Episode 421 - CISA's new SSDF attestation form
Josh and Kurt talk about the new SSDF attestation form from CISA. The current form isn't very complicated, and the SSDF has a lot of room for interpretation. But this is the start of something big. It...
25 Mar 202441min
Episode 420 - What's going on at NVD
Josh and Kurt talk about what's going on at the National Vulnerability Database. NVD suddenly stopped enriching vulnerabilities, and it's sent shock-waves through the vulnerability management space. W...
18 Mar 202439min
Episode 419 - Malicious GitHub repositories
Josh and Kurt talk about an attack against GitHub where attackers are creating malicious repositories then artificially inflating the number of stars and forks. This is really a discussion about how c...
11 Mar 202434min
Episode 418 - Being right all the time is hard
Josh and Kurt talk about recent stories about data breaches, flipper zero banning, and realistic security. We have a lot of weird challenges in the world of security, but hard problems aren't impossib...
4 Mar 202430min
Episode 417 - Linux Kernel security with Greg K-H
Josh and Kurt talk to GregKH about Linux Kernel security. We most focus on the topic of vulnerabilities in the Linux Kernel, and what being a CNA will mean for the future of Linux Kernel security vuln...
26 Feb 202442min
Episode 416 - Thomas Depierre on open source in Europe
Josh and Kurt talk to Thomas Depierre about some of the European efforts to secure software. We touch on the CRA, MDA, FOSDEM, and more. As expected Thomas drops a huge amount of knowledge on what's h...
19 Feb 202442min
Episode 415 - Reducing attack surface for less security
Josh and Kurt talk about a blog post explaining how to create a very very small container image. Generally in the world of security less is more, but it's possible to remove too much. A lot of today's...
12 Feb 202431min
Episode 414 - The exploited ecosystem of open source
Josh and Kurt talk about open source projects proving builds, and things nobody wants to pay for in open source. It's easy to have unrealistic expectations for open source projects, but we have the op...
5 Feb 202432min
