Open Source Security

Josh and Kurt talk about the social norms of security. We also discuss security coprocessors and the reasons behind adding them to hardware. Is DRM a draconian security measure or do we need it to secure the future? We also touch on the story of NordVPN getting hacked. The real story isn't they got hacked, the story is they responded like clowns. The actual problem was one of leadership, there are certain leadership skills you can't be taught, you can only learn.

• Before Windows boots protections

Josh and Kurt talk about the horrid state of digital literacy in the US. We start out talking about broken Phillips Hue light bulbs, then discuss research from Pew on the digital literacy of Americans. We may have accidentally discovered a use for all the cookie warnings every web site has.

• Pew Research on American's Digitcal Literacy

Josh and Kurt about cybersecurity awareness month. What's our actionable advice we can give out? There isn't much which is a fundamental part of the problem.

• Cybersecurity awareness month
• Polar bear sized pigs

Josh and Kurt about a number of Microsoft security news items. They've changed how they are handling encrypted disks and are now forcing cloud logins on Windows users.

• Microsoft KB 4516071
• A Security Market for Lemons
• Kurt's file wiping advisory
• Lock Picking Lawyer vs Consumer Reports
• Sun Ray
• Linux Gamers: 20% of auto reported crashes

Josh and Kurt about DNS over HTTPS and how it may or may not destroy civilization. We also discuss the disruption of cloud in the context of security and touch on the news that GitHub is now a CVE CNA!

• DNS over HTTPS
• California Privacy Law
• Defensive Security Podcast
• GitHub is a CNA

Josh and Kurt about the upcoming Python 2 EOL. What does it mean, why does it matter, and what you can you do?

• Python Clock
• Python's statement about sunsetting Python 2
• wifi 6

Josh and Kurt speak with Allan Friedman of the US National Telecommunications and Information Administration about Software Bill of Materials. Where are we today, where are things going, and how you can help.

• Allan Friedman
• NTIA
• NTIA Software Component Transparency

Josh and Kurt start out discussing human nature and how it affects how we view security. A lot of things that look easy are actually really hard. We also talk about the npm library Standard showing command line ads. Are ads part of the future of open source?

• thegrugq secure android
• DoD JEDI program
• Firefox privacy settings
• Standard ads
• Max Headroom

Josh and Kurt talk about disclosing security flaws in open source. This is part two of a discussion around how to disclose security issues. This episode focuses on some expectations and behaviors for open source projects as well as researchers trying to disclose a problem to a project.

• webmin backdoor
• Github security advisories

Josh and Kurt talk about disclosing security flaws. It's a topic that's come up a few times in the last few weeks and it's more complicated than it's ever been. We certainly ask more questions than we answer in this episode, there will be a part 2 that focuses on open source disclosure.

• Lock Picking Lawyer
• Tavis' Windows flaw