I had a chat on #OpenSourceSecurity with Kat Cosgrove about open source being critical infrastructure Kat has a ton of experience in the world of Kubernetes and had some really interesting things to tell us about both successful projects as well as having to shut down projects

Weekend at Bernie's - Which of your dependencies are wearing sunglasses? nesbitt.io/2026/05/08/w...

The the wrap up with David Bernstein around how to test a disaster recovery / emergency response plan I'm pretty excited to get these out, it feels like this topic is more relevant than it's ever been and David does a nice job explaining it all opensourcesecurity.io/2026/2026-05...

Some incredible in-depth discussion between @vlad.website and @josh.bressers.name on the importance (and challenges) of paying OSS maintainers in this episode of Open Source Security! (PS thanks for the shout-out ☀️) opensourcesecurity.io/2026/2026-04...

I really enjoyed talking to @josh.bressers.name about the @opensourcepledge.com, and about why and how we should support Open Source maintainers 😊

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

I had chat with David Bernstein about creating a disaster recovery plan on #OpenSourceSecurity With all the events unfolding almost every day lately, there's never been a better time to put a plan like this together. In a few weeks David will tell us how to test such a plan once we create it

A new #HackerHistory is out! This time we hear the story of Pyr0 Pyr0 tells us about a new upcoming conference all about hacker history, NaClCON Then we hear about a lot of awesome hacker history It's a great story! hackerhistory.com/podcast/the-...

I had a chat with Paul McCarty about his project @opensourcemalware.bsky.social Paul has a ton of great insight into what's happening with the massive influx of malware into our open source ecosystems opensourcesecurity.io/2026/2026-04...

I had a chat with @andrewnez.bsky.social about why creating a new package repository is so hard. There are a ton of little details like support from SBOM and vulnerability scanners nobody even thinks about. There are so many little details Andrew does a great job explaining all this and more

This week I had a chat with Michael Winser about securing open source at scale We recorded prior to the events of the last few weeks, everything Michael talks about with securing our infrastructure is spot on

@josh.bressers.name put it well: MCP is moving faster than anyone can keep up with. @lukehinds.bsky.social joined #OpenSourceSecurity to dig into why agent security is structurally hard and what kernel-level sandboxing nono.sh actually solves. Episode: opensourcesecurity.io/2026/2026-03...

great chat, with a great chap (Josh, not me).

I had a chat on #OpenSourceSecurity with @lukehinds.bsky.social about his project nono as well as MCP security nono is a sandbox for containing all these tools which is an incredibly difficult problem to solve. The things we see skills and MCP doing are moving forward faster than anyone can keep up

This week on #OpenSourceSecurity I had a chat with Paul Kehrer and Alex Gaynor about the statement they published discussing the challenges posed by modern OpenSSL for the python cryptography module

I had a chat on #OpenSourceSecurity with @sylvestreledru.bsky.social about his Rust coreutils work Replacing coreutils with Rust is one of those things that I love as a way to improve security but also keep a project fresh in the modern age I learned a ton from this disucssion

This week on #OpenSourceSecurity I chat with Brad Axen about Goose and the Agentic AI Foundation I'm often skeptical about AI claims, but I do approve the foundation model and seeing Goose donated to it

How does open source business model work, why is user empowerment so important, and when is the right time for digital sovereignty? Find out in the new episode of the @josh.bressers.name podcast as he is joined by our founder @karlitschek.bsky.social

I had a chat with @oej.edvina.net about The Global Vulnerability Intelligence Platform Olle is working to build a community around the future of vulnerability identifiers Don't just give it a listen, but also come help Olle. It's a pretty important problem that nobody can solve alone

I had a chat with Frank Karlitschek from @nextcloud.bsky.social about digital sovereignty There's a lot of attention lately around digital sovereignty and often that conversation also includes Nextcloud

This episode of #OpenSourceSecurity I have a chat with David Bernstein about crisis response I love this topic because responding to a crisis is pretty common in security work, but doesn't have to be a gong show This is one of those topics that can go deep. David did a nice job covering basics

In a recent episode of Open Source Security, @josh.bressers.name sits down with Victor Julien, founder and lead developer of the #Suricata project. Tune in now! opensourcesecurity.io/2026/2026-01...

This episode of #OpenSourceSecurity I discuss @suricata.io with Victor Julian Victor tells us all about the past, present, and future of #Suricata I learned a ton opensourcesecurity.io/2026/2026-01...

This week on #OpenSourceSecurity I have a chat with Gergely Nagy about Iocaine Iocaine creates a maze of garbage to trap scraping bots. I love this idea, it has amazing chaotic good energy! I learn all about how Iocaine works, and even got to see some dashboards showing off the size of the problem

This week on #OpenSourceSecurity I have a chat with Xe Iaso about #Anubis, the tool that stops web AI scrapers The scale of web scraping is way worse than I expected, and blocking things is also a lot harder than I expected This is one of those conversations where I learned how little I know

This week on #OpenSourceSecurity I chat with Dirkjan Ochtman and Joe Birr-Pixton about #Rustls. A lot has happened with Rustls in the last few years (and there's a lot more to come). Writing a TLS implementation is incredibly complicated, even when you don't have to worry about memory safety

On a very special Christmas episode of #OpenSourceSecurity I asked Daniel Thompson-Yvetot how the #CRA will impact Santa Claus I meant the episode to be silly, just in time for Christmas, but I think I learned more from Daniel in those 50 minutes than I have in the last 3 years reading about CRA

This #OpenSourceSecurity episode I chat with Gabriele Columbro from @linuxfoundationeu.bsky.social We of course chat about the #CRA and how he helped with shaping what we see today We also cover open source sustainability, vertical foundations, and all the attention open source is receiving

This week on #OpenSourceSecurity I chat with Jamie Tanna about updating open source dependencies. It's usually not as simple as "just update" and Jamie has a ton of real world experience in this working on Renovate opensourcesecurity.io/2025/2025-12...

This was so much fun to talk about! If you want to find out how we found this bug, the raw story is here first, in my own words :)

This episode of #OpenSourceSecurity I chat with @alex.zenla.io from @edera.dev about the #TARmageddon vulnerability they found I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one

#OpenSourceSecurity has a chat with @sethmlarson.dev about @python.org security Seth has a new whitepaper, there's a CFP open (which you should submit a paper to), and some discussion about the PSF grant situation It's always fun to chat with Seth, I learn a ton every time!

On this episode of #OpenSourceSecurity I chat with Richard Hughes about the Linux Vendor Firmware Service (LVFS) While it's amazing we can update firmware from Linux now, it was a ton of work to get us here

I had a chat with @charlieeriksen.bsky.social about the recent NPM attacks We chat about what happened (now that the dust settled), and we discuss what's next. Charlie is doing some great work in this space, he understands the problem better than most

This week on #OpenSourceSecurity I talk to @ottoke.bsky.social about his blog post about detecting an attack like xz in Debian It's a fascinating conversation about a very complicated topic There are things that could be detected, but this one would have been very very difficult

I chat with @mikael.barbero.tech about security happenings at the Eclipse Foundation My favorite project they have is helping projects generate #SBOMs, but there's a lot happening. If you want to see some public examples of how to do security right, give it a listen!

🎙 Just wrapped a fantastic conversation with @josh.bressers.name. We dive deep into enhancing open source security and how we do it at the @eclipse.org Can't wait for you to hear the full episode, coming soon!

On #OpenSourceSecurity I had a chat with @brianfox.bsky.social about the sustainability letter from the open source package registries This one is a big deal. The costs for open source are paid by someone, if you don't know who, you need to read this letter opensourcesecurity.io/2025/2025-10...

MCP is having a moment. @josh.bressers.name wanted to know: what are we actually shipping? 9,000 vulns 263 critical findings 36K+ NPM packages Outdated base images Not fear-mongering—just data-driven real... https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/ #MCP #ContainerSecurity

This week on #OpenSourceSecurity I chat with @foxboron.bsky.social and Levente Polyak about Arch Linux security. It's a great chat where we talk about all the difficulties and oddities of trying to keep a Linux distribution secure I learned a ton, I'm sure you will too

This episode of #OpenSourceSecurity I chat with Hana Andersen and Anton Arapov about their upcoming #OpenSSL conference They also answer a bunch of my questions about the structure of the OpenSSL project, how we got where we are today, and what's coming next opensourcesecurity.io/2025/2025-09...

Don’t miss this podcast episode with the PSF’s Executive Director, @eximious.bsky.social, on funding open source, PyCon US, global community support & the importance of sustainability!

This episode of #OpenSourceSecurity I chat with Deb Nicholson about the Python Software Foundation. We discuss what they do, their current grant program, and how you can get involved The PSF is the group behind the legendary Python community. It's a fun chat, Deb has so much knowledge to share

A new @cyphercon.bsky.social #HackerHistory is out! This time I'm talking to Dr. Laura Scherling, EdD, Rachael Tubbs, and Ben Schmerler. It's a super fun conversation where we cover some past, present, and future of hacking

I had a chat with Didier Barzin about his open source project Mercator Mercator maps assets, monitors compliance, looks for vulnerabilities, and more. I learned so much talking to Didier about what managing assets at a large health care provider looks like.

I had a chat with David Bernstein on the @cyphercon.bsky.social #HackerHistory podcast David tells us all about his experience in emergency management. David isn't what many would consider a traditional hacker, but it's clear he has had incredible impact over the years.

This week on #OpenSourceSecurity I talk to Andrey Smirnov about Talos Linux security If you run Kubernetes clusters, big or small, you should look at Talos! Also listen to this discussion, in the order of your choosing.

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting So I wrote a blog post about it An absolutely ridiculous amount of open source is one person projects. I have the data to prove it opensourcesecurity.io/2025/08-oss-...

This episode of #OpenSourceSecurity I chat with Ali Akhavani and Behzad Ousat about their paper Open Source, Open Threats? Investigating Security Challenges in Open-Source Software We chat about what some of this means now and what it could mean in the future. It's a great discussion!

This episode of #OpenSourceSecurity I chat with @tobias.bieniek.cloud about crates.io trusted publishing I learned a ton about how trusted publishing works, it's one of those very new and very interesting topics And of course anytime I can talk about #Rust it's a great chat :)