Episode 438 - CISA's bad OSS advice vs the Whitehouse good advice
Josh and Kurt talk about two documents from the US government that discuss open source in very different ways. The CISA document lays out a way to measure open source, but we take issue with the idea ...
22 Jul 202434min
Episode 437 - CocoPods and proper funding for open source
Josh and Kurt talk about a pretty big bug found in CocoPods ownership. We also touch on a paper that discusses the technical debt that open source should have. We discuss what the long term sustainabi...
15 Jul 202436min
Episode 436 - OpenSSH and node-ip - it's all exponential growth
Josh and Kurt talk about the recent OpenSSH vulnerability and the node-ip project owner taking their project private. They're quasi related in the context of two open source projects handled bugs very...
8 Jul 202432min
Episode 435 - polyfill.io - open source is too big to fix
Josh and Kurt talk about the latest polyfill.io mess. Apparently someone took over a very popular project and started to serve malware. First XZ, now this. What does it mean for open source? We don't ...
1 Jul 202438min
Episode 434 - Unreported vulnerabilities and everyone is getting hacked
Josh and Kurt talk about three wangles of responsibility. We start with a story about a bike theft ring, bike theft doesn't usually get any attention, but this one is special. Then we ask why it seems...
24 Jun 202431min
Episode 433 - Should OpenSSH block misbehaving clients?
Josh and Kurt talk about a new proposal from OpenSSH to add a timeout to penalize clients misbehaving. But this then brings up the typical security conversation of "if it's not perfect we shouldn't do...
17 Jun 202431min
Episode 432 - Flipper Zero with Alex Kulagin
Josh and Kurt talk to Alex Kulagin from Flipper about the Flipper Zero. It's one of the coolest hacker devices that exists on the market. We talk about what it is, how it started, what it can (and can...
10 Jun 202433min
Episode 431 - Redirecting HTTP to HTTPS
Josh and Kurt talk about a blog post titled "Your API Shouldn't Redirect HTTP to HTTPS". It's an interesting idea, and probably a good one. There is however a lot of baggage in this space as you'll he...
3 Jun 202432min
