I had a chat on #OpenSourceSecurity with @sylvestreledru.bsky.social about his Rust coreutils work Replacing coreutils with Rust is one of those things that I love as a way to improve security but also keep a project fresh in the modern age I learned a ton from this disucssion

This week on #OpenSourceSecurity I chat with Brad Axen about Goose and the Agentic AI Foundation I'm often skeptical about AI claims, but I do approve the foundation model and seeing Goose donated to it

How does open source business model work, why is user empowerment so important, and when is the right time for digital sovereignty? Find out in the new episode of the @josh.bressers.name podcast as he is joined by our founder @karlitschek.bsky.social

I had a chat with @oej.edvina.net about The Global Vulnerability Intelligence Platform Olle is working to build a community around the future of vulnerability identifiers Don't just give it a listen, but also come help Olle. It's a pretty important problem that nobody can solve alone

I had a chat with Frank Karlitschek from @nextcloud.bsky.social about digital sovereignty There's a lot of attention lately around digital sovereignty and often that conversation also includes Nextcloud

This episode of #OpenSourceSecurity I have a chat with David Bernstein about crisis response I love this topic because responding to a crisis is pretty common in security work, but doesn't have to be a gong show This is one of those topics that can go deep. David did a nice job covering basics

In a recent episode of Open Source Security, @josh.bressers.name sits down with Victor Julien, founder and lead developer of the #Suricata project. Tune in now! opensourcesecurity.io/2026/2026-01...

This episode of #OpenSourceSecurity I discuss @suricata.io with Victor Julian Victor tells us all about the past, present, and future of #Suricata I learned a ton opensourcesecurity.io/2026/2026-01...

This week on #OpenSourceSecurity I have a chat with Gergely Nagy about Iocaine Iocaine creates a maze of garbage to trap scraping bots. I love this idea, it has amazing chaotic good energy! I learn all about how Iocaine works, and even got to see some dashboards showing off the size of the problem

This week on #OpenSourceSecurity I have a chat with Xe Iaso about #Anubis, the tool that stops web AI scrapers The scale of web scraping is way worse than I expected, and blocking things is also a lot harder than I expected This is one of those conversations where I learned how little I know

This week on #OpenSourceSecurity I chat with Dirkjan Ochtman and Joe Birr-Pixton about #Rustls. A lot has happened with Rustls in the last few years (and there's a lot more to come). Writing a TLS implementation is incredibly complicated, even when you don't have to worry about memory safety

On a very special Christmas episode of #OpenSourceSecurity I asked Daniel Thompson-Yvetot how the #CRA will impact Santa Claus I meant the episode to be silly, just in time for Christmas, but I think I learned more from Daniel in those 50 minutes than I have in the last 3 years reading about CRA

This #OpenSourceSecurity episode I chat with Gabriele Columbro from @linuxfoundationeu.bsky.social We of course chat about the #CRA and how he helped with shaping what we see today We also cover open source sustainability, vertical foundations, and all the attention open source is receiving

This week on #OpenSourceSecurity I chat with Jamie Tanna about updating open source dependencies. It's usually not as simple as "just update" and Jamie has a ton of real world experience in this working on Renovate opensourcesecurity.io/2025/2025-12...

This was so much fun to talk about! If you want to find out how we found this bug, the raw story is here first, in my own words :)

This episode of #OpenSourceSecurity I chat with @alex.zenla.io from @edera.dev about the #TARmageddon vulnerability they found I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one

#OpenSourceSecurity has a chat with @sethmlarson.dev about @python.org security Seth has a new whitepaper, there's a CFP open (which you should submit a paper to), and some discussion about the PSF grant situation It's always fun to chat with Seth, I learn a ton every time!

On this episode of #OpenSourceSecurity I chat with Richard Hughes about the Linux Vendor Firmware Service (LVFS) While it's amazing we can update firmware from Linux now, it was a ton of work to get us here

I had a chat with @charlieeriksen.bsky.social about the recent NPM attacks We chat about what happened (now that the dust settled), and we discuss what's next. Charlie is doing some great work in this space, he understands the problem better than most

This week on #OpenSourceSecurity I talk to @ottoke.bsky.social about his blog post about detecting an attack like xz in Debian It's a fascinating conversation about a very complicated topic There are things that could be detected, but this one would have been very very difficult

I chat with @mikael.barbero.tech about security happenings at the Eclipse Foundation My favorite project they have is helping projects generate #SBOMs, but there's a lot happening. If you want to see some public examples of how to do security right, give it a listen!

🎙 Just wrapped a fantastic conversation with @josh.bressers.name. We dive deep into enhancing open source security and how we do it at the @eclipse.org Can't wait for you to hear the full episode, coming soon!

On #OpenSourceSecurity I had a chat with @brianfox.bsky.social about the sustainability letter from the open source package registries This one is a big deal. The costs for open source are paid by someone, if you don't know who, you need to read this letter opensourcesecurity.io/2025/2025-10...

MCP is having a moment. @josh.bressers.name wanted to know: what are we actually shipping? 9,000 vulns 263 critical findings 36K+ NPM packages Outdated base images Not fear-mongering—just data-driven real... https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/ #MCP #ContainerSecurity

This week on #OpenSourceSecurity I chat with @foxboron.bsky.social and Levente Polyak about Arch Linux security. It's a great chat where we talk about all the difficulties and oddities of trying to keep a Linux distribution secure I learned a ton, I'm sure you will too

This episode of #OpenSourceSecurity I chat with Hana Andersen and Anton Arapov about their upcoming #OpenSSL conference They also answer a bunch of my questions about the structure of the OpenSSL project, how we got where we are today, and what's coming next opensourcesecurity.io/2025/2025-09...

Don’t miss this podcast episode with the PSF’s Executive Director, @eximious.bsky.social, on funding open source, PyCon US, global community support & the importance of sustainability!

This episode of #OpenSourceSecurity I chat with Deb Nicholson about the Python Software Foundation. We discuss what they do, their current grant program, and how you can get involved The PSF is the group behind the legendary Python community. It's a fun chat, Deb has so much knowledge to share

A new @cyphercon.bsky.social #HackerHistory is out! This time I'm talking to Dr. Laura Scherling, EdD, Rachael Tubbs, and Ben Schmerler. It's a super fun conversation where we cover some past, present, and future of hacking

I had a chat with Didier Barzin about his open source project Mercator Mercator maps assets, monitors compliance, looks for vulnerabilities, and more. I learned so much talking to Didier about what managing assets at a large health care provider looks like.

I had a chat with David Bernstein on the @cyphercon.bsky.social #HackerHistory podcast David tells us all about his experience in emergency management. David isn't what many would consider a traditional hacker, but it's clear he has had incredible impact over the years.

This week on #OpenSourceSecurity I talk to Andrey Smirnov about Talos Linux security If you run Kubernetes clusters, big or small, you should look at Talos! Also listen to this discussion, in the order of your choosing.

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting So I wrote a blog post about it An absolutely ridiculous amount of open source is one person projects. I have the data to prove it opensourcesecurity.io/2025/08-oss-...

This episode of #OpenSourceSecurity I chat with Ali Akhavani and Behzad Ousat about their paper Open Source, Open Threats? Investigating Security Challenges in Open-Source Software We chat about what some of this means now and what it could mean in the future. It's a great discussion!

This episode of #OpenSourceSecurity I chat with @tobias.bieniek.cloud about crates.io trusted publishing I learned a ton about how trusted publishing works, it's one of those very new and very interesting topics And of course anytime I can talk about #Rust it's a great chat :)

This week on #OpenSourceSecurity I chat with @patrickmgarrity.bsky.social about what's going on with #CVE It's been a wild couple of months, we break down where are today, where we think it's going to go soon, and why there are some difficult times ahead for vulnerability nerds

I talked to Daniel Thompson-Yvetot on the latest episode of #OpenSourceSecurity The main topic was the coming regulation for software developers. While there are carve outs for open source projects, what counts as an open source project isn't as clear as I thought it was.

This #OpenSourceSecurity episode I chatted with Jan Pleskac from Tropic Square about open source microprocessors I learned an incredible amount about how this all works, what Tropic Square is trying to do, and what we can start to expect in the future

I chatted with Philippe Ombredanne about Package URLs, or PURLs. He created them, so he knows a thing or two. We do complain about CPE quite a bit :) But it's a really hard problem. It feels like a package identifier should be easy, but it's way harder than you think it is.

#OpenSourceSecurity chats with @[email protected] about his blog post explaining hobbyist open source maintainers Whatever you think you know about open source, you're going to learn something from this one

This episode of #OpenSourceSecurity I chat with Aaron Lippold from MITRE about #STIG automation (it's one big open source project) STIG has historically been incredibly difficult Thanks to #FedRAMP it's getting more attention than ever before and the work Aaron has been doing makes it a lot easier

This week #OpenSourceSecurity chats with @andrewnez.bsky.social about Ecosyste.ms Ecosyste.ms is a massive collection of data about open source It's an amazingly useful collection of data. If you're doing anything that needs information about open source you should check it out

I chatted with @daniel.haxx.se about #Curl and the recent #AI happenings It's always fun talking to Daniel, and I think there's a lot of good ideas in this one, especially on how to approach AI fueled contributions that aren't slop. And even suggestions on how to deal with slop contributions :)

I spoke with Kairo De Araujo about signing package repositories with RSTUF. It's one of those topics that's incredibly hard and I learn so much anytime I chat with an expert Just because you're using a package mirror doesn't mean you shouldn't think about signing the artifacts

Obfuscated JavaScript in Phishing Kits technicaloutcast.com...

I chatted with @yossarian.net about securing GitHub Actions with Zizmor I learned a ton, and given all the recent news about GitHub Actions, everyone should be looking at Zizmor opensourcesecurity.io/2025/2025-05...

I had the opportunity to join @paulasadoorian.bsky.social on the @eclypsium.bsky.social podcast to talk about open source and that whole supply chain thing It was a fun chat and Paul is always a great host eclypsium.com/podcasts/bts...

This was fun, make sure you check it out!

This episode of #OpenSourceSecurity I talk with @paulasadoorian.bsky.social about embedded security, but with an open source twist It's open source all the way down. And old open source quite often. It's a really fun discussion, I learned a lot! opensourcesecurity.io/2025/2025-05...

This episode of #OpenSourceSecurity I chat with Dimitri Stiliadis of @endorlabs.bsky.social about the tj-actions/changed-files backdoor Endor did some great research into how many repos were affected and we cover some of the background on this attack. It's way weirder than you can imagine