Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
veganism.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Veganism Social is a welcoming space on the internet for vegans to connect and engage with the broader decentralized social media community.

Administered by:

Server stats:

292
active users

veganism.social: AboutStatusPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.0-alpha.5+vegan

#opensourcesecurity

1 post1 participant0 posts today
Public
ActiveState

AI is transforming vulnerability management.

Discover how AI-powered Software Posture Management (SPM) is changing the game for vulnerability detection and remediation. From proactive risk management to smarter decision-making, learn how enterprises can secure their software supply chains with confidence.

Read the blog to explore the future of AI in vulnerability management: activestate.com/uncategorised/

#AI#VulnerabilityManagement#DevSecOps
Public
Josh Bressers

This episode of #OpenSourceSecurity talks to @predrag about cargo-semver-checks

it's a #Rust tool that can help you figure out if you broke #semver, it's pretty awesome

We also touch on the difficulty of detecting breaking changes, sustainable open source, and what's to come for semver checking

It's a fun chat and you'll learn a lot

opensourcesecurity.io/2025/202

Open Source Security · cargo-semver-checks with Predrag GruevskiCargo Semver Checks is a Rust tool by Predrag Gruevski that is tackling the problem of broken dependencies that cost developers time when trying to upgrade dependencies. Predrag’s work shows how automated checks can catch breaking changes before they’re released, potentially saving projects from unexpected failures and making dependency updates less painful across the entire Rust ecosystem. Episode links Predrag’s Mastodon Predrag’s Blog “We never update unless forced to” — cargo-semver-checks 2024 Year in Review cargo-semver-checks issue 5 This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

I spoke with @liw on #OpenSourceSecurity about two really cool projects he's working on

Ambient is a distributed CI/CD system written in Rust

@radicle is a distributed Git Forge

It's a really fun chat and I learned a lot

opensourcesecurity.io/2025/202

Open Source Security · Distributed CI and Git with Lars WirzeniusI got to chat with Lars about a new CI/CD system he’s been working on called Ambient. It sounds really cool and does some very clever things today, with even more things planned in the future. We also spend some time discussing a project he works on called Radicle, a distributed Git forge. It feels like having decentralized infrastructure might be more important than it’s ever been, for some reason.
Public
Josh Bressers

I chatted with @firstyear about FIDO authentication on #OpenSourceSecurity, especially the FIDO Metadata Service. I learned a ridiculous amount about U2F, WebAuthn, and FIDO in this conversation

opensourcesecurity.io/2025/202

Open Source Security · FIDO authentication with William BrownWhen William Brown posted a rant on Mastodon about the FIDO Metadata Service, it sounded like exactly the sort of thing I wanted to learn more about. So that’s what I did! It’s a fun conversation, William is really good at explaining insanely complicated topics in a way that’s easy to understand. This one is dense, but it’s really interesting, you’re going to learn a ton. Episode links William’s Mastodon Yubico FEITIAN Token2 This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This week on #OpenSourceSecurity I chat with Brian Fox from Sonatype about open source malware

The volume of malware is continuing to grow, and we don't have amazing answers today

The first step is to understand the problem

opensourcesecurity.io/2025/202

Open Source Security · Open Source Malware with Brian FoxI recently sat down with Brian Fox, CTO and co-founder of Sonatype, about a report they recently published about malware in open source ecosystems. This is something that’s not a surprise to anyone paying attention, but there are some things Sonatype is doing in this space that’s very clever. I’ve known Brian for a long time so it was a treat to catch up and see what they found, and what it means for the future.
Public
Josh Bressers

This episode of #OpenSourceSecurity talks to Kelley Misata of @suricata

The foundation model behind Suricata is fascinating, the conversation has a ton of lessons on how to run sustainable open source projects

opensourcesecurity.io/2025/202

Open Source Security · Open Source Foundations with Kelley Misata of SuricataIn the world of open source software, we often celebrate the code, the contributors, and the collaboration. But beneath the surface lies a world unknown to most. It’s not a secret, it’s just not something most of us pay attention to, the foundations that drive some of the open source projects. I had the opportunity to discuss this with Dr. Kelly Masada, who has served as president of the Open Information Security Foundation (OISF) for over 12 years. OISF is the organization behind Suricata, the very capable and well known open source network analysis and threat detection software.
Public
Josh Bressers

This episode #OpenSourceSecurity talks to @sheogorath about forking open source projects

It's a lot more complicated than you think it is, and Sheogorath has some first hand experience from one of the most complicated forks I've ever seen in HedgeDoc

It's a fun chat filled with lessons

opensourcesecurity.io/2025/202

Open Source Security · Forking Open Source Projects with SheogorathIf you use GitHub, you probably have “forked” a repo more times than you can count. It’s super common and the ideal way you can interact with a git repository you don’t control. But the idea of forking in open source can have another meaning, a far more interesting meaning. It’s when you take the open source project, and create a new open source project based on the first. It’s not as simple as clicking a button. The process is complicated and is a ton of corner cases.
Public
Josh Bressers

This episode #OpenSourceSecurity spoke with Aaron Frost from HeroDevs about patching EOL #OpenSource (nobody is going to do this for free)

This one has a special place in my heart as I did this at Red Hat long ago. It was a fun chat

opensourcesecurity.io/2025/202

Open Source Security · Patching EOL Open Source with Aaron FrostWhen I started Open Source Security HeroDevs reached out and asked if I wanted to have a chat. I was pretty interested in this discussion because the work HeroDevs does today is very similar to the work I did at Red Hat for a decade. While what they work on is a bit different than the sort of things we shipped in a Linux distribution, the basic idea is still the same.
Public
Josh Bressers

This episode of #OpenSourceSecurity we talk to François Proulx about CI/CD security. Even though many successful supply chain attacks have originated in CI, we keep obsessing over dev and release. Why do we keep ignoring the middle? (TL;DR it's hard)

opensourcesecurity.io/2025/202

Open Source Security · Why do we keep ignoring CI security with François ProulxWhen I started Open Source Security I knew one of those topics that could use more attention was the security of CI/CD systems. All the talk about securing the supply chain seems to almost exclusively focus on the development stage as well as the deployment stage. It seems like there’s not enough attention happening to the build stage (spoiler: most of the successful attacks have happened at this stage). When François Proulx reached out to chat about CD/CD systems, I couldn’t say yes fast enough.
Public
ActiveState

Exciting news from ActiveState! We're proud to launch our market-first Vulnerability-Management-as-a-Service (VMaaS). This innovative offering combines ASPM with Intelligent Remediation to transform how organizations manage open source security. Empower your DevSecOps teams to secure the software supply chain efficiently and effectively.

Discover more about how VMaaS can benefit your organization: activestate.com/resources/pres

#ActiveState#VMaaS#OpenSourceSecurity
Public
Josh Bressers

This week #OpenSourceSecurity chat with Marc Boorshtein. we chat about what modern day Single Sign-On (SSO) looks like. Everyone likes to talk about zero trust, but how does that work? Marc gives us some good real world advice for how we should be adding authentication to our apps and services
opensourcesecurity.io/2025/202

Open Source Security · Modern day authentication with Marc BoorshteinWhen I thought doing an episode about authentication would be a good idea, Marc Boorshtein was the first person who came to mind for me. Marc knows more about authentication than anyone I know, and he’s really good at talking about it in a coherent way. Marc is the CTO of Tremolo Security, he’s been doing authentication for more than 20 years, long before many of us even knew this whole identity and authentication thing was something we should care about.
Public
Josh Bressers

On this episode of #OpenSourceSecurity I chat with Richard (Dick) Brooks about government security requirements.

There's a lot up in the air right now, and at the moment it doesn't seem like it's going to drastically affect open source developers, but it will certainly affect many of us in our day jobs.

Dick has a lot of insight into what exists today and what's coming next

opensourcesecurity.io/2025/01-

Open Source Security · Government Security Requirements with Dick BrooksI had a discussion with Dick Brooks about government regulations and open source software security. The conversation covered the frameworks that affect enterprise software, users of open source, and open source developers. At the moment, all these regulations don’t mean a ton for open source developers, which is good news. Dick is the co-founder of Business Cyber Guardian and former enterprise architect at ISO New England. He’s a self proclaimed old school software engineer who worked at Digital Equipment Corporation. These days Dick is involved in working on secure development programs with governments around the world.
VegansExploreLive feeds
About