Dependency attacks in 2026 with James Matchett

Dependency attacks in 2026 with James Matchett

Josh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There's no single thing we can do here, it's all about knowing what you have every step of the way. It's easy to say, but certainly a challenge to do right. James is a ton of fun to chat with and filled with energy and knowledge.

The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-10-james-cloudsmith

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(549)

Sovereignty, policy, and OpenUK with Amanda Brock

Sovereignty, policy, and OpenUK with Amanda Brock

Josh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions can affect a county an...

28 Syys 34min

The curl summer of Bliss with Daniel and Stefan

The curl summer of Bliss with Daniel and Stefan

Josh chats with Daniel and Stefan from curl about their summer of bliss. Curl stopped taking vulnerability reports for a month and nothing much happened really. Daniel and Stefan have a really pragmat...

21 Syys 33min

CRA vulnerability reporting with Daniel Thompson

CRA vulnerability reporting with Daniel Thompson

Josh welcomes back Daniel Thompson to explain what just happened regarding vulnerability reporting and the CRA on September 11. The very first CRA requirements kicked in, but what does it really mean?...

14 Syys 40min

Finding difficult vulnerabilities with Jaya Baloo from AISLE

Finding difficult vulnerabilities with Jaya Baloo from AISLE

Josh chats with Jaya Baloo from AISLE about their vulnerability scanner. If you follow open source vulnerabilities AISLE is a name you've seen popping up recently. They have a vulnerability scanner th...

7 Syys 29min

Sovereign Tech Agency with Erik Möller

Sovereign Tech Agency with Erik Möller

Josh chats with Erik Möller from the Sovereign Tech Agency about what they're doing. The Sovereign Tech Agency is doing some amazing work around funding open source maintainers and projects. Eric brea...

31 Elo 36min

CVEs vs Advisories with Paul Asadoorian

CVEs vs Advisories with Paul Asadoorian

Josh chats with Paul Asadoorian about a tool he wrote called fettle and a recent report Paul published on CVEs. Fettle is a tool to help update and manage Linux systems. The big sell on this one is ch...

24 Elo 38min

Maintaining EOL Open Source with Commonhaus and HeroDevs

Maintaining EOL Open Source with Commonhaus and HeroDevs

Josh chats with Erin Schnabel and Rob Nalen about a new effort from Commonhaus and HeroDevs for maintaining end of life open source. This project, the Open Source Sustainability Initiative is a clever...

17 Elo 34min