Josh Bressers

Podcaster (http://opensourcesecuritypodcast.com http://hackerhistory.com) - Blogger (http://opensourcesecurity.io) - He/Him

Public Key

npub16xtuduvtufu9w2vv5nla5yxp8lgr5g35lflv8yz7lsv4rlklpncskclwjr

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsdr97x7x97y7zh9xx2fl76zrqnl5p6yg605lkrjp00cx23lm0seugpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qc5lx87

Publishing to

relay.ditto.pub

Author Public Key

npub16xtuduvtufu9w2vv5nla5yxp8lgr5g35lflv8yz7lsv4rlklpncskclwjr

Show more details

Last Notes

2026-03-30 20:44:58 GMT

- reply

@nprofile…x58d disclosure was always the hardest part of vulnerabilities
This will probably drive the price of exploits to zero
It could end up with a wave of full disclosure drops. Or it could drive vulnerability research to zero
I bet there’s not a lot of untapped coordination energy

2026-03-22 11:25:30 GMT

- reply

@nprofile…6z3g I’ll be there also. We should totally grab a coffee

2026-03-04 13:12:32 GMT

- reply

@nprofile…6z3g @nprofile…qxkq
I suspect this is different. That case someone trying to copyright something the AI spit out, not asking if AI can violate a copyright by copying something almost verbatim
Of course I haven't looked to see if the chardet code is mostly a copy, if it's not, then 🤷

2026-03-04 12:57:46 GMT

- reply

@nprofile…6z3g @nprofile…qxkq
This will have to go through a court case to settle it probably
But if I look at your source code, then I reproduce some of your source exactly, that's a problem

2026-03-03 15:14:44 GMT

- reply

@nprofile…44dh No realistic concern
But there are plenty of pretend concerns that will get you budget :)

2026-03-03 15:04:40 GMT

- reply

@nprofile…44dh
Oh wow, this topic
I think there are so many angles here (this could make a fun podcast discussion)
So I think there's the angle of nobody talks about or publishes about what I'll call "boring stuff". Fixing SMB1 and telnet is boring
So new ideas and research get all the attention. As many old timers know 99% of these new ideas and research go absolutely nowhere
Thanks to this noise factory, there's nobody talking about the boring stuff (even though I think there should be)
So how do you get attention in this constant noise?
And even the leaders who know better will play the game because movie plot threats will get you more budget than the boring stuff will

2026-02-22 22:17:24 GMT

43 out of the 178 Docker Official Images haven't been updated in over a year. That's almost 25%
ugh

2026-02-21 23:49:09 GMT

- reply

@nprofile…4xpq @nprofile…28wh @nprofile…v6s2 Maybe like potato chips or something
If the snacks are bad nobody will invite them in :)

2026-02-21 22:49:03 GMT

- reply

@nprofile…4xpq @nprofile…28wh @nprofile…v6s2 what if the vampire has snacks?

2026-02-10 13:36:13 GMT

I keep seeing stories about LLMs finding vulnerabilities. Finding vulnerabilities was never the hard part, the hard part is coordinating the disclosure
It looks like LLMs can find vulnerabilities at an alarming pace. Humans aren't great at this sort of thing, it's hard to wade through huge codebases, but there are people who have a talent for vulnerability hunting.
This sort of reminds me of the early days of fuzzing. I remember fuzzing libraries and just giving up because they found too many things to actually handle. Eventually things got better and fuzzing became a lot harder. This will probably happen here too, but it will take years.
What about this coordinating thing?
When you find a security vulnerability, you don't open a bug and move on. You're expected to handle it differently. Even before you report it, you need at a minimum a good reproducer and explanation of the problem. It's also polite to write a patch. These steps are difficult, maybe LLMs can help, we shall see.
Then you contact a project, every project will have a slightly different way they like to have security vulnerabilities reported. You present your evidence and see what happens. It's very common for some discussion to ensue and patch ideas to evolve. This can take days or even weeks. Per vulnerability.
So when you hear about some service finding hundreds of vulnerabilities with their super new AI security tool, that's impressive, but the actually impressive part is if they are coordinating the findings. Because the tool probably took an hour or two but the coordination is going to take 10 to 100 times that much time.

2026-02-09 15:43:55 GMT

I had a chat with Frank Karlitschek from @nprofile…u9pr about digital sovereignty
There's a lot of attention lately around digital sovereignty and often that conversation also includes Nextcloud. Frank tells us all about how Nextcloud works, how it can be used to free your data, and has some great insight into what decentralization already looks like and what it could look like soon
https://opensourcesecurity.io/2026/2026-02-nextcloud-frank-karlitschek/

2026-02-07 03:36:31 GMT

Does this Anthropic Red Team blog about the LLM finding vulnerabilities mean we're all doomed? I don't think so. So I wrote a blog about it
https://ai-skeptic.bress.net/blog/0012-anthropic-vulns/
The smart people will figure this out, but there will be slop along the way

2026-02-06 21:31:25 GMT

- reply

@nprofile…gu7x It's always been hard for humans to find security bugs in code, generally we had to focus on one specific area at a time
But the real challenge has always been writing and testing the patches, this is even harder than finding the vulns in many cases
We will of course see claims to "just use an LLM to write the patch", but I've not seen any evidence showing that's realistic yet (there might be something I've missed, goodness knows this space is hard to follow everything)

2026-02-03 03:17:02 GMT

- reply

@nprofile…44dh Microsoft word edits text files just fine!!!

2026-01-29 14:07:33 GMT

Is software ever done? When I started writing this I assumed the answer was yes, but by the time I finished, I'm not sure anything is ever done (not just software)
https://opensourcesecurity.io/2026/01-is-software-ever-done/
#opensource #EOL

2026-01-13 15:20:23 GMT

I wrote a blog about some thoughts I had on modern day #opensource
There used to be the Cathedral and the Bazaar, but now we have Megachurches also
If we look at many of the things that started out in the Bazaar but got big and needed infrastructure, they didn't build cathedrals, they built megachurches
Have you paid your tithe this year?
https://opensourcesecurity.io/2026/01-cathedral-megachurch-bazaar/

2026-01-12 15:30:04 GMT

This week on #OpenSourceSecurity I have a chat with @nprofile…hhq5 about @nprofile…lljd
Iocaine creates a maze of garbage to trap scraping bots. I love this idea, it has amazing chaotic good energy!
I learn all about how Iocaine works, and even got to see some dashboards showing off the size of the problem and how Iocaine handles it all.
https://opensourcesecurity.io/2026/2026-01-iocaine-algernon/

2026-01-05 14:29:47 GMT

This week on #OpenSourceSecurity I have a chat with @nprofile…x2qw about #Anubis, the tool that stops web AI scrapers
The scale of web scraping is way worse than I expected, and blocking things is also a lot harder than I expected
This is one of those conversations where I learned how little I know
https://opensourcesecurity.io/2026/2026-01-anubis-xe/

2025-12-04 02:54:41 GMT

My 2026 prediction is that making predictions is stupid and your predictions are bad and you should feel bad

2025-12-03 20:57:49 GMT

- reply

@nprofile…p7lw @nprofile…39aj
I don't think it's naive at all. It's a data point that proves there is an unfathomable amount of vulnerable react out there
I think the "well actually" security commentary likes to fall into when we can't exactly prove something is a problem
Goodness knows I've done this more than once

2025-12-03 20:08:51 GMT

- reply

@nprofile…p7lw The stats on @nprofile…39aj are pretty 🍌
https://packages.ecosyste.ms/registries/npmjs.org/packages/react
The terrifying stats
Dependent packages: 275,174
Dependent repositories: 2,830,385
Downloads: 117,286,823 last month

2025-11-24 15:58:53 GMT

#OpenSourceSecurity has a chat with @nprofile…0g0z about @nprofile…c97c security
Seth has a new whitepaper, there's a CFP open (which you should submit a paper to), and some discussion about the PSF grant situation
It's always fun to chat with Seth, I learn a ton every time!
https://opensourcesecurity.io/2025/2025-11-python-security-seth-larson/

2025-11-20 12:52:45 GMT

One company had a good earnings report so now the world economy can continue existing or another quarter

2025-10-30 13:14:26 GMT

New project idea
Scream-o-pedia
It's a clone of wikipedia, but filled with endless screaming

2025-10-08 23:59:13 GMT

- reply

@nprofile…r0kn It was missing something
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/341/258/365/409/719/original/c472ded7a447f103.jpeg

2025-10-08 23:44:08 GMT

OK open source security nerds, I need your help
I have a podcast youtube show thing called Open Source Security
https://opensourcesecurity.io/
I'm always looking for guests. Back when I changed formats in January I had a pretty large list of people sent to me as suggestions. I've made it through the list (it took me 10 months)
If you know someone (or are someone) doing open source security work I would love a suggestion. DMs are open and there are other contact things on the website
I especially like guests who are unsung heroes

2025-10-08 00:07:30 GMT

- reply

@nprofile…fle4 I'm not sure if it's facetious either :)
Chainguard is pretty big now, and Docker isn't nearly as huge as it once was
So 🤷‍♂️

2025-10-07 23:42:47 GMT

- reply

@nprofile…fle4 Chainguard might be bigger than docker now :)

2025-09-29 15:00:37 GMT

This week on #OpenSourceSecurity I chat with @nprofile…xg92 and @nprofile…0g5t about Arch Linux security. It's a great chat where we talk about all the difficulties and oddities of trying to keep a Linux distribution secure
I learned a ton, I'm sure you will too
https://opensourcesecurity.io/2025/2025-09-arch-foxboron-anthraxx/

2025-09-06 02:44:30 GMT

- reply

@nprofile…fle4 my takeaway is every large web app has at least ten vulnerabilities waiting to be found

2025-08-28 01:38:32 GMT

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting. So I wrote a blog post about it
An absolutely ridiculous amount of open source is one person projects. I have the data to prove it
https://opensourcesecurity.io/2025/08-oss-one-person/

2025-08-23 20:38:10 GMT

While thinking about a C programming problem this morning, my brain filled in
Chekhov's Footgun
I feel like there are many layers to this one

2025-08-22 21:33:41 GMT

- reply

@nprofile…fle4 Time to see if John Gilmore was right
"The Net interprets censorship as damage and routes around it"

2025-08-09 23:33:01 GMT

- reply

@nprofile…4dv2 @nprofile…5lc3 this is the security we deserve

2025-07-28 14:06:26 GMT

- reply

@nprofile…uv9k
Yeah, I get that, but there's also a difference between the current default RNG vs "this isn't the worst thing we could think of" :)

2025-07-28 12:52:11 GMT

I'm starting to think any random number generator that doesn't generate cryptographically secure values is a security vulnerability

2025-07-28 12:32:43 GMT

- reply

@nprofile…jkcn @nprofile…nfkd
I like this analogy, but I think it falls down a bit because most of the existing supermarkets are really just taking what the bazaar is giving away for free, wrapping it in plastic, and putting it in a refrigerator

2025-07-18 19:12:19 GMT

- reply

@nprofile…fle4 agreed!
They also release software updates for them regularly

2025-06-26 06:02:08 GMT

- reply

@nprofile…fle4 I’m shocked they didn’t just ask the LLM to fix the bugs ;)

2025-05-12 14:50:47 GMT

I chatted with @nprofile…sp92 about securing GitHub Actions with Zizmor
I learned a ton, and given all the recent news about GitHub Actions, everyone should be looking at Zizmor
https://opensourcesecurity.io/2025/2025-05-securing-github-actions-william-woodruff/

2025-05-05 16:21:31 GMT

This episode of #OpenSourceSecurity I talk with @nprofile…lsa5 about embedded security, but with an open source twist
It's open source all the way down. And old open source quite often. It's a really fun discussion, I learned a lot!
https://opensourcesecurity.io/2025/2025-05-embedded-security-with-paul-asadoorian/

2025-04-30 14:14:36 GMT

- reply

@nprofile…uv9k funky!

2025-04-28 00:09:56 GMT

- reply

@nprofile…0dca @nprofile…4dv2
I feel like I recall @nprofile…vklh creating a patch for the Linux Kernel that can disable ../
But it turns out, you can't really search for ../ so I'm not finding anything

2025-04-16 19:51:30 GMT

- reply

@nprofile…uv9k where is the list of members? I couldn’t find it

2025-04-16 19:33:53 GMT

Have #CVE or MITRE put out any public statements about what’s going on?

2025-04-16 14:57:37 GMT

Now that there's a bit more breathing room for this whole CVE mess, it's important to keep a few things in mind
The people who got us here by definition can't fix the problem. If they could, they would have a long time ago
There was no reason for this emergency. The people in charge knew this was coming and decided to say nothing. That's how you erode trust. We should treat anything the CVE program says with extreme caution
Beware anything that has popped up as a "solution" in the last 24 hours. These are hard problems, anyone ambulance chasing almost certainly can't create a sustainable solution
We have an opportunity to have a proper discussion now before this happens again (and it will happen again). Let's hope we don't squander this opportunity

2025-04-14 13:48:50 GMT

I had a chat with Aaron Frost from HeroDevs about #EOL and #CVE. It's a surprisingly complicated topic
If you're unsure an old version is affected, should you assume it is or isn't affected by a vulnerability?
https://opensourcesecurity.io/2025/2025-04-cve_eol_aaron_frost/

2025-04-11 15:38:55 GMT

- reply

@nprofile…nfkd @nprofile…8wcz
"Vibe Management" could be the punchline to most of my IT stories :)

2025-03-31 13:29:38 GMT

I spoke with @nprofile…2hju on #OpenSourceSecurity about two really cool projects he's working on
Ambient is a distributed CI/CD system written in Rust
@nprofile…wfjf is a distributed Git Forge
It's a really fun chat and I learned a lot
https://opensourcesecurity.io/2025/2025-03-ambient-radicle-lars-wirzenius/

2025-03-24 13:32:17 GMT

I chatted with @nprofile…xpqt about FIDO authentication on #OpenSourceSecurity, especially the FIDO Metadata Service. I learned a ridiculous amount about U2F, WebAuthn, and FIDO in this conversation
https://opensourcesecurity.io/2025/2025-03-fido_auth_william_brown/

2025-03-18 21:48:36 GMT

This #HackerHistory episode is a big different than the usual history, but no less fascinating. We talk to Thug Shells, a freestyle rapper, about hacking the english language
Thuggy will be showing off her talent at @nprofile…wdwp in a few weeks, it sounds like it's going to be incredible
https://hackerhistory.com/podcast/the-history-of-thug-shells/

2025-03-17 16:04:54 GMT

This week on #OpenSourceSecuirty I chat with @nprofile…mhl7 about how the CRA will (or won't) affect open source developers
Luis is one of those lawyers that understand the gnarly dark corners of open source, it's a great chat
https://opensourcesecurity.io/2025/2025-03-CRA_luis_villa/

2025-03-10 18:25:46 GMT

This week on #OpenSourceSecurity I chat with Brian Fox from Sonatype about open source malware
The volume of malware is continuing to grow, and we don't have amazing answers today
The first step is to understand the problem
https://opensourcesecurity.io/2025/2025-03-oss_malware_brian_fox/

2025-03-03 15:49:43 GMT

This episode of #OpenSourceSecurity talks to Kelley Misata of @nprofile…gw9v
The foundation model behind Suricata is fascinating, the conversation has a ton of lessons on how to run sustainable open source projects
https://opensourcesecurity.io/2025/2025-03-oss_foundations_kelley_misata/

2025-02-27 02:21:15 GMT

Is there a web browser that won’t try to shiv me in my sleep?
#askingforafriend

2025-02-24 15:33:34 GMT

This episode #OpenSourceSecurity talks to @nprofile…5kdd about forking open source projects
It's a lot more complicated than you think it is, and Sheogorath has some first hand experience from one of the most complicated forks I've ever seen in HedgeDoc
It's a fun chat filled with lessons
https://opensourcesecurity.io/2025/2025-02-fork_open_source_sheogorath/

2025-02-15 14:38:24 GMT

- reply

@nprofile…d2rl @nprofile…kjz2 @nprofile…h0jl I mean, that’s the first step
I worked in a paper mill while in college, and the first lesson was you bring in pizza or donuts if you want any of your machine tests to not fail

2025-02-15 14:29:24 GMT

- reply

@nprofile…d2rl @nprofile…kjz2 @nprofile…h0jl
The answer about repairing the relationship between security and ops is so good

2025-01-23 12:54:09 GMT

- reply

@nprofile…x3yv @nprofile…kxk4 CVE won, that’s why curl and Linux became CNAs, an alternate system isn’t a practical option (it’s been tried, nobody cares enough to help)
And unfortunately the criticism from curl, and everyone else, falls on deaf ears

2025-01-01 14:34:03 GMT

Now that 2025 is here, it's time to wind down the #osspodcast
It was a fun run, but it was time to be done.
I have a new project I'm calling "Open Source Security" (the domain is too good to not do something with it)
I want to chat with people securing the use and creating of open source. I explain a lot more in the blog post (which also has audio)
If you're one of these people, let me know! There are a lot of lessons for us all, and the people doing the best work aren't being listened to
https://opensourcesecurity.io/posts/2025-01-the_future_of_open_source_security/

2024-12-17 22:21:48 GMT

- reply

@nprofile…kxk4 @nprofile…ydm9 But think of all the time you'll save NVD by setting all your CVSS scores to a 10 :)

2024-12-06 02:37:25 GMT

I'm looking for a new hoodie (suggestions welcome)
I have a few requirements. It has to be black and it has to be zip up
Bonus points for hacker, open source, or privacy focus
I'm currently leaning towards this from @nprofile…9nj5
https://shop.eff.org/products/stay-golden-hooded-sweatshirt?variant=42581380694195

2024-11-26 20:59:48 GMT

- reply

@nprofile…fle4 @nprofile…7mte all the 2024 CVE growth has been Wordpress plugin bug bounty sites (like wordfence) and the Linux kernel

2024-04-29 13:35:58 GMT

While #xz has been a pretty popular topic lately, I just learned of a very similar attack that happened against the MinecraftOnline server in 2022/2023
The Gradle folks have a nice writeup
https://blog.gradle.org/wrapper-attack-report
I did some digging, and found the timeline
2022-07 the compromised plugin was built
2022-09 compromised plugin deployed
2023-01-09 compromise detected
I haven't figured out when the attacker joined the project yet, but clearly they had some level of trust and authority

2024-03-14 11:47:43 GMT

Has anyone tried telling developers to stop writing insecure code?
It worked for phishing

2023-12-19 00:00:27 GMT

- reply

@npub1t2c…d0pp I don’t think I would say it’s working as designed. It’s a negative for my productivity quite often because the data is almost always wrong or incomplete, and it can’t be updated
If it was simply pointers to somewhere competent, that would be lovely

2023-12-18 22:14:27 GMT

I was in a meeting today and I realized something profound
We are currently in a post #CVE world
That probably don’t make sense to a lot of people, and I need to think about it more
But here’s the basics of it
The CVE data is so comically bad, nobody actually doing #vulnerability work can use it. The ID is all we use. We have to look in other databases and collect or own facts
Automated tools rely on sources like #GitHub, #GitLab, and #OSV. Other than the ID, CVE doesn’t really matter anymore

2023-11-22 14:46:08 GMT

- reply

@npub1ysu…2jyl @npub1sc5…4hj4
I've yet to find minizip in any zlib packages (I'm trying to find it)
But even if it was there, you can make the argue this affects zlib, which is technically correct
But zlib is special, it's in literally every computing device on the planet
This is going to waste literally millions of dollars with people either patching to get rid of the vulnerability absolutists, or justifying why it's not a problem over and over again
Rigidly following rules and policy without exception either means your policy is terrible, or you don't understand what's going on (or both)
Additionally, this shouldn't have a critical severity. So even if your broken policy makes you keep the data in the system, at least mark the severity appropriately

2023-11-22 01:06:28 GMT

A lot of folks are going to have a bad time with this
https://nvd.nist.gov/vuln/detail/CVE-2023-45853
It’s a critical #CVE in zlib
Except it’s not critical
And doesn’t affect zlib
The whole CVE system is too broken to fix

2023-07-03 13:37:04 GMT

- reply

@npub1t2c…d0pp @npub13t5…qflp
YAS!