Shows
What's in the SOSS? An OpenSSF PodcastInvisible Infrastructure, Autonomous Agents, and 10 Years of Cloud Native with CNCF's Chris AniszczykIn this episode of What's in the SOSS, host CRob sits down with Chris Aniszczyk, CTO of the Cloud Native Computing Foundation (CNCF), to celebrate a decade of scaling invisible infrastructure. Reflecting on his journey from a Slackware Linux user to leading global open source foundations, Chris dives deep into the evolution of Kubernetes, why it has become the default operating system for AI infrastructure, and how cultural friction has overtaken technical debt as a primary blocker for modern teams. The pair also explore the rise of autonomous agents, the critical need for robust observability via OpenTelemetry, and how...
2026-10-2047 min
What's in the SOSS? An OpenSSF PodcastBig Thoughts, Open Sources: From Upstream to Downstream: Managing Open Source Risk in a Changing Regulatory Era with Vincent DanenIn this episode of What's in the SOSS’s “Big Thoughts, Open Sources,” host CRob sits down with Vincent Danen, Vice President of Product Security at Red Hat, for a deep dive into the evolving landscape of open source vulnerability disclosure. Drawing on over two decades of open source security experience, Vincent reflects on the history and critical role of the CVE program while addressing modern challenges like the rise of alternative advisory systems and the flood of AI-assisted vulnerability disclosures. The conversation explores the shifting dynamics between upstream maintainers and downstream consumers, the practical utility – and missing user experien...
2026-10-0652 min
What's in the SOSS? An OpenSSF PodcastBuilding the Agentic Future with Angie JonesIn this episode of What’s in the SOSS?, host Sally Cooper interviews Angie Jones, VP of Developer Experience at the Agentic AI Foundation (AAIF). Angie shares her career journey from software engineering and holding 27 patents at IBM to leading open source protocol and developer relations initiatives. She details the mission of the Agentic AI Foundation as a neutral home for governing open source standards and technologies such as the Model Context Protocol (MCP), Goose, Agents.md, and Google's Agent-to-Agent (A2A) protocol. The conversation explores how cross-industry collaboration addresses the reliability and security of AI agents in production, ke...
2026-09-2919 min
What's in the SOSS? An OpenSSF PodcastSecuring the Source: Navigating AI Velocity, CRA Compliance, and Dependency Debt with Abby KearnsIn this episode of What’s in the SOSS, host Sally Cooper sits down with technology executive and ActiveState CEO Abby Kearns to break down the rapidly evolving open source security landscape. Together, they dissect why reactive post-build scanning fails to prevent dependency debt, how machine-speed AI ingestion is overwhelming human maintainers, and what the impending EU Cyber Resilience Act (CRA) mandates mean for enterprise software supply chains. Abby offers actionable insights into why building a "start secure, stay secure" paradigm is essential for modern software pipelines and why open source communities must unite to redefine repository economics in an...
2026-09-2219 min
What's in the SOSS? An OpenSSF PodcastBalancing AI's Double-Edged Sword: Software Engineering, Unlearning, and Ecosystem Sustainability with Mark RussinovichIn this episode of What's in the SOSS?, host CRob sits down with Mark Russinovich – CTO and Deputy CISO of Azure, as well as Board Chair for the Open Source Security Foundation (OpenSSF) – for a wide-ranging conversation on the changing landscape of software security. Mark shares insights from his journey from Sysinternals to Azure leadership, exploring how generative AI is delivering dramatic productivity boosts while creating new talent pipeline challenges for early-in-career engineers. The discussion dives into the shift toward hardware-backed "what, not who" supply chain identity, the urgent rolling Y2K effort to fix AI-discovered vulnerabilities via initiatives like...
2026-09-0856 min
What's in the SOSS? An OpenSSF PodcastNavigating the New Era: The EU Cyber Resilience Act Explained with Madalin NeagIn this episode of What’s in the SOSS, host Sally Cooper is joined by Madalin Neag, EU Policy Advisor at the OpenSSF, to demystify the European Union’s Cyber Resilience Act (CRA). As the tech industry shifts from treating open source as a free buffet to navigating a new era of regulatory liability, Madalin explains how the CRA establishes a horizontal cybersecurity baseline for digital products. The conversation explores the innovative concept of "open source software stewards," the importance of moving beyond passive consumption to active upstream contribution, and why compliance should be viewed as an outcome of good...
2026-09-0136 min
What's in the SOSS? An OpenSSF PodcastPrivate Forks, CRA Deadlines, and the True Cost of Open Source Compliance with Dave RussoIn this episode of What's in the SOSS, host Sally Cooper sits down with returning champion Dave Russo, Policy and Standards Lead at Red Hat’s Open Source and AI Program Office, to unpack the European Union’s Cyber Resilience Act (CRA). Together, they explore the stark realities of the 2026 CRA Awareness and Readiness Report, exposing why three-quarters of North American tech companies remain completely unaware of the strictest cybersecurity mandate in history. Dave breaks down the hidden $250,000-per-release financial toll of maintaining private forks, the crucial legal distinction between software manufacturers and open source stewards, and Red Hat's fram...
2026-08-2518 min
What's in the SOSS? An OpenSSF PodcastWatering the Community Garden: Navigating the EU CRA for Open Source with Roman ZhukovThe clock is ticking toward the European Union’s Cyber Resilience Act (CRA) deadlines, yet a staggering 66% of organizations remain completely unaware of what is coming. In this episode of What’s in the SOSS? host Sally sits down with Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, to demystify this sweeping regulation. Using a brilliant "community garden" analogy, Roman breaks down the distinct roles of maintainers, stewards, and manufacturers under the law, illustrating why the traditional "consume and forget" model of open source is officially dead. They dive deep...
2026-08-1847 min
What's in the SOSS? An OpenSSF PodcastCRA Readiness: Practical Strategies for Open Source Communities with Megan KnightIn this episode of What's in the SOSS, host Sally sits down with Megan Knight, Director of Software Communities at ARM, OpenSSF Board Member, and Chair of the Awareness SIG within the Global Cyber Policy Working Group. Together, they break down the upcoming European Union Cyber Resilience Act (CRA) and address the persistent gap in ecosystem awareness. Megan outlines concrete, practical strategies for maintainers and organizations, highlights the vital role of community collaboration across working groups like ORBIT and ORC, and shares key resources to help lower the barrier to compliance. Stick around for a fun rapid-fire round where...
2026-08-1116 min
What's in the SOSS? An OpenSSF PodcastFunding the Future: Community Collaboration and the Spirit of Open Source with Mila ZhouJoin host Yesenia as she sits down with Mila Zhou, Open Source Program Manager at AWS, to explore the fascinating intersection of finance, strategy, and security in the open source ecosystem. Mila shares her unique journey from forensic auditing to spearheading AWS funding initiatives, breaking down how strategic financial backing transforms vulnerable "long tail" projects and empowers dedicated security champions. Discover how full-time security engineers at foundations are securing critical repositories like PyPI, why community-driven forks like Valkey represent the true spirit of collaboration, and how the OpenSSF Ambassador Program is helping close the gap between developers and security...
2026-08-0438 min
What's in the SOSS? An OpenSSF PodcastTurning AI into the Ultimate Open Source Maintainer Power Tool with Michael WinserIn this episode of What’s in the SOSS?, host CRob welcomes back open source security champion Michael Winser to reflect on Alpha-Omega’s spectacular milestone of surpassing $20 million in security grants. Michael breaks down how their mission has evolved from simply chasing bugs to acting as a catalyst for sustainable, long-term security culture across critical projects. The two dive deep into the unsustainable economics of package repositories—the "app stores" of software development —and address how a massive partnership with frontier AI model providers is aiming to flip the script on AI. Instead of fueling endless, low-context vulnerability "slop," A...
2026-07-2833 min
What's in the SOSS? An OpenSSF PodcastSigning the Future: Securing AI and ML Artifacts with Mihai MaruseacIn this episode of What’s in the SOSS?, host Yesenia Yser sits down with Mihai Maruseac, the lead of the OpenSSF AI/ML Working Group and Security and Privacy expert at OpenAI, to dive deep into the unique security challenges facing artificial intelligence. Unlike traditional software packages, AI models cannot simply be inspected for malware by looking at their weights – malicious code only exposes itself upon execution. Mihai outlines how the community is answering this threat through the evolution of the OpenSSF Model Signing (OMS) specification. Discover how OMS creates an unshakeable chain of custody for models, data sets...
2026-07-1421 min
What's in the SOSS? An OpenSSF PodcastThe Heartbeat of the Kernel: Why Upstream is the Ultimate Security Strategy with Greg Kroah-HartmanWhat does it feel like to wake up and realize your weekend passion project is now the critical infrastructure powering the planet? In this episode of What’s in the SOSS?, CRob sits down with Linux kernel maintainer and open source icon Greg Kroah-Hartman. Greg takes us on a journey from his early days writing firmware for printer and hospital ATMs to managing the relentless, everyday engineering task of maintaining the Linux kernel over decades. He breaks down the realities of modern kernel security, dismantles the myth that maintainers know every single vulnerability exploit , and details how looming global re...
2026-06-3034 minWhat's in the SOSS? An OpenSSF PodcastConsuming with Intent: Driving Enterprise Security and Career Growth Through Open Source with Jamie Thomas (IBM)In this episode of Big Thoughts, Open Sources, host CRob sits down with Jamie Thomas, IBM Enterprise Security Executive and OpenSSF Governing Board Member (former Chair!), to tackle the vital shifting dynamics of enterprise open source engagement. From IBM's historical "billion-dollar bet" on Linux to modern supply chain wake-up calls like SolarWinds and Log4j, Jamie pulls back the curtain on what it truly means to move from accidental consumption to intentional stewardship. Tune in to discover how active participation in neutral foundations like the OpenSSF acts as a fast track for engineering career trajectories, why soft skills like "...
2026-06-1629 minWhat's in the SOSS? An OpenSSF PodcastThe Ghost in the Dependency Tree: Navigating Open Source End-of-Life with HeroDevsIn this episode of What’s in the SOSS, host CRob sits down with Isaac Wuest, Product Line Leader at HeroDevs, to explore the critical and often overlooked "gray area" of the software supply chain: End-of-Life (EOL) software. While the industry heavily relies on CVEs to track vulnerabilities, Isaac explains how maintainer abandonment creates a vacuum where risks are present but remain undiscovered and unreported. From the origins of HeroDevs supporting AngularJS to the nuances of the EU Cyber Resilience Act (CRA), this conversation provides a practical framework for distinguishing between inherent hazards and actual risk in your dependency tr...
2026-06-0226 minWhat's in the SOSS? An OpenSSF PodcastBeginner to Builder: Shaping the Conversation in Open Source SecurityIn this episode of What's in the SOSS, Yesenia Yser interviews cybersecurity analyst Ejiro Oghenekome about her journey from UI/UX design to becoming a key contributor to the OpenSSF. Ejiro shares the inspiration behind her public "100 Days of Cybersecurity" challenge, which has helped her maintain discipline and consistency while making the field less intimidating for beginners. She discusses how connecting with the OpenSSF community led her to the BEAR Working Group, where her authorship of the "Beginner to Builder" blog series has allowed her to move from consuming content to actively shaping the open source security conversation. Ejiro...
2026-05-1925 minWhat's in the SOSS? An OpenSSF PodcastPackaging, Transferring, and Deploying Software in Air-Gapped Environments with ZarfHost Sally Cooper is joined by Brandt Keller, a staff software engineer at Defense Unicorns and maintainer of the OpenSSF sandbox project, Zarf. Brandt discusses Zarf's origins as a tool designed to reliably package, transfer, and deploy software components (like container images and Helm charts) specifically for critical, air-gapped environments that lack internet connectivity. The conversation explores Zarf's evolution, highlighting its current role in introducing security gates, improving transparency, and consolidating various management and S-bomb tools into a single, declarative workflow. Finally, Brandt explains how Zarf's declarative manifest model is helping to secure open source software by reducing the...
2026-05-0519 min
The Verdict — Vladimir MikhalevDocker supply chain hardening — from Scout D to OpenSSF 7.8 on a 730K-pull imageHow I hardened a 1M-pull public Docker image from Scout grade D to OpenSSF Scorecard 7.8 — multi-stage build, cosign, SLSA provenance, non-root default. Narrated by an AI clone of the author's voice.
2026-04-2215 minWhat's in the SOSS? An OpenSSF PodcastBuilding a Connected Africa: The Origin Story of OSSAfrica with Prince AsieduThis episode features Prince Oforh Asiedu, discussing his inspiring journey into tech and open source, starting from a childhood fascination with computers in Ghana, self-learning to code despite financial and economic challenges, and making his first contributions through documentation. Prince shares the origin story of Open Source & Security Africa (OSSAfrica), revealing how the frustration of repeatedly being denied access to global conferences due to visa issues sparked the idea to build a local, Africa-rooted community to connect and empower African contributors globally. He outlines the vision for OSSAfrica to become a serious contributor to software supply chain security, aiming...
2026-04-2126 minWhat's in the SOSS? An OpenSSF PodcastBig Thoughts, Open Sources Inaugural Episode: Beyond the Hype: Brian Fox on Securing the Agentic Future of Open SourceIn this inaugural episode of Big Thoughts and Open Sources, host Crob sits down with Brian Fox, Co-founder and CTO of Sonatype, to dissect the friction between rapid AI adoption and foundational software security. Brian shares insights from the 11th annual State of the Software Supply Chain Report, revealing the emergence of "slop squatting" and the high frequency of AI models recommending non-existent or vulnerable dependencies. The conversation explores how the Model Context Protocol (MCP) could revolutionize developer compliance and why the industry must fund the critical infrastructure supporting our trillion-dollar open source ecosystem.Chapters:
2026-04-0729 minWhat's in the SOSS? An OpenSSF PodcastFrom Noise to Signal: Security Expertise and Kusari Inspector with Mike LiebermanIn this episode, CRob talks with Mike Lieberman from Kusari about the current state of open source security. They discuss the growing burden on maintainers from the "deluge" of noisy, low-quality vulnerability reports, often generated by AI tools, and the vital role of "a human in the loop." Mike introduces Kusari's tool, Inspector, explaining how it uses codified security expertise to process data from tools like OpenSSF Scorecard and SLSA, effectively filtering out false positives and giving maintainers only high-quality, actionable reports. They also dive into the design philosophy of "don't piss off the engineers" and share...
2026-03-2425 minWhat's in the SOSS? An OpenSSF PodcastEmpowering New Maintainers: Inside the OpenSSF Mentorship ProgramIn this episode of What’s in the SOSS? host Sally Cooper sits down with Yesenia Yser, co-lead of the OpenSSF Mentorship Program and the BEAR Working Group, and Kairo De Araujo, Open Source Software Engineer and mentor for rstuf. They dive into the success of the OpenSSF Mentorship Program, which focuses on bringing underrepresented voices into software security. Kairo shares an incredible outcome from the last cycle – where two out of three mentees became project maintainers – while Yesenia discusses the evolution of the BEAR Working Group (Belonging, Empowerment, Allyship, and Representation) mentorship program. Whether you are a potential mentor...
2026-03-1722 minWhat's in the SOSS? An OpenSSF PodcastThe Gemara Project: GRC Engineering Model for Automated Risk AssessmentHannah Braswell and Jenn Power, security engineers from Red Hat and contributors to the OpenSSF, join host Sally Cooper to discuss the Gemara project. Gemara, an acronym for GRC Engineering Model for Automated Risk Assessment, is a seven-layer logical model that aims to solve the problem of incompatibility in the GRC (Governance, Risk, and Compliance) stack. By outlining a separation of concerns, the project seeks to enable engineers to build secure and compliant systems without needing to be compliance experts. The speakers explain how Gemara grew organically to seven layers and connects with other open source initiatives like the...
2026-03-1017 min
CHAOSScastEpisode 128: Guest Episode - GR-OSS OUT Podcast: Building Welcoming Communities with Stacey PotterThank you to the folks at Sustain for providing the hosting account for CHAOSSCast!
CHAOSScast- Episode 128
Check out the original GR-OSS OUT episode on the GR-OSS OUT podcast:
https://podcast.gr-oss.io/15-openssf-community
In this episode of CHAOSScast, we have a special crossover episode with the GR-OSS OUT podcast, hosted by Tabatha DiDomenico from G-Research and featuring special guest Stacey Potter, Community Manager at the Open Source Security Foundation (OpenSSF).
Stacey shares her journey into open source, which started in software license compliance and marketing before she found her passion in...
2026-02-1922 minWhat's in the SOSS? An OpenSSF PodcastAIxCC Part 4 – Cyber Reasoning Systems: The Real-World Journey After AIxCCIn this final episode of our AI Cyber Challenge (AIxCC) series, CRob and Jeff Diecks wrap-up the journey from DARPA's groundbreaking two-year competition to the exciting collaborative phase happening now. Discover how winning teams are taking their AI-powered vulnerability detection systems into the real world, finding actual bugs in projects like the Linux kernel and CUPS. Learn about the innovative OSS-CRS project that aims to create a standard infrastructure for mixing and matching the best components from different systems, and hear valuable lessons about how to responsibly introduce AI-generated security findings to open source maintainers. The competition may be...
2026-02-1017 minWhat's in the SOSS? An OpenSSF PodcastAIxCC Part 3 - Buttercup's Hybrid Approach: Trail of Bits' Journey to Second Place in AIxCCIn the final episode of our AI Cyber Challenge (AIxCC) series, CRob sits down with Michael Brown, Principal Security Engineer at Trail of Bits, to discuss their runner-up cybersecurity reasoning system, Buttercup. Michael shares how their team took a hybrid approach - combining large language models with conventional software analysis tools like fuzzers - to create a system that exceeded even their own expectations. Learn how Trail of Bits made Buttercup fully open source and accessible to run on a laptop, their commitment to ongoing maintenance with prize winnings, and why they believe AI works best when applied to...
2026-02-1023 minWhat's in the SOSS? An OpenSSF PodcastAIxCC Part 2 - From Skeptics to Believers: How Team Atlanta Won AIxCC by Combining Traditional Security with LLMsIn this 2nd episode in our series on DARPA's AI Cyber Challenge (AIxCC), CRob sits down with Professor Taesoo Kim from Georgia Tech to discuss Team Atlanta's journey to victory. Kim shares how his team - comprised of academics, world-class hackers, and Samsung engineers - initially skeptical of AI tools, underwent a complete mindset shift during the competition. He shares how they successfully augmented traditional security techniques like fuzzing and symbolic execution with LLM capabilities to find vulnerabilities in large-scale open source projects. Kim also reveals exciting post-competition developments, including commercialization efforts in smart contract auditing and plans to...
2026-02-1028 minWhat's in the SOSS? An OpenSSF PodcastAIxCC Part 1 - From Skepticism to Success: The AI Cyber Challenge (AIxCC) with Andrew CarneyThis episode of What’s in the SOSS features Andrew Carney from DARPA and ARPA-H, discussing the groundbreaking AI Cyber Challenge (AIxCC). The competition was designed to create autonomous systems capable of finding and patching vulnerabilities in open source software, a crucial effort given the pervasive nature of open source in the tech ecosystem. Carney shares insights into the two-year journey, highlighting the initial skepticism from experts that ultimately turned into belief, and reveals the surprising efficiency of the competing teams, who collectively found over 80% of inserted vulnerabilities and patched nearly 70%, with remarkably low compute costs. The discussion concludes wi...
2026-02-1023 minWhat's in the SOSS? An OpenSSF PodcastDemystifying the CFP Process with KubeCon North America Keynote SpeakersEver wondered what it takes to get your talk accepted at a major open source tech conference – or even land a keynote slot? Join What’s in the Sauce new co-host Sally Cooper, as she sits down with Stacey Potter and Adolfo “Puerco” García Veytia, fresh off their viral KubeCon keynote "Supply Chain Reaction." In this episode, they pull back the curtain on the CFP review process, share what makes a strong proposal stand out, and offer honest advice about overcoming imposter syndrome. Whether you're a first-time speaker or a seasoned presenter, you'll learn practical tips for crafting compellin...
2026-02-0333 minWhat's in the SOSS? An OpenSSF PodcastWhy Marketing Matters in Open Source: Introducing Co-Host Sally CooperIn this special episode, the What's in the SOSS podcast welcomes Sally Cooper as an official co-host. Sally, who leads OpenSSF's marketing efforts, shares her journey from hands-on technical roles in training and documentation to becoming a bridge between complex technology and everyday understanding. The conversation explores why marketing matters in open source, how personal branding connects to community building, and the importance of personas in serving diverse stakeholders. Sally also reveals OpenSSF's 2026 marketing themes and explains how newcomers can get involved in the community, whether through Slack, working groups, or contributing content....
2026-01-2719 minWhat's in the SOSS? An OpenSSF Podcast2025 Year End Wrap Up: Celebrating 5 Years of Open Source Security Impact!Join co-hosts CRob and Yesenia for a special season finale celebrating OpenSSF's fifth anniversary and recapping an incredible year of innovation in open source security! From launching three free educational courses on the EU Cyber Resilience Act, AI/ML security, and security for software development managers, to the groundbreaking DARPA AI Cyber Challenge where competitors achieved over 90% accuracy in autonomous vulnerability discovery, 2025 has been transformative. We reflect on standout interviews with new OpenSSF leaders Steve Fernandez and Stacey, deep dives into game-changing projects like the Open Source Project Security Baseline and AI model signing, and the vibrant community conversations...
2025-12-3027 minWhat's in the SOSS? An OpenSSF PodcastTeaching the Next Generation: Software Supply Chain Security in Academia with Justin CapposOn this episode of "What's in the SoSS," Yesenia Yser sits down with Justin Cappos, NYU professor and self-described "OG software supply chain guy" who's been working in this space since 2002. Justin reveals why most universities fail to teach fundamental security practices—from MFA to code signing—and how his groundbreaking software supply chain security course is creating some of the top 500 most qualified professionals in the world. We discuss the challenges of keeping curriculum current in a rapidly evolving field, the "throw them in the deep end" approach to teaching open source collaboration, and Justin's vision for transforming secu...
2025-12-1622 min
The AI Kubernetes ShowOpenSSF CTO on AI, Open Source Security, and the Human ElementIn this AI Kubernetes Show episode, we chat with OpenSSF CTO and Linux Foundation Chief Security Architect Christopher Robinson, or CRob, as everyone calls him. We explore the potential and the inherent risks of integrating AI into the open source security landscape.
2025-12-1026 minWhat's in the SOSS? An OpenSSF PodcastSecuring the Future: AI, Open Source, and Collaboration with Jay White (Microsoft)Jay White, a leader in the open source ecosystem at Microsoft, discusses his journey into open source, focusing on AI and machine learning. He highlights his role in the Azure office of the CTO, working on open source, security, and AI standards. White emphasizes the importance of model signing and transparency in AI development, mentioning ongoing work in the OpenSSF and Coalition for Secure AI (CoSAI). He encourages community involvement, noting the need for standardization in AI supply chain security and the nuanced challenges of cultural representation in AI models. White also shares his passion for community building and...
2025-12-0225 minWhat's in the SOSS? An OpenSSF PodcastSBOM Chaos and Software Sovereignty: The Hidden Challenges Facing Open Source with Stephanie Domas (Canonical)Stephanie Domas, Canonical's Chief Security Officer, returns to What's in the SOSS to discuss critical open source challenges. She addresses the issues of third-party security patch versioning, the rise of software sovereignty, and how custom patches break SBOMs. Domas also explains why geographic code restrictions contradict open source principles and what the EU's Cyber Resilience Act (CRA) means for enterprises. She highlights Canonical's work integrating memory-safe components like sudo-rs into the next Ubuntu LTS. This episode challenges assumptions about supply chain security, software trust, and the future of collaborative development in a regulated world.Chapters:
2025-11-1926 minWhat's in the SOSS? An OpenSSF PodcastA Deep Dive into the Open Source Project Security (OSPS) BaselineIn this episode of "What's in the SOSS," CRob, Ben Cotton, and Eddie Knight discuss the Open Source Project Security Baseline. This baseline provides a common language and control catalog for software security, enabling maintainers to demonstrate their project's security posture and fostering confidence in open source projects. They explore its integration with other OpenSSF projects, real-world applications like the GUAC case study, and its value to maintainers and stakeholders. The role of documentation in security is emphasized, ensuring secure software deployment. The effectiveness of the baseline is validated through real-world applications and refined by community feedback, with future...
2025-11-0432 minWhat's in the SOSS? An OpenSSF PodcastBuilding Trust in Open Source: Seth Larson's Journey from Maintainer to Security LeaderIn this episode of What’s in the SOSS, host Yesenia Yser sits down with Seth Larson, Security Developer in Residence at the Python Software Foundation, as he shares his unique perspective on open source security. From his Minneapolis base, Seth discusses his journey from urllib3 maintainer to leading security initiatives across the Python ecosystem. In this episode, we explore how public documentation shapes security work, the importance of supporting maintainers both technically and emotionally, and the art of building trust in open source communities. Seth also shares insights on engaging with academic communities, the evolution of secure-by-default practices, an...
2025-10-2121 minWhat's in the SOSS? An OpenSSF PodcastNew Education Course: Secure AI/ML-Driven Software Development (LFEL1012) with David A. WheelerIn this episode of “What’s In The SOSS,” Yesenia interviews David A. Wheeler, the Director of Open Source Supply Chain Security at the Linux Foundation. They discuss the importance of secure software development, particularly in the context of AI and machine learning. David shares insights from his extensive experience in the field, emphasizing the need for both education and tools to ensure security. The conversation also touches on common misconceptions about AI, the relevance of digital badges for developers, and the structure of a new course aimed at teaching secure AI practices. David highlights the evolving nature of softwa...
2025-10-1638 minWhat's in the SOSS? An OpenSSF PodcastThe Remediation Revolution: How AI Agents Are Transforming Open Source Security with John Amaral of Root.ioIn this episode of What's in the SOSS, CRob sits down with John Amaral from Root.io to explore the evolving landscape of open source security and vulnerability management. They discuss how AI and LLM technologies are revolutionizing the way we approach security challenges, from the shift away from traditional "scan and triage" methodologies to an emerging "fix first" approach powered by agentic systems. John shares insights on the democratization of coding through AI tools, the unique security challenges of containerized environments versus traditional VMs, and how modern developers can leverage AI as a "pair programmer" and security analyst...
2025-10-0722 minWhat's in the SOSS? An OpenSSF PodcastFrom Manager to Open Source Security Pioneer: Kate Stewart's Journey Through SBOM, Safety, and the Zephyr ProjectIn this episode of What’s in the SOSS, CRob has an inspiring conversation with Kate Stewart, a Linux Foundation veteran who took an unconventional path into open source as a manager rather than a developer, navigating complex legal challenges to get Motorola's contributions upstream. Now a decade into her tenure at the Linux Foundation, Kate leads critical initiatives in safety-critical open source software, including the Zephyr RTOS project and ELISA, while being instrumental in the evolution of SPDX and Software Bill of Materials (SBOM). She breaks down the different types of SBOMs, explains how the Zephyr project became a...
2025-09-2334 minWhat's in the SOSS? An OpenSSF PodcastRacing Against Quantum: The Urgent Migration to Post-Quantum Cryptography with KeyFactor's Crypto ExpertsThe quantum threat is real, and the clock is ticking. With government deadlines set for 2030, organizations have just five years to migrate their cryptographic infrastructure before quantum computers can break current RSA and elliptic curve systems. In this episode of "What's in the SOSS," join host Yesenia Yser as she sits down with David Hook (VP Software Engineering) and Tomas Gustavsson (Chief PKI Officer) from Keyfactor to break down post-quantum cryptography, from ELI5 explanations of quantum-safe algorithms to the critical importance of crypto agility and entropy. Learn why the financial sector and supply chain security are leading t...
2025-09-0930 minWhat's in the SOSS? An OpenSSF PodcastSecuring AI: A Conversation with Sarah Evans on OpenSSF's AI/ML InitiativesIn this episode of "What's in the SOSS," we welcome back Sarah Evans, Distinguished Engineer at Dell Technologies and a key figure in the OpenSSF's AI/ML working group. Sarah discusses the critical work being done to extend secure software development practices to the rapidly evolving field of AI. She dives into the AI Model Signing project, the groundbreaking MLOps white paper developed in partnership with Ericsson, and the crucial work of identifying and addressing new personas in AI/ML operations. Tune in to learn how OpenSSF is shaping the future of AI security and what challenges and opportunities...
2025-08-2614 minWhat's in the SOSS? An OpenSSF PodcastOpen Source Security: OSTIF's 10-Year Journey of Collaborative AuditsIn this episode of "What's in the SOSS," Derek Zimmer and Amir Montezari from the Open Source Technology Improvement Fund (OSTIF) discuss their decade-long mission of providing security resources to open source projects. They focus on collaborative, maintainer-centric security audits that help projects improve their security posture through expert third-party reviews, without creating fear or overwhelming developers.Episode Chapters:00:00 Introduction00:22 Podcast Welcome01:04 OSTIF Founders Introduction02:31 OSTIF's Mission and Approach05:28 Relationship Management and Expertise08:01 Evolution of Security Engagement Methods12:15 Making Security Audits Less Intimidating18:00 Rapid Fire Questions20:45 Closing, Call to ActionEpisode links:
2025-08-1225 minWhat's in the SOSS? An OpenSSF PodcastFrom Compliance to Community: Meeting CRA Requirements TogetherIn this episode of 'What's in the SOSS” CRob dives deep into the Erlang ecosystem with Jonatan Männchen (CISO, Erlang Ecosystem Foundation), Ulf (Product Owner, Herrmann Ultraschall), and Michael Winser (Alpha Omega). This episode explores the critical importance of security in open source, particularly in light of regulations like the CRA. Hear how the Erlang community is proactively addressing security concerns by bringing in experts, fostering collaboration, and building trust. Discover why manufacturers are investing in upstream projects and how other ecosystems can learn from their approach. This conversation highlights the value of community, transparency, and the essential rol...
2025-07-2931 minWhat's in the SOSS? An OpenSSF PodcastBuilding India's Open Source Security Community: From Developer Nation to Security ChampionsJoin CRob as he sits down with Ram Iyengar, OpenSSF's India community representative, to explore the unique challenges and opportunities of promoting open source security in one of the world's largest developer communities. Ram shares his journey from computer science professor to developer evangelist, discusses the launch of LF India, and reveals why getting developers excited about security tools remains one of his biggest challenges. From spicy food preferences to Star Trek vs. Star Wars debates, this episode offers both insights into global open source security efforts and a glimpse into the passionate community builders making it happen.
2025-07-1518 minWhat's in the SOSS? An OpenSSF PodcastFrom Lockpicking to Leadership: Tabatha DiDomenico on Security, Open Source, and Building CommunityIn this episode of What’s in the SOSS? host Yesenia Yser sits down with open source security engineer and community leader Tabatha DiDomenico for an inspiring conversation about her unexpected path into open source, the vibrant communities behind security, and her role as president of BSides Orlando.From discovering Netscape in the early days to shaping security strategy at G-Research and OpenSSF, Tabatha shares how her career evolved from necessity to purpose. She talks about the power of DevRel, the invisible work behind sustainable open source, and the magic of volunteering - pro-tip: working the registration ta...
2025-07-0129 minWhat's in the SOSS? An OpenSSF PodcastBridging DevOps and Security: Tracy Reagan on the Future of Open SourceIn this episode of What's in the SOSS, we sit down with longtime open source leader and DevOps champion Tracy Ragan. From her early days with the Eclipse Foundation to her current work with Ortelius, the Continuous Delivery Foundation, and the OpenSSF, Tracy shares her journey through the ever-evolving world of open source security.We dig into the importance of configuration management, what DevSecOps really means, and how projects like the OpenSSF Scorecard and Ortelius help make our software supply chains more transparent and secure. Plus, we tackle the education gap between security pros and DevOps engineers—an...
2025-06-1720 minWhat's in the SOSS? An OpenSSF PodcastYoda, DEI, and the Jedi Council: A Conversation with Dr. Eden-Reneé HayesIn this enlightening and entertaining episode of What's in the SOSS, host Yesenia Yser sits down with DEI strategist, social psychologist, and Star Wars superfan Dr. Eden-Reneé Hayes. From her academic roots to her entrepreneurial journey, Dr. Hayes shares how diversity, equity, inclusion, and accessibility (DEIA) drive sustainable growth—and how she found inspiration for her TED Talk in the wisdom of Yoda. The two discuss the myths around DEIA, how the Jedi Council reflects ideal collaboration, and why unlearning old beliefs is key to progress. Plus, stay for the rapid-fire questions and discover if Dr. Hayes is more Mar...
2025-06-0319 minWhat's in the SOSS? An OpenSSF PodcastCybersecurity Framework LaunchIn this episode of What's in the SOSS, host CRob interviews Clyde Seepersad from the LF Education Department. They discuss Clyde's journey into open source, the role of LF Education in supporting the community, and the importance of cybersecurity education. They also delve into the development of the Global IT Cyber Skills Framework, emphasizing the need for continuous learning and community engagement in the tech industry.Chapters:00:00 Introduction to Open Source and LF Education02:59 Clyde's Journey into Open Source05:54 The Role of LF Education in Open Source09:00 Cybersecurity and the Global IT Cyber Skills Framework11:59 Framework...
2025-05-2020 minWhat's in the SOSS? An OpenSSF PodcastScaling Security: Inside the GitHub Securing Open Source Software FundIn this episode of What’s in the SOSS?, CRob sits down with Kevin Crosby and Xavier Rene-Corail from GitHub to unpack the GitHub Secure Open Source Fund - an innovative program that combines funding, education, and community to strengthen open source security. Learn how this unique initiative connects maintainers with training, resources, and a $10K stipend to scale security best practices. The trio also shares the origins of the fund, surprising takeaways from the first cohort, and what’s next for this rapidly growing initiative.Chapters:00:00 – Introduction00:58 – Meet the Guests02:26 – Open Source Ori...
2025-05-1326 minWhat's in the SOSS? An OpenSSF PodcastShowing Up Fully: Meet OpenSSF’s new Community Manager, Stacey PotterIn this special episode of What’s in the SoSS?, we welcome Stacey Potter, the new Community Manager at the Open Source Security Foundation (OpenSSF). Stacey shares her winding journey from managing operations at a vitamin company to becoming a powerful advocate and connector in the open source world. We explore her community-first mindset, her work with CNCF and Platform Engineering Day, and her passion for inclusion and authenticity. Whether you're curious about how to get started in open source or want insight into how community shapes security, this episode is for you.Ch...
2025-05-0621 minWhat's in the SOSS? An OpenSSF PodcastSecure Software Starts with Awareness: Education & Open Source with the Council of DavesIn this episode of What’s in the SOSS, host CRob is joined by the “Council of Daves” - Dr. David Wheeler of the OpenSSF and Dave Russo from Red Hat — for a deep dive into the intersection of secure software development and education. From their open source origin stories to the challenges of educating developers and managers alike, this conversation covers key initiatives like the LFD121 course, upcoming resources on the EU Cyber Resilience Act, and how AI is shifting the landscape.Whether you're a developer, manager, or just open source curious, this is your crash course i...
2025-04-2224 minWhat's in the SOSS? An OpenSSF PodcastEnterprise to Open Source: Steve Fernandez’s Journey to the OpenSSFIn this episode of What’s in the SOSS, we sit down with the OpenSSF’s new General Manager, Steve Fernandez — a seasoned enterprise tech leader whose resumé spans giants like L’Oréal, Coca-Cola, AIG, and Ford. Steve shares his “origin story,” what drew him into the world of open source, and how his decades of experience as a consumer of open source software are shaping his vision for the Foundation.00:21 Welcome & Introductions00:57 Steve’s Tech Journey03:13 Why OpenSSF?05:02 The Role of Security & Strategic Vision08:17 Rapid Fire & Final Thoughts
2025-04-1511 minWhat's in the SOSS? An OpenSSF PodcastJavaScript's Big Footprint: Robin Bender Ginn on Leading OpenJS and Open Source at ScaleRobin Bender Ginn, Executive Director of the OpenJS Foundation, joins us to talk about JavaScript’s massive footprint, the challenges of sustaining critical open source projects, and the importance of security in the web ecosystem. She shares her journey, insights on community-led development, and how OpenJS is building a healthier future for the JavaScript ecosystem.Learn more and register for JSConf North America: https://events.linuxfoundation.org/jsconf-north-america/register/Chapters:0:00 JavaScript's Critical Web Presence0:51 Robin Ginn Introduces OpenJS Foundation2:01 Core Challenges Facing JavaScript Ecosystem4:12 Managing Older Pr...
2025-04-0817 minWhat's in the SOSS? An OpenSSF PodcastEmpowering Security: Yesenia Yser on Open Source, AI, and Personal BrandingIn this inspiring episode of "What's in the SOSS?", we welcome our new Co-Host, cybersecurity expert and open source advocate Yesenia Yser. Join hosts CRob and Yesenia as they delve into her compelling journey from discovering open source at Red Hat to pioneering AI security at Microsoft. Learn how Yesenia blends her passion for cybersecurity, Brazilian jiu-jitsu, and empowering communities—especially women—to shape her personal brand and advocacy efforts. Don't miss this lively conversation full of actionable insights for anyone interested in cybersecurity, open source communities, and personal growth.Episode Highlights:00:18 – Introduction to Yeseni...
2025-03-2517 minWhat's in the SOSS? An OpenSSF PodcastOpenSSF 2025 MVVSR OverviewCRob is joined by Arun Gupta, Vice President and General Manager of Developer Programs at Intel and OpenSSF Governing Board Chair, and Zach Steindler, Principal Engineer at Github, a member of the OpenSSF TAC and co-chairs the OpenSSF Security Packages Repository Working Group to discuss the key lessons learned from open source security in 2024, the importance of the MVVSR (Mission, Vision, Values, Strategy, and Roadmap) framework, and the exciting initiatives planned for 2025. They highlight the growing reliance on open source, the challenges of dependency vulnerabilities, and the need for better security practices in the industry.Chapters:03:29...
2025-03-1126 minWhat's in the SOSS? An OpenSSF PodcastKusari’s Michael Lieberman Talks GUAC, SLSA and Securing the Open Source Supply ChainCRob is joined by Michael Lieberman, CTO and co-founder of Kusari, about the importance of supply chain security in the open source ecosystem. They discuss Michael's journey in open source, his contributions to projects like SLSA and GUAC and the future of supply chain security. 01:56 - Michael explains how he got into open source04:10 - The challenges of being a startup within the open source ecosystem05:38 - Michael digs into his participation with SLSA and GUAC09:13 - How maintainers can address SBOMs with GUAC10:56 - Michael’s predictions for supply chain security and dependency management14:26 - M...
2025-01-0721 minWhat's in the SOSS? An OpenSSF PodcastSovereign Tech Agency’s Tara Tarakiyee and Funding Important Open Source ProjectsIn this episode, CRob talks to Tara Tarakiyee, FOSS technologist at the Sovereign Tech Agency, which supports the development, improvement and maintenance of open digital infrastructure. The Sovereign Tech Agency’s goal is to sustainably strengthen the open source ecosystem, focusing on security, resilience, technological diversity and the people behind the code.01:42 - Why the Sovereign Tech Fund became the Sovereign Tech Agency03:59 - The ways the Sovereign Tech Agency supports open source infrastructure initiatives04:42 - The four criteria for Sovereign Tech Agency funding: prevalence, relevance, vulnerability and public interest06:51 - Sovereign Tech Agency success st...
2024-12-1716 minWhat's in the SOSS? An OpenSSF PodcastAlpha-Omega’s Michael Winser and Catalyzing Sustainable Improvements in Open Source SecurityIn this episode, CRob talks to Michael Winser, Technical Strategist for Alpha-Omega, an associated project of the OpenSSF that with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code – and get them fixed – to improve global software supply chain security. 01:00 - Michael shares his origin story into open source 02:09 - How Alpha-Omega came to be03:48 Alpha-Omega’s mission is catalyzing sustainable security improvements05:16 - The four types of investments Alpha-Omega makes to catalyze change11:33 - Michael expands on his “clean the beach” approach to impacting open source security16:41 - The 3F framework helps manage...
2024-12-1027 minWhat's in the SOSS? An OpenSSF PodcastJack Cable of CISA and Zach Steindler of GitHub Dig Into Package Repository SecurityCRob discusses package repository security with two people who know a lot about the topic. Zach Steindler is a principal engineer at Github, a member of the OpenSSF TAC and co-chairs the OpenSSF Security Packages Repository Working Group. Jack Cable is a senior technical advisor at CISA. Earlier this year, Zach and Jack published a helpful guide of best practices called “Principles for Package Repository Security.”00:48 - Jack and Zach share their backgrounds02:59 - What package repositories are and why they’re important to open source users04:17 - The positive impact package security has on downstream users07:06 - Jack a...
2024-11-2623 minWhat's in the SOSS? An OpenSSF PodcastRed Hat's Rodrigo Freire and the Impact of High-Profile Security IncidentsIn this episode, CRob talks to Rodrigo Freire, Red Hat's chief architect. They discuss high-profile incidents and vulnerability management in the open source community. Rodrigo has a distinguished track record of success and experience in several industries, especially high-performance and mission-critical environments in financial services. 01:08 - Rodrigo shares his entry into open source02:42 - Diving into the specifics of a high-profile incident06:22 - How security researchers coordinate a response to a high-profile incident10:33 - The benefits of a vulnerability disclosure program11:57 - Rodgiro answers CRob's rapid-fire questions13:43 - Advice for anyone getting into the industry14:26 - Rodrigo's call t...
2024-11-1216 min
Compilado do Código Fonte TVNovidades do CSS; TikTok investigado no Brasil; IA encontra bug no SQLite; Verificação de segurança com OpenSSF; Rifa do Bing; Bloco de Notas com IA [Compilado #172]Nesse episódio trouxemos as notícias e novidades do mundo da programação que nos chamaram atenção dos dias 02/11 a 08/11.
📌 Black Friday com até 40% de descontoDepois de experimentar Insider, é impossível voltar atrás. #insiderstore Desbloqueie seu desconto com o cupom CODIGO15https://codft.me/insider092024
☕ Que tal um café com desconto?Veroo Café: https://codft.me/veroocafeCupom: CODIGOFONTE - Plano anual com brinde especial!
📌 Sorteio Semanal Compilado:Os ganhadores do Sorteio Semanal do Compilado foram o @onecio, e ele levou uma camiseta do Compilado! Você pode ser...
2024-11-1054 minWhat's in the SOSS? An OpenSSF PodcastCanonical’s Stephanie Domas and Security Insight from a Self-Described “Tinkerer”In this episode, CRob talks to Stephanie Domas, CISO at Canonical, the creators of the popular operating system Ubuntu. Having started her career with over 10 years of ethical hacking, reverse engineering and advanced vulnerability analysis, Stephanie has a deep knowledge and passion for the hacker mindset. 01:14: Stephanie shares how she got her start in security05:41 Interesting things Stephanie has discovered since becoming more directly involved with open source08:20 The challenge of instilling trust into those who consume open source12:42 Stephanie answers CRob’s rapid-fire questions14:07 Stephanie’s advice to those getting into cybersecurity15:43 Stephanie’s call to action for lis...
2024-10-2916 minWhat's in the SOSS? An OpenSSF PodcastIntel’s Katherine Druckman and the Impact of Developer RelationsIn this episode, CRob discusses the finer points of developer relations (DevRel) with Katherine Druckman, Open Source Evangelist at Intel and co-chair of the OpenSSF Marketing Advisory Council and DevRel Community. Katherine enjoys sharing her passion for a variety of open source topics and is a long-time open source advocate, developer and podcaster. She’s currently the host of Open at Intel and co-host of the FLOSS Weekly and Reality 2.0 podcasts. She spent over a decade at Linux Journal. A passionate Drupalist since she first downloaded a tarball in 2005, she has also been a Drupal contributor and engineer. A...
2024-10-1514 minWhat's in the SOSS? An OpenSSF PodcastDell's Sarah Evans and Lisa Bradley and Ensuring Secure Open Source Software at the Enterprise LevelIn this episode, CRob sits down with Sarah Evans, security research technologist at Dell and Lisa Bradley, senior director of product and application security at Dell. They dig into the challenges of implementing secure open software at a complex enterprise. Sarah sits on the OpenSSF Technical Advisory Council and at Dell’s she has been instrumental in cybersecurity innovation, conducting research within the global CTO R&D organization. Her career spans pivotal roles, including being an enterprise security architect and engaging in Identity and Access Management and IT at prestigious organizations like Wells Fargo and the U.S...
2024-10-0116 minWhat's in the SOSS? An OpenSSF PodcastBidding Adieu to Omkhar ArasaratnamIn this episode, CRob chats with Omkhar Arasaratnam, who has served as the general manager of the OpenSSF and was co-host of What’s in the SOSS? As Omkhar moves on to the next chapter of his occupational journey, he reflects on his tenure with the OpenSSF, shares his open source origin story and highlights the achievements of the OpenSSF and the tactics he used to engage different stakeholders. Omkhar shares his open source origin story02:14 - Things Omkhar is proud of during his tenure at the OpenSSF04:36 - The challenge of keeping myriad stakeholders engaged07:12 - Areas of...
2024-09-1720 minWhat's in the SOSS? An OpenSSF PodcastCoSAI, OpenSSF and the Interesting Intersection of Secure AI and Open SourceOmkhar is joined by Dave LaBianca, security engineering director at Google, Mihai Maruseac, member of the Google Open Source Security Team, and Jay White, security principal program manager at Microsoft. David and Jay are on the Project Governing Board for the Coalition for Secure AI (CoSAI), an alliance of industry leaders, researchers and developers dedicated to enhancing the security of AI implementations. Additionally, Jay — along with Mihai — are leads on the OpenSSF AI/ML Security Working Group. In this conversation, they dig into CoSAI’s goals and the potential partnership with the OpenSSF.00:57 - Guest introductions01:56 - Dave and Ja...
2024-09-1022 min
SecurityWeek PodcastFireside Chat: Bennett Pursell on the OpenSSF Siren Threat Intel ProjectIn this session SecurityWeek speaks to Bennett Pursell, Ecosystem Strategist at the Open Source Security Foundation (OpenSSF) about OpenSSF Siren, a community data-sharing initiative aimed at bolstering the defenses of open source projects worldwide. In this fireside chat, Pursell discusses the origins and goals of OpenSSF Siren, exploring transparent access to data that can help small- and medium-sized businesses during active incidents. Pursell also shares insights on the value of threat intelligence, the shelf life of IOC (indicators of compromise) and how businesses with limited resources can mitigate exposure to risk.(Recorded at SecurityWeek's 2024 Threat Detection & Incident...
2024-09-0630 minSecurityWeek Podcast Series - Cybersecurity InsightsFireside Chat: Bennett Pursell on the OpenSSF Siren Threat Intel ProjectIn this session SecurityWeek speaks to Bennett Pursell, Ecosystem Strategist at the Open Source Security Foundation (OpenSSF) about OpenSSF Siren, a community data-sharing initiative aimed at bolstering the defenses of open source projects worldwide. In this fireside chat, Pursell discusses the origins and goals of OpenSSF Siren, exploring transparent access to data that can help small- and medium-sized businesses during active incidents. Pursell also shares insights on the value of threat intelligence, the shelf life of IOC (indicators of compromise) and how businesses with limited resources can mitigate exposure to risk.(Recorded at SecurityWeek's 2024 Threat Detection & Incident...
2024-09-0630 minWhat's in the SOSS? An OpenSSF PodcastGitHub’s Mike Hanley and Transforming the “Dept. of No” Into the "Dept. of Yes, And…”In this episode, Omkhar chats with Mike Hanley, Chief Security Officer and SVP of Engineering at GitHub. Prior to GitHub, Mike was the Vice President of Security at Duo Security, where he built and led the security research, development, and operations functions. After Duo’s acquisition by Cisco for $2.35 billion in 2018, Mike led the transformation of Cisco’s cloud security framework and later served as CISO for the company. Mike also spent several years at CERT/CC as a Senior Member of the Technical Staff and security researcher focused on applied R&D programs for the US Depar...
2024-09-0322 minWhat's in the SOSS? An OpenSSF PodcastCISA's Aeva Black and the Public Sector View of Open Source SecurityIn this episode, Omkhar Arasaratnam visits with Aeva Black, who currently serves as the Section Chief for Open Source Security at CISA, and is an open source hacker and international public speaker with 25 years of experience building open source software projects at large technology companies. She previously led open source security strategy within the Microsoft Azure Office of the CTO, and served on the OpenSSF Technical Advisory Committee, the OpenStack Technical Committee, and the Kubernetes Code of Conduct Committee. In her spare time, Aeva enjoys riding motorcycles up and down the west coast.01:37...
2024-08-2712 minWhat's in the SOSS? An OpenSSF PodcastGoogle’s Andrew Pollock and Addressing Open Source VulnerabilitiesEpisode description: Andrew Pollock is a Senior Software Engineer at Google, currently working on https://osv.dev. With a background as an Enterprise Security Engineer, he has extensive experience in large-scale Linux Systems Administration and GCP Security. Andrew is passionate about the human factors in security, focusing on scalable solutions, great user experiences and self-service opportunities. He has primarily worked in Linux/Unix environments as a Site Reliability Engineer or Security Engineer, with a strong interest in process improvement and automation.00:52 - Andrew shares his background as a “mid-90s data nerd”02:31 - Managing vulnerabilities in the open sour...
2024-08-1312 minWhat's in the SOSS? An OpenSSF PodcastRust Foundation’s Bec Rumbul and Succeeding as a “Non-Techie” in a Tech-Heavy IndustryBec Rumbul is the Executive Director and CEO of the Rust Foundation, a global non-profit that stewards the Rust language, supports maintainers, and ensures that Rust is safe, secure, and sustainable for the future. She holds a PhD in Politics and Governance and has worked as a consultant and researcher with governments, parliaments and development agencies all over the world, advocating for openness and transparency and developing tools to improve digital participation.02:57 Bec shares her day-to-day activities with the Rust Foundation04:53 Bec on her sometimes tricky responsibilities during her time at the U.N.06:35 How Bec communicates the...
2024-07-3018 minWhat's in the SOSS? An OpenSSF PodcastSonatype’s Brian Fox and the Perplexing Phenomenon of Downloading Known VulnerabilitiesBrian Fox is Co-founder and Chief Technology Officer at Sonatype, bringing over 28 years of hands-on experience driving software development for organizations of all sizes, from startups to large enterprises. A recognized figure in the Apache Maven ecosystem and a longstanding member of the Apache Software Foundation, Brian has played a crucial role in creating popular plugins like the maven-dependency-plugin and maven-enforcer-plugin. His leadership includes overseeing Maven Central, the world's largest repository of open-source Java components, which recently surpassed a trillion downloads annually.As a Governing Board member for the Open Source Security Foundation, Brian actively c...
2024-07-1622 minWhat's in the SOSS? An OpenSSF PodcastArun Gupta and Giving Back to Security CommunitiesArun Gupta is vice president and general manager of Open Ecosystem Initiatives at Intel Corporation and the OpenSSF Governing Board Chair. Arun has been an open source strategist, advocate, and practitioner for nearly two decades. He has taken companies such as Apple, Amazon, and Sun Microsystems through systemic changes to embrace open source principles, contribute, and collaborate effectively.On July 9th and 10th, the OpenSSF will attend the 2024 OSPOs for Good symposium hosted by the UN. What’s in the SOSS? co-host Omkhar Arasaratnam and Arun will lead a session called “Engaging the Open Source Community.”Foll...
2024-07-0222 minWhat's in the SOSS? An OpenSSF PodcastStacklok's Adolfo García Veytia Digs Into SBOMs and VEXThe world of software bill of materials (SBOMs) is both complex and fascinating. And few people know the SBOM community better than Adolfo García Veytia — aka Puerco — Staff Software Engineer at Stacklok. Puerco is also a Technical Lead with Kubernetes SIG Release specializing in supply chain improvements to the software that drives the automation behind the release process. Puerco is one of the original authors of OpenVEX, an OpenSSF project working towards a minimal implementation of VEX that can be easily embedded and attested. He's also a contributor to the SPDX project and a maintainer of severa...
2024-06-1818 minWhat's in the SOSS? An OpenSSF PodcastA Man Called CRob: Introducing the Newest Co-host of What’s in the SOSS?Christopher Robinson (aka CRob) is the Director of Security Communications at Intel Product Assurance and Security. He also serves as the Open SSF’s Technical Advisory Committee (TAC) Chair. And soon, CRob will step into another role: co-host of What’s in the SOSS? With 25 years of enterprise-class engineering, architectural, operational and leadership experience, Chris has worked at several Fortune 500 companies with experience in the financial, medical, legal, and manufacturing verticals. He also spent six years helping lead the Red Hat Product Security team as their Program Architect.00:57 - CRob’s day-to-day activities and his affiliation with the OpenSS...
2024-06-1120 minWhat's in the SOSS? An OpenSSF PodcastOpenAI’s Matt Knight and Exploring the Intersection of AI and Open Source SecurityMatt Knight is Head of Security at OpenAI, where he builds IT, privacy and security programs. His teams also collaborate on security research with teams across OpenAI and with the broader security research community. Their goal is to explore the frontier of AI, understand its impacts and maximize its benefits, especially in the cybersecurity domain. 00:40 - Matt’s duties at OpenAI01:52 - Matt’s accidental journey into cybersecurity05:18 - The intersection of AI and open source06:45 - Matt’s thoughts on how AI can help security professionals08:53 - Details on the AI Cyber Challenge (AIxCC)10:53 - Matt answers Omkhar’...
2024-06-0414 min
Redefining CyberSecurityWhy the Industry Needs OpenSSF | A Conversation with Omkhar Arasaratnam, Adrianne Marcum, Arun Gupta, and Christopher Robinson | Redefining CyberSecurity with Sean MartinGuests: Omkhar Arasaratnam, General Manager, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/omkhar/Adrianne Marcum, Technical Project Manager, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/adriannefranscinimarcumArun Gupta, VP/GM Open Ecosystem at Intel, Governing Board Chair, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/arunpgupta/On Twitter | https://twitter.com/arunguptaChristopher Robinson, Chairperson of the Technical Advisory Council, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/darthcrob/____________________________Host: Sean M...
2024-05-2342 min
The ITSPmagazine PodcastWhy the Industry Needs OpenSSF | A Conversation with Omkhar Arasaratnam, Adrianne Marcum, Arun Gupta, and Christopher Robinson | Redefining CyberSecurity with Sean MartinGuests: Omkhar Arasaratnam, General Manager, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/omkhar/Adrianne Marcum, Technical Project Manager, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/adriannefranscinimarcumArun Gupta, VP/GM Open Ecosystem at Intel, Governing Board Chair, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/arunpgupta/On Twitter | https://twitter.com/arunguptaChristopher Robinson, Chairperson of the Technical Advisory Council, OpenSSF [@openssf]On LinkedIn | https://www.linkedin.com/in/darthcrob/____________________________Host: Sean M...
2024-05-2342 minWhat's in the SOSS? An OpenSSF PodcastEric Brewer and the Future of Open Source SecurityIn this episode, Omkhar talks to Eric Brewer, professor emeritus of computer science at the University of California, Berkeley and vice president of infrastructure at Google. He’s also on the Governing Board of the OpenSSF. His research interests include operating systems and distributed computing. He is known for formulating the CAP theorem about distributed network applications in the late 1990s. 01:15 - Eric discusses his background03:14 - Improving security in a corporate vs. open source environment05:58 - Advancements Eric has noticed in open source in recent years07:17 - How to make software repositories more secure08:58 - The next big...
2024-05-2116 minWhat's in the SOSS? An OpenSSF PodcastMark Russinovich and AI’s Impact on Software Engineering and Open Source Software SecurityIn this episode, Omkhar talks to Mark Russinovich, CTO of Microsoft Azure. Mark oversees the technical strategy and architecture of Microsoft’s cloud computing platform. Mark is also on the Governing Board of the OpenSSF. He’s a widely recognized expert in distributed systems, operating system internals, and cybersecurity. Mark’s also the author of the Jeff Aiken cyberthriller novels Zero Day, Trojan Horse and Rogue Code, and co-author of the Microsoft Press Windows Internals books.00:36 - Mark on his role at Azure01:30 - Where AI is headed and its impact on enterprises04:06 - The task of teaching a mach...
2024-05-0717 minWhat's in the SOSS? An OpenSSF PodcastChristoph Kern and the Challenge of Keeping Google SecureIn this episode, Omkhar talks to Christoph Kern, Principal Software Engineer in Google’s Information Security Engineering organization. Christoph helps to keep Google’s products secure and users safe. His main focus is on developing scalable, principled approaches to software security.00:42 - Christoph offers a rundown of his duties at Google01:38 - Google’s general approach to security03:02 - What Christoph describes as “stubborn vulnerabilities” and how to stop them06:42 - An overview of Google’s security ecosystem10:00 - Why memory safety is so important12:23 - Solving memory safety problems via languages16:23 - Omkhar’s rapid-fire questions18:28 - Why Christoph...
2024-04-2320 min
Nerding Out With Viktor (audio only)Mastering OpenSSF Scorecards & SBOMs with Chris SwanJoin Viktor Petersson on this episode of Nerding Out with Viktor as he dives into the world of open source security with guest Chris Swan, a seasoned engineer at Atsign. Together, they explore the critical role of SBOMs (Software Bill of Materials) and OpenSSF Scorecards in securing software and promoting transparency. Chris shares his expertise on how Atsign harnesses these tools to safeguard their networking platform and build trust with users.
The conversation shines a light on the importance of OpenSSF within the Linux Foundation, highlighting Atsign's adoption of scorecards as a testament to their commitment to...
2024-04-221h 00Nerding Out With ViktorMastering OpenSSF Scorecards & SBOMs with Chris SwanJoin Viktor Petersson on this episode of Nerding Out with Viktor as he dives into the world of open source security with guest Chris Swan, a seasoned engineer at Atsign. Together, they explore the critical role of SBOMs (Software Bill of Materials) and OpenSSF Scorecards in securing software and promoting transparency. Chris shares his expertise on how Atsign harnesses these tools to safeguard their networking platform and build trust with users.
The conversation shines a light on the importance of OpenSSF within the Linux Foundation, highlighting Atsign's adoption of scorecards as a testament to their commitment to...
2024-04-221h 00What's in the SOSS? An OpenSSF PodcastVincent Danen and the Art of Vulnerability ManagementOmkhar talks to Vincent Danen, Vice President of Product Security at Red Hat, which is responsible for security and compliance activities for all Red Hat products and services. He’s also on the Governing Board of the OpenSSF. Vincent has been involved with open source and software security for over 20 years, leading security teams and participating in open source communities and development.Links: Vincent Danen’s LinkedIn pageRed Hat Product Security Vulnerability ManagementOpenSSF Security Toolbelt
2024-04-1118 minWhat's in the SOSS? An OpenSSF PodcastWhat's in the SOSS? PreviewOmkhar Arasaratnam is the General Manager of the Open Source Security Foundation (OpenSSF) and a veteran cybersecurity and technical risk management executive. Before joining the OpenSSF, he led security organizations at financial and technology institutions, such as Google, JPMorgan Chase, Credit Suisse, Deutsche Bank, TD Bank Group, and IBM. As a seasoned technology leader, Omkhar has revolutionized the effectiveness of secure software engineering, compliance, and cybersecurity controls. He is also an accomplished author and has led contributions to many international standards. In this short preview, Omkhar offers a sneak peek into the coming What's in the SOSS? p...
2024-03-2600 min
Application Security Weekly (Video)GoFetch Side Channel, OpenSSF & Security Education, Fuzzing vs. Formal Verification - ASW #278The GoFetch side channel in Apple CPUs, OpenSSF's plan for secure software developer education, fuzzing vs. formal verification as a security strategy, hard problems in InfoSec (and AppSec), and more! Show Notes: https://securityweekly.com/asw-278
2024-03-2532 min
AppSec NowEpisode 13: August, 2023 - OpenSSF / Hacker Summer CampJoin Aubrey King, from DevCentral, as he talks with a record number of guests - 8 - for August, 2023 This Month In Security! Topics are OpenSSF and "Hacker Summer Camp" in Las Vegas (B-Sides, BlackHat, Defcon), as well as the latest news. You'll hear from David Wheeler, from the Linux Foundation, Akira Brand, from Application Security Weekly podcast and F5'ers Buu Lam, Christine Abernathy, Trishan DeLanerole, Aaron Brailsford, Malcolm Heath and Sander Vinberg!
00:00:00 Introduction
00:02:55 Aubrey & Akira chat Ops and OpenSSF
00:06:48 OpenSSF Update w/ David Wheeler
00:24:11 B-Sides LasVegas & Defcon 2023 Report
00:35:54 BlackHat 2023 Report
00:43:12 Aubrey & Akira chat SecOps Perspectives
00:46:13 The Latest CyberSecurity...
2024-01-111h 01
It's 5:05! Daily cybersecurity and open source briefingEpisode #245: npm Typo-Squat Deploys RootKits; Software Supply Chain: What Matters to an Architect; Security During Software Creation; OpenSSF Scorecards for Open Source🎙️ Free, ungated access to all 235+ episodes of “It’s 5:05!” on your favorite podcast platforms: https://bit.ly/505-updates. ♻️ You’re welcome to 𝗿𝗲𝗽𝗼𝘀𝘁 if your followers will find this of value.The stories we're covering today.Marcel Brown: October 6th, 1942. Chester Carlson is issued a patent on a process called electrophotography, now commonly known as photocopying. It was not until 1946 that a company had any interest in pursuing photocopying commercially.Edwin Kwan: A malicious component in the npm package registry has been found to be deploying an open-source rootkit. This incident is a reminder that developers need to take caution...
2023-10-0614 min
Application Security Weekly (Video)A Deceptive Dependabot, Insecure JWT, CISA Wants HBOMs, OpenSSF's Critical Projects - ASW #257Attackers impersonate Dependabot commits, an alg of "none" plagues a JWT, CISA calls for hardware bills of materials, OpenSSF lists its critical projects, Exim (finally! maybe?) has some patches, bug bounties and open source projects, and more! Show Notes: https://securityweekly.com/asw-257
2023-10-0339 min
Three Buddy ProblemOpenSSF GM Omkhar Arasaratnam on open-source software securityEpisode sponsors:
Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)
New General Manager of the Open Source Security Foundation (OpenSSF) Omkhar Arasaratnam joins Ryan for a candid conversation on the challenges surrounding open-source software security, lessons from the Log4j crisis, the value of SBOMs, and the U.S. government efforts at securing America's software supply chains.Links:OpenSSF Welcomes New General Manager
OpenSSF Alpha-Omega
CSRB report on Log4j
Big Tech Object to US Gov SBOM Mandate
Omkhar Arasaratnam on LinkedIn
2023-07-0536 min
Resilient CyberS4E22: Omkhar Arasaratnam - OSS and OpenSSFYou are now at the Open Source Security Foundation - but you have a ton of experience (even as a former IBMer) from Google, to JPMorgan, and financial institutions through architecture, management, and engineering. Can you talk a little bit about your leadership journey? Let's dig into OpenSSF a bit more - we're only seeing an increase in software supply chain attacks - what is driving the OpenSSF and any particular threats you're concerned with at the moment? We know the OpenSSF has focused heavily on securing OSS and the ecosystem and even launched the OS...
2023-06-2341 min
We Speak CVECoordinated Vulnerability DisclosureShannon Sabens of CrowdStrike chats with Madison Oliver of GitHub Security Lab about the recent release of OpenSSF’s “Guidance for Security Researchers to Coordinate Vulnerability Disclosures with Open Source Software Projects” document and the important step of obtaining a CVE ID in the coordinated vulnerability disclosure process for open-source vulnerabilities.OpenSSF is a “cross-industry organization that brings together the industry’s most important open source security initiatives and the individuals and companies that support them.” The CVD Guide was released by OpenSSF’s Vulnerability Disclosure working group in September 2022, which in 2021 released its “Guide to Implementing a Coordinated Vu...
2022-12-3023 min
Application Security Weekly (Video)Text4Shell, GUAC for SLSA, OpenSSF Scorecards, Toner Deaf, OWASP Elections - ASW #217Text4Shell isn't a new patching hell, using supply chain info with GUAC, OpenSSF Scorecards and metrics, Toner Deaf firmware persistence, upcoming OWASP Board Elections, Chrome browser exploitation Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw217
2022-10-2640 min
Application Security Weekly (Video)Typosquatting, Curl's Security Update, & OpenSSF's 10 Point Mobilization Plan - ASW #197This week in the AppSec News: Typosquatting spreads to Rust, curl fixes flaws in mishandling dots and slashes, OpenSSF invests in a mobilization plan for open source, interesting appsec from Black Hat Asia. Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw197
2022-05-1840 min
In the Open with Luke and JoeOpen source software, cybersecurity, and OpenSSF | Jamie Thomas, Chair, OpenSSFAs General Manager of Strategy and Development, IBM Systems, Jamie Thomas sets the direction for IBM Systems, Power, Z, and Storage systems. She also currently serves as Board Chair of the Open Source Security Foundation. In her leadership roles, Jamie is uniquely positioned to provide insight on what lies ahead for open source development, software, and the systems that serve as the technology backbone for companies around the world. Jamie joins hosts Luke Schantz and Joe Sepi to talk about her storied career at IBM and what lies ahead for the technology that helps most large organizations r...
2022-04-1449 min
IBM Developer PodcastOpen Source Security Foundation | Interview with Brian Behlendorf, GM, OpenSSFBrian Behlendorf is the General Manager of the Open Source Security Foundation. Brian has dedicated his career to connecting and empowering the free software and open source community to both solve difficult technology problems and have a positive impact on society. From startup company founder, to advisor to the U.S. government, to non-profit board member and employee of the World Economic Forum, he's been at the forefront of the open source software revolution. Join hosts Luke Schantz and Joe Sepi as they get Brian's take on the latest open source software developments. As the recent Log4J...
2022-02-2349 min
Open Source SecurityDavid A Wheeler discusses the OpenSSFJosh and Kurt talk to David A. Wheeler about everything OpenSSF. The Open Source Security Foundation is part of the Linux Foundation, and there are 6 OpenSSF working groups. David does a great job explaining how the OpenSSF works and what the 6 working groups are doing. The working group are (in no particular order): Identifying Security Threats, Security Tooling, Best Practices, Vulnerability Disclosures, Digital Identity Attestation, Securing Critical Projects. Show Notes David A Wheeler Episode 14 – David A Wheeler: CII Badges Sigstore joins the OpenSSF OpenSSF Technical Working Groups NPM requires MFA LISH Backstabber's Knife Collection: A Review of Op...
2021-11-2238 min
Open Source SecurityScoring OpenSSF Security ScoringJosh and Kurt talk about the release of OpenSSF Security Scorecards version 3. This is a great project that will probably make a huge difference. Most of the things the scorecards are measuring are no brainier activities. We go through the list of metrics being measured. There are only a few that we don't think are fantastic. Show Notes 4 of spades OpenSSF Chris Montgomery audio explanation Scorecard 3.0.0 Scoring criteria Python Skeleton
2021-10-1834 min