This week on #OpenSourceSecurity I chat with @patrickmgarrity.bsky.social from @vulncheck.bsky.social about a report they wrote that looked at the number of actually exploited vulnerabilities The increase of CVEs is out of control, but the number of things that get exploited is flat

VulnCheck's State of Exploitation Report with Patrick Garrity

Josh chats with Patrick Garrity about the VulnCheck State of Exploitation 1H-2026 report. Patrick explains the current trends we are seeing around vulnerabilities right now. While the number of CVEs i...

opensourcesecurity.io

I'm not an unbiased observer here, but the idea of paying a subscription for an SSH client seems uniquely absurd

EveryDev AI@everydevai.bsky.social · last wk.

Managing servers from your phone shouldn't feel like a compromise. VVTerm is a native SSH client for iOS and Mac with GPU-accelerated rendering, SFTP browsing, tmux support, and iCloud sync across devices. Full specs in the next post. #DevTools

I had a chat with @joshcorman.bsky.social about securing critical infrastructure on #OSSPodcast Josh is one of the best in the industry on this topic. He has a ton of interesting (and sometimes scary) things to say about this opensourcesecurity.io/2026/2026-07...

Securing critical infrastructure with Josh Corman

Open Source Security welcomes Josh Corman to talk about the challenges around securing our critical infrastructure. Specifically the discussion centers around our water supplies. There are a lot of re...

opensourcesecurity.io

I chatted with Josh Marpet about a report his group, Value Chain Risk Institute, published showing the data behind open source dependencies It's not great, but having data that shows the problem is a big deal. There are a lot of opinions about open source and not a lot of data

Abandoned open source with Josh Marpet

Josh welcomes Josh Marpet for a discussion about abandoned open source packages. Josh Marpet has a foundation called Value Chain Risk Institute that has a report discussion how to start measuring if a...

opensourcesecurity.io

I got to chat with @mairin.bsky.social about Red Hat's Project Lightwell on #OpenSourceSecurity It's going to be interesting to figure out how everyone will start interacting with open source projects. This is something Red Hat is pretty good at already opensourcesecurity.io/2026/2026-07...

Red Hat's Project Lightwell with Mo Duffy

Josh welcomes Mo Duffy from Red Hat to chat about project Lightwell. The idea is to leverage the resources and understanding Red Hat has built up over the years to help deal with the deluge of vulnera...

opensourcesecurity.io

🎙️ Great convo on @josh.bressers.name's Open Source Security podcast with @lorilorusso.bsky.social & @nikomatsakis.com about the new Rust Foundation Maintainers Fund and funding the unglamorous, essential work of OSS maintenance. Check it out: youtube.com/watch?v=Z0s9... #rustlang #opensource

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve #OpenSourceSecurity #rust #RustFoundation

Rust Foundation Maintainers Fund with Lori and Niko

Josh chats with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund. This is a new project the Rust Foundation has create to help fund Rust maintainers. It’s a great discussion w...

opensourcesecurity.io

This was a fun conversation! We unpacked the “omniBOM.”

Josh Bressers@josh.bressers.name · last mo.

I had the pleasure to chat with @allanfriedman.bsky.social about Bill of Materials things on #OpenSourceSecurity We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe

I had the pleasure to chat with @allanfriedman.bsky.social about Bill of Materials things on #OpenSourceSecurity We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe

AIBOM, CBOM, and HBOM with Allan Friedman

Josh chats with Allan Friedman about all things Bill of Materials. Allan did a ton of work to help turn SBOM into what it is today. He has many thoughts and ideas around the new types of BOMs, a conce...

opensourcesecurity.io

I had a chat with Jordi Boggiano from Packagist about a heap of security features they recently added and adding in the future The security of the public package repositories is a hot topic right now, Packagist is doing some really interesting things to improve their security

Packagist and Composer security with Jordi Boggiano

Josh welcomes Jordi Boggiano the lead maintainer of Composer and Packagist to explain the truckload of security features they’ve recently added. Packagist is the PHP package registry, Composer is the ...

opensourcesecurity.io

I had a chat on #OpenSourceSecurity with Mike Milinkovich and Thabang Mashologu from @eclipse.org about their new managed Open VSX registry The Eclipse Foundation has a plan that seems pretty sensible to keep the Open VSX registry around for a long time

Sustaining Open VSX with Mike and Thabang

Josh welcomes Mike Milinkovich and Thabang Mashologu from the Eclipse Foundation to talk about their new managed Open VSX registry. This is the first open source package registry to create a commercia...

opensourcesecurity.io

Happy 40th, Maniacs

I had a chat with @francoisproulx.bsky.social about CI/CD security and a tool he built to red team your own pipelines. Holy cow this is a wild topic right now. I chatted with François a bit over a year ago before CI/CD lit on fire, his warnings were very apt opensourcesecurity.io/2026/2026-06...

Hacking your CI/CD with François Proulx

Josh welcomes back François Proulx to talk about the absolute madness in the CI/CD universe right now. We also learn about François’ new project SmokedMeat which is a tool to help you hack your own CI...

opensourcesecurity.io

I had a chat on #OpenSourceSecurity with Kat Cosgrove about open source being critical infrastructure Kat has a ton of experience in the world of Kubernetes and had some really interesting things to tell us about both successful projects as well as having to shut down projects

Open source is critical infrastructure with Kat Cosgrove

Josh talks to Kat Cosgrove about a how companies should be treating open source more like their critical infrastructure than free stuff. Kat has a ton of knowledge about how the interactions between c...

opensourcesecurity.io

Weekend at Bernie's - Which of your dependencies are wearing sunglasses? nesbitt.io/2026/05/08/w...

Weekend at Bernie’s

Which of your dependencies are wearing sunglasses

nesbitt.io

The the wrap up with David Bernstein around how to test a disaster recovery / emergency response plan I'm pretty excited to get these out, it feels like this topic is more relevant than it's ever been and David does a nice job explaining it all opensourcesecurity.io/2026/2026-05...

How to actually test a disaster plan with David Bernstein

Josh and David finish up the disaster recovery and emergency planning trilogy. In this one David tells us how to test the plan he told us how to build in the last episode. There are some great ideas i...

opensourcesecurity.io

Some incredible in-depth discussion between @vlad.website and @josh.bressers.name on the importance (and challenges) of paying OSS maintainers in this episode of Open Source Security! (PS thanks for the shout-out ☀️) opensourcesecurity.io/2026/2026-04...

Open Source Pledge with Vlad-Stefan Harbuz

Josh has a discussion with Vlad-Stefan Harbuz about the Open Source Pledge as well as his recent FOSDEM talk. The Open Source Pledge is all about trying to build a sustainable universe for open source...

opensourcesecurity.io

I really enjoyed talking to @josh.bressers.name about the @opensourcepledge.com, and about why and how we should support Open Source maintainers 😊

Josh Bressers@josh.bressers.name · 3mo ago

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

Open Source Pledge with Vlad-Stefan Harbuz

Josh has a discussion with Vlad-Stefan Harbuz about the Open Source Pledge as well as his recent FOSDEM talk. The Open Source Pledge is all about trying to build a sustainable universe for open source...

opensourcesecurity.io

I had chat with David Bernstein about creating a disaster recovery plan on #OpenSourceSecurity With all the events unfolding almost every day lately, there's never been a better time to put a plan like this together. In a few weeks David will tell us how to test such a plan once we create it

Building a plan for disaster with David Bernstein

Josh welcomes back David Bernstein to talk about creating a disaster recover plan. It’s a very timely topic given all the current events. There are more supply chain attacks and compromises than ever ...

opensourcesecurity.io

A new #HackerHistory is out! This time we hear the story of Pyr0 Pyr0 tells us about a new upcoming conference all about hacker history, NaClCON Then we hear about a lot of awesome hacker history It's a great story! hackerhistory.com/podcast/the-...

The history of Pyr0 - Hacker History Podcast

Hacker History sits down with Luke McOmie, AKA Pyr0, to talk about a new conference about hacker history, as well as his history. Pyr0 tells us all about NaClCON. It's a conference dedicated to the st...

hackerhistory.com

I had a chat with Paul McCarty about his project @opensourcemalware.bsky.social Paul has a ton of great insight into what's happening with the massive influx of malware into our open source ecosystems opensourcesecurity.io/2026/2026-04...

Open Source Malware with Paul McCarty

Josh talks to Paul McCarty of Open Source Malware about … open source malware. Paul explains why there aren’t many good open source malware datasets. We discuss why the existing data is lacking for ma...

opensourcesecurity.io

I had a chat with @andrewnez.bsky.social about why creating a new package repository is so hard. There are a ton of little details like support from SBOM and vulnerability scanners nobody even thinks about. There are so many little details Andrew does a great job explaining all this and more

Package management challenges with Andrew Nesbitt

Josh welcomes back Andrew Nesbitt to discuss some recent blog posts he wrote about the challenges of new ecosystems as well as challenges of no ecosystems like C. There aren’t very many people who loo...

opensourcesecurity.io

This week I had a chat with Michael Winser about securing open source at scale We recorded prior to the events of the last few weeks, everything Michael talks about with securing our infrastructure is spot on

Open Source Security at scale with Michael Winser

Josh talks to Michael Winser about a talk he gave at FOSDEM as well as his work on Alpha Omega at the Linux Foudnation. Michael is approaching open source security in a way that nobody has ever tried ...

opensourcesecurity.io

@josh.bressers.name put it well: MCP is moving faster than anyone can keep up with. @lukehinds.bsky.social joined #OpenSourceSecurity to dig into why agent security is structurally hard and what kernel-level sandboxing nono.sh actually solves. Episode: opensourcesecurity.io/2026/2026-03...

MCP and Agent security with Luke Hinds

Josh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke’s new tool, nono which is a sandboxing tool that has AI agents in mind as a use case. We ...

opensourcesecurity.io

great chat, with a great chap (Josh, not me).

Josh Bressers@josh.bressers.name · 5mo ago

I had a chat on #OpenSourceSecurity with @lukehinds.bsky.social about his project nono as well as MCP security nono is a sandbox for containing all these tools which is an incredibly difficult problem to solve. The things we see skills and MCP doing are moving forward faster than anyone can keep up

I had a chat on #OpenSourceSecurity with @lukehinds.bsky.social about his project nono as well as MCP security nono is a sandbox for containing all these tools which is an incredibly difficult problem to solve. The things we see skills and MCP doing are moving forward faster than anyone can keep up

MCP and Agent security with Luke Hinds

Josh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke’s new tool, nono which is a sandboxing tool that has AI agents in mind as a use case. We ...

opensourcesecurity.io

This week on #OpenSourceSecurity I had a chat with Paul Kehrer and Alex Gaynor about the statement they published discussing the challenges posed by modern OpenSSL for the python cryptography module

The State of OpenSSL for pyca/cryptography with Alex Gaynor and Paul Kehrer

Josh talks to Paul Kehrer and Alex Gaynor, from the Python Cryptographic Authority. Alex and Paul recently published a statement discuss the challenges posed by modern OpenSSL. We discuss the statemen...

opensourcesecurity.io

I had a chat on #OpenSourceSecurity with @sylvestreledru.bsky.social about his Rust coreutils work Replacing coreutils with Rust is one of those things that I love as a way to improve security but also keep a project fresh in the modern age I learned a ton from this disucssion

Rust coreutils with Sylvestre Ledru

Josh talks to Sylvestre Ledru about the Rust coreutils project. We’ve been using GNU coreutils for decades now, and the goal of Rust coreutils is to rewrite these utilities in Rust. The primary reason...

opensourcesecurity.io

This week on #OpenSourceSecurity I chat with Brad Axen about Goose and the Agentic AI Foundation I'm often skeptical about AI claims, but I do approve the foundation model and seeing Goose donated to it

Goose and the Agentic AI Foundation with Brad Axen

Josh chats with Brad Axen from Block about his creation Goose as well as the Agentic AI Foundation (AAIF). I am quite skeptical of many AI claims, but Brad has a very pragmatic view about where things...

opensourcesecurity.io