More Open Source Security episodes
Published 11 May 2026
Duration: 38:01
Maintaining open source infrastructure is critical to prevent security risks from neglected projects, highlighting the need for sustainable funding, corporate collaboration beyond financial support, and systemic reforms to address coordination challenges, dependency fragility, and vulnerabilities.
Josh talks to Kat Cosgrove about a how companies should be treating open source more like their critical infrastructure than free stuff. Kat has a ton...
The podcast emphasizes the critical need for sustained maintenance of open source infrastructure, highlighting security risks that emerge when projects like Ingress NGINXsupporting 50% of cloud-native environmentsare neglected due to a lack of active maintainers or corporate support. Such oversights can leave systems vulnerable to exploits, as seen in the accumulation of unresolved vulnerabilities (CVEs) and the eventual shutdown of Ingress NGINX. The discussion underscores that many open source projects rely on voluntary contributions from individuals working in their spare time, an unsustainable model for critical infrastructure. While organizations like the CNCF provide foundational support (e.g., infrastructure, legal guidance), they do not directly fund engineering resources for individual projects, leaving sustainability challenges unaddressed. The contrast between Kubernetes successthrough widespread coordination and community engagementand other projects struggles highlights the uneven distribution of attention and resources in the open source ecosystem, with non-flashy tools often facing greater neglect.
Key themes also include the risks of single-maintainer projects, which can create fragile dependencies and potential time bombs if abandoned, as well as the psychological and cultural barriers that hinder contributions to unglamorous but vital components. The podcast critiques systemic communication failures in the security industry, where vague warnings and condescension alienate non-expert audiences, and stresses the need for audience-centric messaging that avoids overestimating or underestimating technical knowledge. Maintainer burnout and the moral burden of sustaining projects indefinitely are also flagged as significant issues, with calls for policies that prioritize contributor well-being, such as delaying project releases to prevent overwork. The discussion advocates for improved collaboration between engineers and executives to translate technical risks into business terms, while urging individual contributors to engage with open source projects without relying on employer approval.
Finally, the conversation addresses the growing challenges of trust in open source ecosystems, including heightened skepticism among maintainers due to past security incidents and the difficulty of distinguishing malicious intent from legitimate contributions. While organizations like OpenSSF and the Linux Foundation are working to address these issues, the podcast stresses that systemic changes are needed to ensure the long-term sustainability and security of open source infrastructure. It concludes by framing current challenges as growing pains in a trend toward open source becoming the norm, though legacy systems persist, and emphasizes the importance of fostering inclusive, sustainable practices to prevent future crises.
3 Aug 2026 VulnCheck's State of Exploitation Report with Patrick Garrity
"Cybersecurity vulnerabilities are being exploited faster (80-day average), AI is both a tool and target, disclosure practices are inconsistent, and better coordination, transparency, and proactive patching are critical to mitigating risks."
27 Jul 2026 Securing critical infrastructure with Josh Corman
"Cybersecurity faces escalating threats to critical infrastructure, requiring stronger OT security, IT-OT collaboration, proactive threat modeling, and resilience engineering to prevent real-world disasters."
20 Jul 2026 Abandoned open source with Josh Marpet
"Outdated vendor risk management processes, plagued by misrepresented questionnaires and slow vulnerability disclosures, demand faster, proactive security measures and greater transparency in open-source software."
13 Jul 2026 Red Hat's Project Lightwell with Mo Duffy
"Project Lightwell uses AI and open-source collaboration to detect and fix vulnerabilities missed by traditional tools, emphasizing upstream transparency, AI's role in security, and Red Hat's efforts to sustain long-term open-source security through collaboration and patch adoption."
29 Jun 2026 AIBOM, CBOM, and HBOM with Allan Friedman
The evolution of Software Bill of Materials (SBOM) beyond manufacturing into cryptographic, hardware, and AI domains faces challenges in unified integration, compliance, tooling, and dependency tracking, requiring open-source collaboration, standardized frameworks, and adaptive policies to meet industry demands in procurement and risk management.