Open Source Security

Josh  and  Kurt  talk about how to be a smart security buyer. We have guest  Steve Mayzak  walk us through how a the buying process works as well as giving out a ton of great advice. Even if you're experienced with how to buy security technology you should give this a listen.

Josh  and  Kurt  talk about a number of consumer security issues. The FBI told everyone to reboot their routers which they won't do. The .app top level domain is a cesspool of malware. Everyone has a cell phone and won't update them properly. None of this probably matters though. Unless there are real measurable tragedies caused by this tech, people tend not to really care.

Josh  and  Kurt  talk about the NTSB report from the fatal Uber crash and what happened with Amazon's Alexa recording then emailing a private conversation. IT decisions now have real world consequences like never before.

Josh  and  Kurt  talk about the security of automation as well as automating security. The only way automation will really work long term is full automation. Humans can't be trusted enough to rely on them to do things right.

Josh  and  Kurt  talk about backdoors in code and products that have been put there on purpose. We talk about unlocking phones. Encryption backdoors with a focus on why they won't work.

Josh  and  Kurt  talk about Twitter doing the right thing when they logged a lot of passwords and the npm malicious getcookies package and how backdoors work in code.

Josh  and  Kurt  talk about the Amazon Route 53 incident and what it really means for the modern infrastructure. Complaining nobody is using DNSSEC or securing BGP aren't the right conversations to be having. Reality must be considered in any honest conversation about these topics.

Josh  and  Kurt  talk about security flaws in beep and patch. How on earth were there security flaws in beep and patch?

Josh  and  Kurt  talk to Rami Saas, the CEO of WhiteSource about 3rd party open source security as well as open source licensing.

Josh and Kurt talk to a 7 year old about security. We cover Minecraft security, passwords, hacking, and many many other nuggets of wisdom.

Josh  and  Kurt  talk about all the current misinformation, how humans react to it, and what it means for security.

Josh  and  Kurt  talk about the recent AMD flaws and the events surrounding the disclosure.

Josh  and  Kurt  talk about container security with IBM's Chris Rosen.

Josh  and  Kurt  talk about Let's Encrypt with co-founder Josh Aas. We discuss the past, present, and future of the project.

Josh  and  Kurt  talk about the Trustico certificate incident and Let's Encrypt.  

Josh  and  Kurt  talk about the npm 5.7.0 debacle.

Josh  and  Kurt  talk about the new password data dump from Have I been pwned?

Josh  and  Kurt  talk about the XKCD CVE comic and a flight simulator stealing credentials.

Josh  and  Kurt  talk about problems of textbook RSA implementations, the upcoming TLS changes in TLS, and the insecurity of http in Chrome.

Josh  and  Kurt  talk about AutoSploit, bug bounties and fixing flaws, market forces in security, future expectations, and how humans perceive threats.

Josh  and  Kurt  talk about GPS metadata giving away military bases and GPS jamming as part of testing.

Josh  and  Kurt  talk about Skyfall, fake reports, risk, logging, and how a civilized society functions.

Josh  and  Kurt  talk about the accidental missile warning in Hawaii. We also discuss general preparedness and risk.

Josh  and  Kurt  talk about the recent npm happenings. What it means for the supply chain, and we end with some thoughts on how maybe none of this matters.

Josh  and  Kurt  talk about the aftermath of Meltdown. The details of the flaw are probably less interesting than what happens now.