Back
• Tech Support Scam podcast: Part 1, Part 2
• STIR/SHAKEN
• Drill the wrong safe deposit box
• 2009 Bank of Ireland robbery

Josh and Kurt talk about what beer and reproducible builds have in common. It's a lot more than you think, and it mostly comes down to quality control. If you can't reproduce what you do, you're not a mature organization and you need maturity to have quality.

• Reinheitsgebot
• Josh's Blog Post
• Ken Thompson's reflections on trusting trust
• Tor Browser Deterministic Builds
• One line package broke npm create
• Donkey Kong 64 memory leak

Josh and Kurt talk about automatic updates. Specifically we discuss a recent decision by Ubuntu to enable forced automatic updates. There are lessons here for the security community. We have a history of jumping to solutions rather than defining and understanding problems. Sometimes our solutions aren't the best. Also murder bees.

• The Oatmeal giant bee comic
• Honeybees cook giant hornet
• Ubuntu 20.04 LTS' snap obsession has snapped me off of it
• Forum discussion

Josh and Kurt talk about the uproar around Cloudflare's "Is BGP safe yet" site. It's always interesting watching how much people will push back on new things, even if the new things is probably a step in the right direction. The clever thing Cloudflare is doing in this instance is they are making the BGP problem something anyone can understand. Also send us your funny dog stories.

• Is BGP safe yet?
• Reddit BGP conversation
• Hacker News BGP conversation
• Stealing cryptocurrency with BGP

Josh and Kurt talk about the new normal that's working away from an office. It's not exactly working from home as there are some unforeseen challenges that we just took for granted in the past. There are a lot of new and strange security problems we have to adapt to, everyone is doing amazing work with very little right now.

• Microsoft buys corp.com
• Hijack computer network traffic with a Pi Zero

Josh and Kurt talk about space. We intended to focus on Apollo 13 but as usual we have no ability to stay on topic. There is a lot of fun space discussions in this one though. Do you think you can hack Voyager 1? Only if you have a big enough satellite dish.

• Eavesdropping on Apollo 11
• Apollo 11 classified weather satellite
• The pen that saved Apollo 11

Josh and Kurt talk about Kurt's recent treadmill purchase and the lessons we can lean in security from the consumer market. The consumer market has learned a lot about how to interact with their customers in the last few decades, the security industry is certainly behind in this space today. Once again we display our ability to tie even the seemingly mundane things back to a discussion about security.

• Eating goldfish off the treadmill

Josh and Kurt talk about security scanners. They're all pretty bad today, but there are some things we can do to make them better. Step one is to understand the problem. Do you know why you're running the scanner and what the reports mean?

• Edmonton freeze thaw cycles
• Josh's security scanner blog series

Josh and Kurt talk about building a talent ecosystem. What starts out as an attempt by Kurt to talk about Canada evolves into a discussion about how talent can evolve, or be purposely grown. Canada's entertainment industry and Unit 8200 are good examples of this.

• SCTV
• Red Team Project
• Moon Shot book
• AvE channel
• Turning a tree root into a bowl
• Mailing the Hope Diamond
• The Ecosystem

Josh and Kurt talk about video games and hacking. Specifically how speed runners are really just video game hackers.

• Developer speedrun commentary
• Super Mario World end credits glitch explained
• Mario 3 RCE
• Breath of the Wild speedrun
• Super Metroid reverse boss order
• TMR beats every NES game