Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
veganism.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Veganism Social is a welcoming space on the internet for vegans to connect and engage with the broader decentralized social media community.

Administered by:

Server stats:

288
active users

veganism.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-alpha.5

#opensourcesecurity

2 posts2 participants0 posts today
Public
Josh Bressers

This episode of #OpenSourceSecurity I chat with @tb about crates.io trusted publishing

I learned a ton about how trusted publishing works, it's one of those very new and very interesting topics

And of course anytime I can talk about #Rust it's a great chat :)

opensourcesecurity.io/2025/202

Open Source Security · crates.io trusted publishing with Tobias BieniekIn this episode we discuss crates.io trusted publishing with Tobias Bieniek. We cover the steps crates.io is taking to enhance supply chain security through trusted publishing, a method that leverages short-lived tokens and GitHub actions to safeguard against unauthorized access. Tobias shares insights into the challenges of managing a large-scale open-source repository, offering a glimpse into the future of secure software distribution. Tune in to learn how these advancements are shaping the landscape of open-source development.
Public
FreeBSD Foundation

How do you secure thousands of open-source projects?

At the June 2025 FreeBSD Developer Summit, Michael Winser shared three years of lessons from the Alpha-Omega project—covering supply chain risk, rapid audits, and sustainable funding.

📺 Watch here: Lessons From Funding Open Source Security Over the Past 3 Years, What’s Ahead
youtu.be/6DoT-eFH6tY?si=M_zlAf

#BSDCan2025#OpenSourceSecurity#AlphaOmega
Public
Josh Bressers

This week on #OpenSourceSecurity I chat with Patrick Garrity about what's going on with #CVE

It's a wild couple of months, we break down where are today and where we think it's going to go soon, and why there are some difficult times ahead for vulnerability nerds

opensourcesecurity.io/2025/202

Open Source Security · CVE update with Patrick GarrityIn this episode I chat with Patrick Garrity from VulnCheck. We discuss the chaos that has enveloped the CVE and NVD programs over the past two years. We cover some of the transparency and communication challenges with the existing program. What some of the new things that have started to emerge as well as why they seem to be struggling. We end on the note that the last 3 months haven’t been confidence inspiring. It’s likely in 6 months everyone will be scrambling to deal with a difficult situation.
Public
DataDef(AE)

🧠 Backup is not just a technical task — it's a leadership responsibility.

As the founder of DataDef, I’ve seen too many businesses suffer from one simple mistake: they didn’t back up their data properly.

It’s not just about saving a copy. It’s about resilience.

📌 My rule — and what we follow at DataDef — is simple but powerful:
3-2-1-1-0

🔹 3 copies of your data
🔹 2 different storage types
🔹 1 offsite backup
🔹 1 immutable (read-only, ransomware-proof)
🔹 0 errors during recovery (because we test everything)

💡 If you don’t have a strategy like this, you’re not protected. You’re hoping for luck.
And hope is not a cybersecurity policy.

If you're a founder, CTO, or CISO — make backup part of your core risk strategy. Before something breaks.

DMs open.

#CyberSecurity #DataDef #Backup #32110 #TechLeadership #ImmutableBackup #MastodonTech #InfoSec #OpenSourceSecurity #BusinessContinuity #DataProtection

GIF
Public
Josh Bressers

I talked to Daniel Thompson-Yvetot on the latest episode of #OpenSourceSecurity

opensourcesecurity.io/2025/202

The main topic was the coming regulation for software developers. While there are carve outs for open source projects, what counts as an open source project isn't as clear as I thought it was. I learned a ton from Daniel on this one. It's going to be a very interesting couple of years.

Open Source Security · EU Regulations will change everything with Daniel ThompsonIn this episode, we dive into the Product Liability Directive and Cyber Resilience Act with Daniel Thompson, CEO of Crab Nebula. The EU’s new legislative framework impacts manufacturers in ways we don’t totally understand, but are going to bring substantial changes to how companies use and develop open source. Daniel explains the broader implications for software security and the future of digital products in the European market. Episode Links Daniel Crab Nebula This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This #OpenSourceSecurity episode I chatted with Jan Pleskac from Tropic Square about open source microprocessors

I learned an incredible amount about how this all works, what Tropic Square is trying to do, and what we can start to expect in the future

I would like to say it's time for open source to work its magic on the world of hardware, but it's indescribably more complicated than software

opensourcesecurity.io/2025/202

Open Source Security · Open source microprocessors with Jan PleskacIn this episode Jan Pleskac, CEO and co-founder of Tropic Square, shares insights on the challenges and innovations in creating open and auditable hardware. While most hardware is very closed, Tropic Square is working to change this. WE discuss how open source can enhance security, the complexities of integrating third-party technologies, and the future of secure computing devices. Episode Links Jan Pleskac Tropic Square Tropic Square GitHub This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

#OpenSourceSecurity chats with @Di4na about his blog post explaining hobbyist open source maintainers

Whatever you think you know about open source, you're going to learn something from this one

An enormous amount of the open source that runs the world is written by hobbyists, and how we can support them is not at all obvious or easy

opensourcesecurity.io/2025/202

Open Source Security · Hobbyist Maintainers with Thomas DePierreThomas DePierre joins Open Source Security to discuss the central idea from his blog post, “You are all on the hobbyist maintainers turf now,” exploring the massive disconnect between the corporate world that consumes open source and the hobbyist community that actually produces it. The conversation reveals this isn’t a new problem, but a long-standing reality whose consequences for security, stability, and the future of software we are only now beginning to truly confront.
Public
Josh Bressers

This episode of #OpenSourceSecurity I chat with Aaron Lippold from MITRE about #STIG automation (it's one big open source project)

STIG has historically been incredibly difficult and a bit of a niche space. Thanks to #FedRAMP it's getting more attention than ever before, and the work Aaron has been doing makes it a lot easier

opensourcesecurity.io/2025/202

Open Source Security · STIG automation with Aaron LippoldI chat with Aaron Lippold, creator of MITRE’s Security Automation Framework (SAF), to discuss how to escape the pain of manual STIG compliance. We explore the technical details of open-source tools like InSpec, Heimdall, and Vulcan that automate validation, normalize diverse security data, and streamline the entire security authoring process. Episode Links Aaron MITRE SAF This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This week #OpenSourceSecurity chats with @andrewnez about @ecosystems

Ecosyste.ms is a massive collection of data about open source projects

It's an amazingly useful collection of data. If you're doing anything that needs information about open source packages, or git repos, or even the folks who work on this stuff, you should check it out

opensourcesecurity.io/2025/202

Open Source Security · Ecosyste.ms with Andrew NesbittI recently chatted with Andrew Nesbitt about his project, Ecosyste.ms. Ecosyste.ms catalogs open source projects by tracking packages, dependencies, repositories, and more. With this dataset Andrew is able to incredible insights into the world of open source. We chat all about how Ecosyste.ms works and how he manages to wrangle all this data. Episode Links Andrew Ecosyste.ms Open Collective OpenSSF Issue 101 This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This episode of #OpenSourceSecurity I talk with @paulasadoorian about embedded security, but with an open source twist

It's open source all the way down. And old open source quite often. It's a really fun discussion, I learned a lot!

opensourcesecurity.io/2025/202

Open Source Security · Embedded Security with Paul AsadoorianRecently, I had the pleasure of chatting with Paul Asadoorian, Principal Security Researcher at Eclypsium and the host of the legendary Paul’s Security Weekly podcast. Our conversation dove into the often-murky waters of embedded systems and the Internet of Things (IoT), sparked by a specific vulnerability discussion on Paul’s show concerning reference code for the popular ESP32 microcontroller. Episode Links Paul Eclypsium Below the surface podcast RVAsec This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This episode of #OpenSourceSecurity I chat with Dimitri Stiliadis of @endorlabs about the tj-actions/changed-files backdoor

Endor did some great research into how many repos were affected and we cover some of the background on this attack. It's way weirder than you can imagine

opensourcesecurity.io/2025/202

Open Source Security · tj-actions with Endor Lab's Dimitri StiliadisDimitri Stiliadis, CTO from Endor Labs, discusses the recent tj-actions/changed-files supply chain attack, where a compromised GitHub Action exposed CI/CD secrets. We explore the impressive multi-stage attack vector and the broader often-overlooked vulnerabilities in our CI/CD pipelines, emphasizing the need to treat these build systems with production-level security rigor instead of ignoring them. Episode Links Dimitri’s Linkedin Endor Labs Harden-Runner detection: tj-actions/changed-files action is compromised Unit 42 tj-actions analysis This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

This episode of #OpenSourceSecurity talks to @predrag about cargo-semver-checks

it's a #Rust tool that can help you figure out if you broke #semver, it's pretty awesome

We also touch on the difficulty of detecting breaking changes, sustainable open source, and what's to come for semver checking

It's a fun chat and you'll learn a lot

opensourcesecurity.io/2025/202

Open Source Security · cargo-semver-checks with Predrag GruevskiCargo Semver Checks is a Rust tool by Predrag Gruevski that is tackling the problem of broken dependencies that cost developers time when trying to upgrade dependencies. Predrag’s work shows how automated checks can catch breaking changes before they’re released, potentially saving projects from unexpected failures and making dependency updates less painful across the entire Rust ecosystem. Episode links Predrag’s Mastodon Predrag’s Blog “We never update unless forced to” — cargo-semver-checks 2024 Year in Review cargo-semver-checks issue 5 This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Public
Josh Bressers

I spoke with @liw on #OpenSourceSecurity about two really cool projects he's working on

Ambient is a distributed CI/CD system written in Rust

@radicle is a distributed Git Forge

It's a really fun chat and I learned a lot

opensourcesecurity.io/2025/202

Open Source Security · Distributed CI and Git with Lars WirzeniusI got to chat with Lars about a new CI/CD system he’s been working on called Ambient. It sounds really cool and does some very clever things today, with even more things planned in the future. We also spend some time discussing a project he works on called Radicle, a distributed Git forge. It feels like having decentralized infrastructure might be more important than it’s ever been, for some reason.
Public
Josh Bressers

I chatted with @firstyear about FIDO authentication on #OpenSourceSecurity, especially the FIDO Metadata Service. I learned a ridiculous amount about U2F, WebAuthn, and FIDO in this conversation

opensourcesecurity.io/2025/202

Open Source Security · FIDO authentication with William BrownWhen William Brown posted a rant on Mastodon about the FIDO Metadata Service, it sounded like exactly the sort of thing I wanted to learn more about. So that’s what I did! It’s a fun conversation, William is really good at explaining insanely complicated topics in a way that’s easy to understand. This one is dense, but it’s really interesting, you’re going to learn a ton. Episode links William’s Mastodon Yubico FEITIAN Token2 This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
VegansExploreLive feeds
About