Josh and Kurt talk about three government activities happening around security. CISA has a request for comment, and an international strategic plan around cybersecurity. These are both good ideas, and hopefully will help drive change. But we also discuss an EU proposal that brings liability rules to software which sounds like a great way to force change to happen.

• Request for Comment on Product Security Bad Practices Guidance
• FY2025-2026 CISA International Strategic Plan
• EU brings product liability rules in line with digital age and circular economy
• CSA Cloud Controls Matrix

Josh and Kurt talk about the Meshtastic open source project. It's a really slick mesh radio system that runs on very cheap radio equipment. This episode isn't very security related (there are a few things), but it is very open source.

• Meshtastic
• Heltec LoRa 32(V3) Radio
• 465 Rutgers University Confirmed: Meshtastic and LoRa are dangerous
• Meshtastic Routing Issues & Deployment Scenarios
• TC2-BBS-mesh
• The Comms Channel
• Josh's BBS
• Heltec T114 bug

Josh and Kurt talk about a story that discusses a story from Black Hat that references supply chains. There's a ton of doom and gloom around our software supply chains and much of the advice isn't realistic. If we want to take this seriously we need to stop obsessing over the little problems and focus on some big problems.

• Black Hat USA 2024: Key Takeaways from the Premier Cybersecurity Event
• The Reason Train Design Changed After 1948

Josh and Kurt talk to Jill Moné-Corallo about GitHub's bug bounty and product security team. It's a treat to discuss bug bounties with someone who is managing a very large bug bounty for one of the most important web sites in the world of software today.

• Jill's Twitter
• Jill's Mastodon
• GitHub Bug Bounty
• Bug bounty scope
• Eight years of the GitHub Security Bug Bounty program
• GitHub NPM bug bounty find

Josh and Kurt talk about a new tool that can do Stylometry analysis of Hacker News authors. The availability of such tools makes anonymity much harder on the Internet, but it's also not unexpected. The amount of power and tooling available now is incredible. We also discuss some of the future challenges we will see from all this technology.

• Hacker News Stylometry Analyzer
• FBI Profiler on the Unabomber
• Impersonate Eli Lilly for $8
• Shakespeare Stylometry

Josh and Kurt talk about end to end encrypted messages. This has been a popular topic lately due to the Mastodon popularity. Mastodon has a uniquely insecure messaging system, but they aren't the only one. The eternal debate of can security and usability exist together? We suspect it can't be, but it's a very complicated topic.

• EFF on Mastodon DM privacy
• Towards End-to-End Encryption for Direct Messages in the Fediverse
• Pluralistic: 14 Nov 2022 Even if you're paying for the product, you're still the product

Josh and Kurt talk about email security and the perils of trying to run your own mail infrastructure. We then get into discussing the value and danger of trying to run your own infrastructure, email, blogs, or most anything. There's a lot to juggle about all this these days, it's complicated.

• PowerDMARC
• Will Dormann
• GossiTheDog upgrades Exchange
• lcamtuf's blog
• I like Ice Cream

Josh and Kurt talk about the UK plan to scan their country's IP space. The purpose and outcome of this isn't completely clear at this point, but we are hopeful the data can be used as a positive force. We are only going to see more programs like this as all the governments are told they have to cyber harder.

• NCSC Scanning information
• Motherboard podcast about NCIS

Josh and Kurt talk about the recent OpenSSL nothingburger. OpenSSL got everyone whipped into a frenzy over a critical vulnerability, then changed the severity to high. The correct solution to this whole problem is to stop using a TLS library written in C, we need to be using memory safe languages. Don't migrate from OpenSSL 1 to 3, migrate from OpenSSL 1 to Rustls.

• OpenSSL Blog Post
• OpenSSL pre-announcement
• Mark Cox Tweet 3.0 only affected
• GossiTheDog NDA Tweet
• Claims of a name and logo
• Rustls

Image Credit

Josh and Kurt talk about Lufthansa trying to ban Airtags. This has a similar feel to all the security events where a company tries to hand waive away a security problem then having to walk back all their previous statements. There is almost always a massive imbalance between the large companies and consumers.

• Lufthansa bans airtags
• Airtag stalking problems
• Lufthansa unbans airtags
• Cult of the Dead Cow book
• TV Typewriter
• Andre the Giant on an airplane
• Poison Squad

Josh and Kurt talk about stories detailing tech working with multiple jobs. This raises some questions about fairness, accountability, and the future of work. As an industry we are very bad at measuring what we do, which is a problem shared with many jobs currently working from home.

• Equifax surveilled 1,000 remote workers, fired 24 found juggling two jobs
• Business Insider 2 jobs story
• Ken Thompson lines of code

Josh and Kurt talk about ineffective security from the past we still use today. There has been a great deal of progress in the last few decades bringing us amazing products like the Flipper Zero, cameras that can peer inside locks, and even software defined radio. A great deal of security relies on people not having easy access to these cheap devices. What does this mean for the future of security?

• Cloning a Rare ISA Card to Use a Rare CD Drive
• Vintage Tech YouTubers Discussion Panel | VCFMW 17 (2022)
• Flipper Zero
• Lock camera
• HackRF One
• The history of Hash
• Reddit post-it notes in apartment

Josh and Kurt talk about a newly rediscovered old python vulnerability. It raises a lot of questions about what was OK in 2007 vs what's OK in 2022. The issue is very complicated and has a wild story surrounding it. There is no reason to not fix this in 2022.

• CVE-2007-4559
• Red Hat Bug
• Register story
• Response from upstream
• Upstream patch
• ZippSlip
• Current upstream bug
• CSURF

Josh and Kurt talk about a few stories around the TLS CA certificate world. It's all pretty dire sounding. There's not a lot of organization or process in the space, and the root CAs are literally the foundation of modern society, everything needs them to function. There's not a lot of positive ideas here, it's mostly a show where Kurt explains to Josh what's going on, because Josh doesn't want to care (and will continue to ignore all of this going forward).

• Firefox's Mozilla follows Google in losing trust in Entrust's TLS certificates
• DigiCert Revocation Incident (CNAME-Based Domain Validation)
• List of Trust Lists

Josh and Kurt talk about a blog post that explains there isn't really an open source software supply chain. The whole idea of open source being one thing is incorrect, open source is really a lot of little things put together. A lot of companies and organizations get this wrong.

• Iliana's Twitter
• There is no “software supply chain”
• Google supply chain blog
• GitHub ansi_term advisory
• PyPI 2FA Dashboard
• tarfile issue rediscovered in 2022

Josh and Kurt talk about programming language ecosystems tracking and publishing security advisory details. We are at a point in the language ecosystems where they are giving us services that have historically been reserved for operating systems.

• Kelsey Hightower tweet
• OSS-Fuzz

Josh and Kurt talk about the Time Till Open Source Alternative blog post. The numbers probably don't mean what we think they mean anymore. A lot of modern open source is really corporate controlled. Just because something carries an open source license doesn't mean you can contribute to it.

• Time Till Open Source Alternative
• GitHub Desktop issue 78
• The Reddit Safe

Josh and Kurt talk with Josh Aas from the Internet Security Research Group about Let's Encrypt, Prossimo, and Divvi Up. A lot has changed since the last time we spoke with Josh. Let's Encrypt won, and the ISG are working on some really cool new projects.

• Josh Aas
• Internet Security Research Group (ISRG)
• Let's Encrypt
• Episode 87 – Chat with Let’s Encrypt co-founder Josh Aas
• New Major Funding from the Ford Foundation
• ISRG annual reports
• Peter Eckersley

Josh and Kurt talk about really weird networking bugs. Josh tells a story about his home network problems that made no sense. There was also a qt5 bug that affected wireless networks that made virtually no sense. What should count as a security vulnerability?

• Resolving an unusual wifi issue
• Hacker News thread
• Global Security Database
• IdeaPad 5 14ARE05

Josh and Kurt talk about the recent National Defense Authorization Act that requires security vulnerabilities to be fixed. What does this mean for us, is it as bad as some people are claiming it is? It's actually not a huge deal, for most of us it's really just time to deal with product security.

• The Hacker Mind
• The Untold Stories of Open Source
• H.R.7900 - National Defense Authorization Act for Fiscal Year 2023
• Kurt's blog post

Josh and Kurt talk to Dustin Childs about the recent ZDI Black Hat talk where they discovered the current trend of security patches not actually fixing the security problem. We talk about what this problem means. Why is it happening, and what ZDI is doing to try nudge the industry in the right direction.

• Dustin Childs
• ZDI
• Sloppy Software Patches Are a ‘Disturbing Trend’
• Zero Day Initiative launches new bug disclosure timelines
• ISO 28147

Josh and Kurt talk about our lack of security and some of the data bias problems that can emerge. A lot of what we think is security data is really just biased data. This is OK as long as we understand the data is broken and know this is the first step in a longer journey.

• Tweet about data
• The 6 most common types of bias when working with data
• Syft and Grype stars graph
• John Snow, Cholera, the Broad Street Pump
• Bob Lord tweet

Josh and Kurt talk about a tweet from @kmcquade3 asking the question "What's a concept in security that is generally accepted as true but is actually bull%$#*?" How many of the replies make sense? Most of them do. We go over some of the best replies as fast as we can.

• The tweet that started it all
• Mark Loveless
• Mark Manning
• Richard (Dick) Brooks
• @ImbecillicusRex
• What Train Have We Got?
• Dan
• Alejo 🏳️‍🌈
• postmodern
• 🇺🇸 Robert C. Seacord 🇺🇦
• Yip Wai Peng
• Sachin Shahi

Josh and Kurt talk about leap seconds. Every time there's a leap second, things break. Facebook wants to get rid of them because they break computers, but Google found a clever way to keep leap seconds without breaking anything. Corner cases are hard, security is often just one huge corner case. There are lessons we can learn here.

• How and why the leap second affected Cloudflare DNS
• Facebook wants to get rid of leap seconds
• Leap Smear
• Falsehoods programmers believe about time

Josh and Kurt talk about CWE. What is it, and why does it matter. We cover some history, some shortcomings, and some ideas on how CWE could be used to make security a lot better. We frame the future discussion around the OWASP top 10 list. We should be putting more effort into removing removing entire classes of vulnerabilities.

• CWE
• Episode 360 – Memory safety and the NSA
• Inside 22,734 Steam games

Josh and Kurt talk about Microsoft creating a policy of not allowing anyone to charge for open source in their app store. This policy was walked back quickly, but it raises some questions about how fair or unfair open source really is. It's mostly unfair to developers if you look at the big picture.

• Syft
• Grype
• Microsoft bans and unbans open source
• Tidelift survey
• Bruce Perens - What comes after open source

Josh and Kurt talk about PyPI mandating two factor authentication for the top 1% of projects. It feels like a simple idea, but it's not when you start to think about it. What problems does 2FA solve? How common are these attacks? What are the second and third order effects of mandating 2FA? This episode should have something for everyone on all sides of this discussion to violently disagree with.

• PyPI announcement
• NPM expired domains
• Morten Linderud Tweet
• Congratulations: We Now Have Opinions on Your Open Source Contributions

Josh and Kurt talk about their very silly GPG key management from the past. This is sadly a very true story that details how both Kurt and Josh protected their GPG keys. Josh's setup is like something out of a very bad spy novel. It was very over the top for a key that really didn't matter.

• XKCD signed email
• Shire calendar
• Guardian editors destroy Snowden laptop

Josh and Kurt talk about the challenge of dealing with vulnerabilities at a large scale. We tend to treat every vulnerability equally when they are not equal at all. Some are trees we have to pay very close attention to, and some are part of a larger forest that can't be treated as individual vulnerabilities. We often treat risk as a binary measurement instead of a sliding scale.

• gsd.id
• The Register OpenSSL story
• OpenSSL bug

Josh and Kurt talk about what the actual purpose of signing artifacts is. This is one of those spaces where the chain of custody for signing content is a lot more complicated than it sometimes seems to be. Is delivering software over https just as good as using a detached signature? How did we end up here, what do we think the future looks like? This episode will have something for everyone to complain about!

• Twitter thread
• Kurt's security advisory page
• Bug 998

Josh and Kurt talk about the security of employees leaving jobs. Be it a voluntary departure or in the context of the current layoffs we see, what are the security implications of having to remove access for one or more people departing their job?

• Tesla Layoffs
• Coinbase layoffs

Josh and Kurt talk about a funny GitHub reply that notified 400,000 people. It's fun to laugh at this, but it's an easy open to discussing alert fatigue and why it's important to be very mindful of our communications.

• GitHub 400K notifications Hacker News thread
• Reddit user TV Bluetooth

Josh and Kurt talk about containers. There are a lot of opinions around what type of containers is best. Back when it all started there were only huge distro sized containers. Now we have a world with many different container types and sizes. Is one better?

• Programming in the Apocalypse
• Bob Diachenko
• Paranoids Podcast

Josh and Kurt talk about a recent OpenSSF issue that asks the question how many open source maintainers should a project have that's "healthy"? Josh did some research that shows the overwhelming majority of packages have one maintainer. What does that mean?

• OpenSSF TAC Issue 101

Josh and Kurt talk about the whole work from home debate. It seems like there are a lot of very silly excuses why working from home is bad. We've both been working from home for a long time and have a chat about the topic. There's not much security in this one, but it is a fun discussion.

• Boris Johnson blames cheese
• Apple and WFH

Josh and Kurt talk about a presentation Josh recently gave that was supposed to be about how open source works. The talk was the wrong topic for a security crowd, but there's a lot of interesting details in the questions and comments that emerged. It's clear a lot of security people don't really care about the fine details about what open source is, their primary goal is to help keep development secure.

• Grassr00tz
• Pamela Chestek copyright paper
• Josh's presentation

Josh and Kurt talk about a fake 7-Zip security report. It's pretty clear that everyone is running open source all the time. We end on some thoughts around what SBOM is good for, and who should be responsible for them.

• Probably fake 7-Zip

Josh and Kurt talk to Adam Shostack about his new book "Threats: What Every Engineer Should Learn From Star Wars". We discuss some of the lessons and threats in the Star Wars universe, it's an old code I hear. We also discuss if Star Wars is a better than Star Trek for teaching security (it probably is). It's a fun conversation and sounds like an amazing book.

• Adam Shostack
• Adam's Website
• The book

Josh and Kurt talk about the Google Project Zero blog post about 0day vulnerabilities in 2021. There were a lot more than ever before, but why? Part of the challenge is the whole industry is expanding while a lot of our security technologies are not. When the universe around you is expanding but you're staying the same size, you are actually shrinking.

• Google Project Zero blog post
• Apple 0days
• Joint cyber advisory

Josh and Kurt talk about a survey about a TuxCare patch management and vulnerability detection. Sometimes our security bubble makes us forget what it's like in the real world for the people who keep our infrastructure running. Patching isn't always immediate, automation doesn't fix everything, and accepting risk is very important.

• State of Enterprise Vulnerability Detection and Patch Management
• CISA Known Exploited Vulnerabilities Catalog
• Google 0days

Josh and Kurt talk about a lot of security vulnerabilities in this month's Patch Tuesday. There's also a new Git vulnerability. This sparks the age old question of how fast to patch? The answer isn't binary, the right answer is whatever works best for you, not what someone tells you is best.

• Patch Tuesday
• Git security update

Josh and Kurt talk about hackers using emergency data requests to gain access to sensitive data. The argument that somehow backdoors can be protected falls under this problem. We don't yet have the technical or policy protections in place to actually protect this data. We also explain why this zlib issue got a 2018 CVE ID in 2022.

• Hackers using fake emergency data requests
• CVE-2018-25032
• Global Security Database

Josh and Kurt talk about the binary nature of security. Many of our ideas are yes or no, there's not much in the middle. The conversation ends up derailed due to a Twitter thread about pinning dependencies. This gives you an idea how contentious of a topic pinning is. The final takeaway is not to let security turn into your identity, it ends up making a mess.

• Josh's Twitter thread
• How to install week old npm packages

Josh and Kurt talk about the latest NPM backdoored package. It feels like this keeps happening. We talk about why this is and why it's probably OK. Kurt fixes Linus' Law, in open source the superpower isn't bugs are shallow (they're not), the superpower is security bugs in open source can't be ignored.

• node-ipc protestware

Josh and Kurt talk about Microsoft accidentally letting us find out about ads in file explorer. Changing your clocks sucks. And touch on some of the security implications of the Russian invasion and sanctions. There are a lot of security lessons we can all learn. Mostly what not to do.

• Ads in Windows Filemanager
• Russia running out of storage
• Russia threatens to nationalize industry
• Onagawa Nuclear Power Plant
• Cockcroft's Follies
• German government advises citizens to uninstall Kaspersky

Josh and Kurt talk about the Linux Kernel Dirty Pipe security vulnerability. This bug is an amazing combination of amazing complexity, incredible simplicity, and a little bit of luck. The discovery is amazing, the analysis is enlightening. There's almost no way a bug like this could be found outside of open source.

• Dirty Pipe Writeup

Josh and Kurt talk about a story talking about the "graying" of open source. There doesn't seem to be many young people working on open source, but we don't really know why that is. There are many thoughts, but a better question is why should anyone get involved in open source anymore? The world has changed quite a lot since open source was created.

• The graying open source community needs fresh blood
• OSPOs for Good 2024
  • Day 1 Part 1
  • Day 1 Part 2
  • Day 2 Part 1
  • Day 2 Part 2
• FFmpeg bug
• JSON Editor Online
• https://rfc3339.com/

Josh and Kurt talk about the challenges of security at scale. Specifically we focus on why a lot of security starts to fall apart once you have to do something more than a few times. There's a lot of new thinking we need to push security forward.

• Stable Linux Kernel and Machine Learning

Josh and Kurt talk about SBOMs. Not what they are, there's plenty about that. We talk about why everyone keeps claiming they're super important, and why we're starting to see some people question if we really need them. SBOMs are part of a future that's still being invented.

• Questioning SBOMs
• Rezilion Log4j diagram
• David A Wheeler on CII Badges
• Using open source is communism

Josh and Kurt talk about the Coinbase Super Bowl ad. It was a QR code, lots of security people were aghast at how many people scanned the QR code. The reality is scanning QR codes isn't dangerous. What other security advice just won't go away?

• Coinbase Ad
• Kurt's Twitter question
• QR code parking scam
• Mossad or not Mossad
• Kurt's talk