Open Source Security

Josh chat with Roi Nisimi about some research he's done into missing backport security fixes. Roi calls these Backport Gaps. The idea is looking for security fixes on the main branch of a project but not in a released version. This is the sort of thing that was very hard in the past, but is very easy to do now. Roi has some marvelous insights into how things used to work, how...

Josh talks to Keith Hoodlet about a research project he co-authored about the success rate of AI generated vulnerability patches. Keith has a very scientific approach to this paper and does a great job of breaking down all the data and outcomes. There isn't a lot of AI research that takes this approach, this paper is a breath of fresh air. Keith has some pretty scary details ...

Josh chats with Jeff Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There's no single thing we can do here, it's all about knowing what you have every step of the way. It's easy to sa...