Open Source Security

Josh and Kurt talk about video games. Yeah, video games. Specifically about cheating in video games. There's a lot of other security themes in the discussion. With the news being horrible these days, we needed to talk about something fun.

• Penny Arcade
• Banned from Fortnite
• Apollo Robbins, world's best pickpocket

Josh and Kurt talk about Wireguard. There have been a lot of recent conversations about it and if it's better or worse than other VPN solutions. It's safe to say in our modern age, less is usually more, especially when it comes to security. Wireguard has a lot going for it, it can't be ignored.

• Replacing a Nintendo Switch fan
• WireGuard
• Hacker News discussion

Josh and Kurt talk to Tony Meehan from Elastic (formerly Endgame) about endpoint detection, response, protection, and even SIEM. Tony has a great history coming from the NSA and has a number of great stories to help understand the topics.

• Tony Meehan
• Rob Joyce on Disrupting Nation State Hackers
• Bobby Filar living off the land blog
• Dwell time graph
• Snowboarder vs Tree

Josh and Kurt talk about the Linux Foundation Census 2. There is a lot of talk around how to fix open source security, but the reality is we can't fix it. We need to stop trying to fix what isn't broken and engineering around the system we have, not the system we want.

• Linux Foundation Census 2
• Core Infrastructure Initiative

Josh and Kurt talk about the sale of the corp.com domain. Is it going to be the end of the world, or a non event? We disagree on what should happen with it. Josh hopes an evildoer buys it, Kurt hopes for Microsoft. We also briefly discuss the CIA owning Crypto AG.

• corp.com is for sale
• CIA owned Crypto AG

Josh and Kurt talk about a huge working from home experiment because of the the Coronavirus. We also discuss some of the advice going on around the outbreak, as well as how humans are incredibly good at ignoring good advice, often to their own peril. Also an airplane wheel falls off.

• Work from home Hacker News discussion
• CDC advice
• How to wash your hands
• Air Canada flight without running wather
• Airplane wheel falling off

Josh and Kurt talk about open source maintainers and building communities. While an open source maintainer doesn't owe anyone anything, there are some difficult conversations around holding back a community rather than letting it flourish.

• Actix-web story
• Lodash
• Possible Lodash security issue
• Javascript libraries are almost never updated
• Ularn

Josh and Kurt talk about SIM swapping. What is it, how does it work. Why should you care? There's not a ton you can do to protect yourself, but we go over some of the basic concepts and what to watch out for. It's unfortunate this is still a problem.

• Five Major US Wireless Carriers Are Vulnerable to SIM Swapping
• Edmonton Police SIM swap website

Josh and Kurt talk about two recent vulnerabilities that have had very different outcomes. One was the Citrix remote code execution flaw. While the flaw is bad, the handling of the flaw was possibly worse than the flaw itself. The other was the Microsoft ECC encryption flaw. It was well handled even though it was hard to understand and it is a pretty big deal. As all these things go, fixing and disclosing vulnerabilities is hard.

• Microsoft flaw CVE-2020-0601
• Citrix flaw CVE-2019-19781
• Citrix mitigation instructions

Josh and Kurt talk about the updated Google Project Zero disclosure policy. What's the new policy, what does it mean, and will it really matter? We suspect it will improve some things, but won't drastically change much.

• Google and 90 day patch disclosure
• Upgrading all Windows versions