Search a title or topic

Over 20 million podcasts, powered by 

Player FM logo

Sbom Podcasts

show episodes
 
Sushi Bytes is an unapologetically AI-generated podcast brought to you by Shinobi, FossID’s vigilant Software Composition Analysis ninja. In each bite-sized episode, Shinobi breaks down the evolving world of software supply chain integrity – from open-source license compliance and vulnerability disclosure to SBOM standards, IP risks, and AI-generated code implications. With a surge in regulatory scrutiny and AI adoption, the software stack is becoming harder to manage – and riskier to ignore ...
  continue reading
 
Artwork

1
One Mission Podcast

Alabama Baptist SBOM

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Monthly
 
The One Mission Podcast is hosted by Dr. Rick Lance, executive director of the Alabama Baptist State Board of Missions. In this podcast, we'll talk about issues related to church ministry.
  continue reading
 
Artwork

1
Automating Quality

SOLABS, Mandy Gervasio, Philippe Gaudreau, and Guests

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Monthly
 
Welcome to the Automating Quality show sponsored by SOLABS, with your host Mandy Gervasio, Technology and Life Sciences industry veteran. The Automating Quality podcast is designed to provide professionals in the regulated Life Sciences industry with best practice perspectives as well as employable strategies and tools relevant to current industry trends. Listeners will come to understand pressing issues in the space and hear best in class thought leadership on various topics such as Quality ...
  continue reading
 
Artwork
 
Join us at the intersection of networking and security! Whether you’re fending off ransomware attacks, securing remote workers, hunting for rogue IoT devices, or gearing up for your latest compliance audit, Packet Protector provides practical information that IT and infrastructure pros can put to work. Every episode covers the latest security headlines and then drills into essential topics to provide technical and strategic insights on wired and wireless network security, access control, clo ...
  continue reading
 
Artwork
 
Open Source Security is a media project to help showcase and educate on open source security. Our goal is to give the community a platform educate both developers and users on how open source security works. There's a lot of good work happening that doesn't get attention because there's no marketing department behind it, they don't have a developer relations team posting on LinkedIn every two hours. Let's focus on those people and teams then learn what they do and how they do it. The goal is ...
  continue reading
 
Artwork

1
Nerding Out With Viktor

Viktor Petersson

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Monthly+
 
Nerding Out With Viktor is a podcast about tech, startups, and everything in between. Hosted by Viktor, a lifelong nerd and seasoned entrepreneur, the show features real conversations with builders, hackers, and technologists. Viktor got his start in Silicon Valley with YippieMove, an early email migration tool, and later created Blotter, a top-ranked productivity app for macOS. He now runs Screenly — the first developer-friendly digital signage platform — and built its open-source sibling, ...
  continue reading
 
What's in the SOSS? features the sharpest minds in security as they dig into the challenges and opportunities that create a recipe for success in making software more secure. Get a taste of all the ingredients that make up secure open source software (SOSS) and explore the latest trends at the intersection of AI and security, vulnerability management, and threat assessments. Each episode of What's in the SOSS? is packed with valuable insight designed to foster collaboration and promote stron ...
  continue reading
 
A Federal Security & Compliance career is a very rewarding career - we get the honor and privilege of protecting some of the most guarded assets of our great country. However, it doesn’t come without a cost. We often take the brunt of the beating when it comes to the regulations that are impeding innovation. Join federal security professional Max Aulakh as he distills the challenges facing our career field, pulling back the curtain on culture, emerging technical knowledge, ATOs, CMMC and var ...
  continue reading
 
Artwork

1
Unsolicited Response

Dale Peterson: ICS Security Catalyst and S4 Conference Chair

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Monthly
 
Dale Peterson interviews the innovators in ICS / SCADA cyber security as well as the top talent in related fields. It is the podcast for those who want more information similar to what is presented at the annual S4 event each January in Miami South Beach.
  continue reading
 
Artwork

1
daBOM

DJ Schleen

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Weekly
 
Wondering what all the hype about Software Bill of Materials or SBOMs is? They’ve become a regular talking point when discussing the composition of software, and if you haven’t heard of them yet, you surely will soon. Join DJ Schleen as he interviews experts who shed light on what Software Bill of Materials are, how they are used by organizations to exchange information on software composition, and the effect they will have on consumers of software from large organizations to government agen ...
  continue reading
 
Control System Cyber Security Association International, or (CS)²AI, is the premier global non-profit workforce development organization supporting professionals of all levels charged with securing control systems. With over 34,000 members worldwide, we provide the platform for members to help members, foster meaningful peer-to-peer exchange, continue professional education, and directly support OT and ICS cyber security professional development in every way. Our founder, Derek Harp, intervi ...
  continue reading
 
UPSTREAM is a podcast for those curious about the security of the software supply chain. In each episode, host Kim Weins speaks with experts, practitioners, and thought leaders about concrete ideas and approaches to improve software supply chain security. This podcast is for everyone inside and outside the world of security. Upstream is brought to you by Anchore.
  continue reading
 
Open Source is embedded in every software application you touch today. It’s impossible to build a large scale application without it. The real question is, what’s the story behind that component, application, or framework you just downloaded? Not the specs. Not the functionality. The real story: “Who wrote the code? What is their backstory? What led them to the Open Source community?” From the Linux Foundation office in New York City, welcome to "The Untold Stories of Open Source". Each week ...
  continue reading
 
Artwork

1
DevOps Chat

DevOps.com

icon
Unsubscribe
icon
icon
Unsubscribe
icon
Monthly
 
"DevOps Chats" by Techstrong Group, the force behind industry-leading platforms like DevOps.com, Cloud Native Now, Security Boulevard, Techstrong.ai, DigitalCxO, and Techstrong.TV, is your premier destination for all things DevOps. Hosted by industry veterans Alan Shimel and Mitchell Ashley, this podcast series delves deep into the world of DevOps, bringing you the latest trends, innovative strategies, and insightful discussions that matter. Each episode of "DevOps Chat" is a journey through ...
  continue reading
 
Loading …
show series
 
The EU Cyber Resilience Act (CRA) is reshaping global expectations for software security – and putting Software Bill of Materials (SBOMs) at the center of compliance. In this episode, Shinobi and Gen break down what the CRA requires, how it compares to U.S. regulations, and what engineering and legal teams must do now to stay ahead. Whether you're …
  continue reading
 
Stephanie Domas, Canonical's Chief Security Officer, returns to What's in the SOSS to discuss critical open source challenges. She addresses the issues of third-party security patch versioning, the rise of software sovereignty, and how custom patches break SBOMs. Domas also explains why geographic code restrictions contradict open source principles…
  continue reading
 
Just what’s inside that commercial software you bought? Does it contain open-source components, NPM packages, or other third-party code? How could you find out? The answer is a Software Bill of Materials, or SBOM, a machine-readable inventory of a finished piece of software. Why should you care about SBOMs? Our guest, Natalie Somersall, is here... …
  continue reading
 
There may be misconfigurations and other problems lurking in your wireless network. From a lack of peer isolation to poor segmentation to RADIUS problems and vendor fails, these issues can make your WLAN less secure. Jennifer “JJ” Minella goes from Packet Protector co-host to guest as she discusses these issues with Drew Conry-Murray. This episode.…
  continue reading
 
From early 2022 through late 2024, a group of threat actors publicly known as APT28 exploited known vulnerabilities, such as CVE-2022-38028, to remotely and wirelessly access sensitive information from a targeted company network. This attack did not require any hardware to be placed in the vicinity of the targeted company's network as the attackers…
  continue reading
 
Jay White, a leader in the open source ecosystem at Microsoft, discusses his journey into open source, focusing on AI and machine learning. He highlights his role in the Azure office of the CTO, working on open source, security, and AI standards. White emphasizes the importance of model signing and transparency in AI development, mentioning ongoing…
  continue reading
 
Josh discusses the TARmageddon vulnerability with Alex Zenla, CTO of Edera. In this episode, we explore the discovery of the TARmageddon vulnerability. It's especially interesting because it's Rust, but also involves multiple end of life crates. Alex shares the story of how Edera managed to figure all this out (it was not simple). Hard problems are…
  continue reading
 
Web applications have always been tricky to protect. They’re meant to be accessible over the Internet, which exposes them to malicious actors, they’re designed to take end-user inputs, which can be manipulated for malicious purposes, and they often handle sensitive data. Then the rise of public cloud and microservices architectures added new layers…
  continue reading
 
In this episode Seth Larson gives us a cornucopia of topics relating to Python security. Seth discusses the Python Software Foundation's decision to reject a significant grant NSF. Diversity is a big deal to python, so this was a no brainier. We discuss the upcoming PyCon US conference, featuring a new security track that fosters collaboration betw…
  continue reading
 
In this episode of "Nerding Out with Viktor," host Viktor Petersson sits down with James Baker, Policy and Campaigns Manager at Open Rights Group, to explore the real-world impact of the UK Online Safety Act and proposed Digital ID systems. Together, they unpack how the UK's approach to digital identity is raising concerns about centralization, pri…
  continue reading
 
Welcome to Automating Quality, the life sciences–focused show that bridges the gap between automation and quality management. In this episode, our host Philippe welcomes Masha Ivankovic, President and Owner of Monbel Consultants. With more than 15 years of experience supporting pharmaceutical and biotech companies, Masha has led complex engineering…
  continue reading
 
Josh talks to Richard Hughes about the world of firmware. We cover how Richard's journey from developing the ColorHug led to the creation of the Linux Vendor Firmware Service (LVFS), changing how firmware updates are managed for nearly every Linux user. Updating firmware has always been dicey, and on Linux it used to be impossible. Richard helps us…
  continue reading
 
In this episode of Sushi Bytes, Shinobi and Gen unpack the high-stakes reality of code snippet: when small fragments of open source code make their way into proprietary applications and go undetected by traditional SCA tools. From copy-pasted Stack Overflow answers to AI-generated code functions, these sometimes-small code segments can carry seriou…
  continue reading
 
Developer experience and productivity are critical, but so is copyright and license compliance. In this episode of Sushi Bytes, Shinobi and Gen talk about the tug-of-war between productivity-centric engineering teams and risk-averse legal teams. Who will win? Tune in to hear how modern SCA tooling can align speed with safety, automate away this fri…
  continue reading
 
Not every Software Composition Analysis (SCA) tool reveals what’s really haunting your code. In this Halloween-themed episode of Sushi Bytes, Shinobi and Gen explore why comparing SCA tools is trickier than it seems—and what engineering and compliance teams should look for under the mask. From snippet detection and modified code to license clarity,…
  continue reading
 
AI-assisted coding is accelerating development, but also creating compliance headaches. In this episode of Sushi Bytes, Shinobi and Gen unpack the legal gray zones around AI-generated code: Who owns it? Is it safe to use? What happens if it’s trained on GPL-licensed data? If your team uses GitHub Copilot, ChatGPT, or Claude, there’s a good chance y…
  continue reading
 
In this episode of Sushi Bytes, Shinobi and Gen dive into the hidden risk of license drift – when the open source license declared in metadata files like package.json or README doesn’t match the actual licenses embedded in the source code. It’s a common problem with serious consequences, especially in embedded systems or M&A deals. The duo explores…
  continue reading
 
Your software has a supply chain. Your SBOM is supposed to tell you what’s inside. But what makes a Software Bill of Materials truly useful; and why is everyone suddenly asking for one? In this episode of Sushi Bytes, Shinobi unpacks what an SBOM is, why regulatory pressure is turning it from best practice to business-critical and why spinning off …
  continue reading
 
Not every vulnerability in your SBOM is a real threat. That’s where VEX comes in. In this episode of Sushi Bytes, Shinobi and Gen explore the Vulnerability Exploitability eXchange… what it is, why it matters, and how it helps teams focus on the vulnerabilities that actually matter. From cutting through alert fatigue to avoiding the growing mess of …
  continue reading
 
Welcome to Sushi Bytes – FossID’s bite-sized, AI-generated podcast hosted by Shinobi, your sharp-eyed Software Composition Analysis ninja. In this debut episode, Shinobi breaks down what “software supply chain integrity” really means… and why it’s now a board-level concern. From open source license compliance to AI-generated code and SBOMs, we expl…
  continue reading
 
Certificates are the socks of IT—everyone needs them, and you always lose track of a few. On today’s show we dive into the ACME protocol, an IETF standard to help automate how a domain owner gets a domain validation certificate from a Certificate Authority (CA). Our guest, Ed Harmoush, a former network engineer with AWS... Read more »…
  continue reading
 
Modern data analytic methods and tools—including artificial intelligence (AI) and machine learning (ML) classifiers—are revolutionizing prediction capabilities and automation through their capacity to analyze and classify data. To produce such results, these methods depend on correlations. However, an overreliance on correlations can lead to predic…
  continue reading
 
Josh chats with Charlie Eriksen, a security researcher at Aikido Security. We discuss the recent NPM supply chain attacks that affect hundreds of packages. Charlie shares his experiences dealing with recent security breaches, the challenges of maintaining trust in open source software, and the importance of proactive measures to safeguard open sour…
  continue reading
 
Did you know college students are snooping on satellite transmissions? On today’s news roundup we discuss new research in which university investigators use off-the-shelf equipment to intercept traffic from geostationary satellites and discover that a lot of it is unencrypted. We also dig into the credential hygiene lessons we can learn from a corp…
  continue reading
 
In this episode of "Nerding Out with Viktor," host Viktor Petersson sits down with Nick Selby, a security leader and advocate for practical security culture, to explore the reality behind software security compliance and why so many teams treat it as a checkbox rather than a mindset. The discussion unpacks how frameworks like SOC 2 and ISO 27001 of…
  continue reading
 
In this episode of "What's in the SOSS," CRob, Ben Cotton, and Eddie Knight discuss the Open Source Project Security Baseline. This baseline provides a common language and control catalog for software security, enabling maintainers to demonstrate their project's security posture and fostering confidence in open source projects. They explore its int…
  continue reading
 
In this episode, Josh and Otto dive into the world of Debian packaging, exploring the challenges of supply chain security and the importance of transparency in open source projects. They discuss Otto's blog post about the XZ backdoor and how it's a nearly impossible attack to detect. Otto does a great job breaking down an incredibly complex problem…
  continue reading
 
How can you ever know whether an LLM is safe to use? Even self-hosted LLM systems are vulnerable to adversarial prompts left on the internet and waiting to be found by system search engines. These attacks and others exploit the complexity of even seemingly secure AI systems. In our latest podcast from the Carnegie Mellon University Software Enginee…
  continue reading
 
CVEs, or Common Vulnerabilities and Exposures, are such a routine aspect of tech that most IT pros probably take them for granted. But like many things we take for granted, the CVE process takes some serious organizational infrastructure to function. On today’s Packet Protector, sponsored by Cisco, we talk about the organizations and processes that…
  continue reading
 
Software bills of materials or SBOMs are critical to software security and supply chain risk management. Ideally, regardless of the SBOM tool, the output should be consistent for a given piece of software. But that is not always the case. The divergence of results can undermine confidence in software quality and security. In our latest podcast from…
  continue reading
 
In this episode of "Nerding Out with Viktor," host Viktor Petersson sits down with Patrick Walker, former YouTube and Facebook executive and now founder of the conscious tech platform Uptime, to explore the quiet discipline of digital minimalism. Patrick shares his journey from building global video platforms to stepping away from Big Tech, reflect…
  continue reading
 
Model Context Protocol (MCP) is an open-source protocol that enables AI agents to connect to data, tools, workflows, and other agents both within and outside of enterprise borders. As organizations dive head-first into AI projects, MCP and other agentic protocols are being quickly adopted. And that means security and network teams need to understan…
  continue reading
 
In this episode of What’s in the SOSS, host Yesenia Yser sits down with Seth Larson, Security Developer in Residence at the Python Software Foundation, as he shares his unique perspective on open source security. From his Minneapolis base, Seth discusses his journey from urllib3 maintainer to leading security initiatives across the Python ecosystem…
  continue reading
 
In this conversation, Josh speaks with Mikael Barbero, head of security at the Eclipse Foundation. They discuss the foundation's role in enhancing the security posture of open source projects, the importance of Software Bill of Materials (SBOMs), and the various security services provided to projects. Mikael explains the challenges and strategies i…
  continue reading
 
In this episode of “What’s In The SOSS,” Yesenia interviews David A. Wheeler, the Director of Open Source Supply Chain Security at the Linux Foundation. They discuss the importance of secure software development, particularly in the context of AI and machine learning. David shares insights from his extensive experience in the field, emphasizing the…
  continue reading
 
Today we’re bringing back one of our favorite guests — Akili Akridge. He’s a former Baltimore cop who transitioned to building and leading mobile offense and defense teams for federal agencies and Fortune 100s. These days he’s a straight-talking expert on all things mobile security. We’re digging into mobile threats, why they keep CISOs up... Read …
  continue reading
 
I chat with Joshua Rogers about a blog post he wrote as well as some bugs he submitted to the curl project. Joshua explains how he went searching for some AI tools to help find security bugs, and found out they can work, if you're a competent human. We discuss the challenges of finding effective tools, the importance of human oversight in triaging …
  continue reading
 
Send us a text In this episode of the Reckless Compliance podcast, Max talks with Justin Paquette from NtelSec about a bold idea: helping small contractors achieve “CMMC in a day” by working inside a pre-secured enclave—CUI Vault—instead of overhauling their entire enterprise. Justin explains how NtelSec’s government collaboration platform SectorNe…
  continue reading
 
Application programing interfaces, more commonly known as APIs, are the engines behind the majority of internet traffic. The pervasive and public nature of APIs have increased the attack surface of the systems and applications they are used in. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), McKinley Sconie…
  continue reading
 
In this episode of What's in the SOSS, CRob sits down with John Amaral from Root.io to explore the evolving landscape of open source security and vulnerability management. They discuss how AI and LLM technologies are revolutionizing the way we approach security challenges, from the shift away from traditional "scan and triage" methodologies to an e…
  continue reading
 
Brian Fox discusses the challenges and future of open source package repository infrastructure. We discuss the complexities of managing public registries, the impact of overconsumption, and the importance of sustainable practices in the open source community. Brian tells us how organizations can reduce their footprint and contribute to a more balan…
  continue reading
 
What does the risk environment for Operational Technology (OT) look like in 2025? JJ and Drew review four recent reports on the state of OT security from Dragos, Fortinet, and others. We discuss ransomware impacts, ongoing risks of RDP traffic, directly exposed OT devices, and overall attack trends and the tools and processes that organizations... …
  continue reading
 
Artificial intelligence (AI) is a transformational technology, but it has limitations in challenging operational settings. Researchers in the AI Division of the Carnegie Mellon University Software Engineering Institute (SEI) work to deliver reliable and secure AI capabilities to warfighters in mission-critical environments. In our latest podcast, M…
  continue reading
 
Loading …
Copyright 2025 | Privacy Policy | Terms of Service | | Copyright
Listen to this show while you explore
Play