Open Source Security

Josh chats with Lance and Anton from Caution about verifiable computing. We start out discussing all the challenges in bootstrapping software that almost nobody thinks about anymore. We then make our way into discussing the art of the possible. There are some great things happening in this space today and plenty of solutions we can use right now. There's a ton to learn and it's never been easier to trust your software.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-11-trust-lance-anton

Josh chat with Roi Nisimi about some research he's done into missing backport security fixes. Roi calls these Backport Gaps. The idea is looking for security fixes on the main branch of a project but not in a released version. This is the sort of thing that was very hard in the past, but is very easy to do now. Roi has some marvelous insights into how things used to work, how they work now, and what the future could look like. It's one of those new and complicated security problems nobody really knows how to solve.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-11-backport-gaps-roi

Josh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There's no single thing we can do here, it's all about knowing what you have every step of the way. It's easy to say, but certainly a challenge to do right. James is a ton of fun to chat with and filled with energy and knowledge.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-10-james-cloudsmith

Josh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions can affect a county and its open source. It seems sometimes like open source is a global phenomenon, but there are always country wide considerations. This is what the OpenUK is doing in the UK. The discussion is great and the things the OpenUK is dealing with will affect many of us moving forward, even if we would prefer to ignore our digital borders.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-OpenUK-amanda-brock

Josh chats with Daniel and Stefan from curl about their summer of bliss. Curl stopped taking vulnerability reports for a month and nothing much happened really. Daniel and Stefan have a really pragmatic view of all the new LLM powered vulnerability detection tools. The cost of finding a vulnerability has dropped dramatically, but the cost of fixing those bugs hasn't changed. Taking some time off is important for anyone in the middle of these reports. Daniel and Stefan have some great experience and ideas on how to make this all happen. It's great advice for anyone working on software, not just open source.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel