2026-04-03T04:31:29Z https://yabu.me Josh Bressers https://yabu.me/npub16g6cmy3pla8nq6sapkm650wdn6szn988u87yzxs62jz6ljy50sjq5xs9jn https://media.infosec.exchange/infosec.exchange/accounts/avatars/000/007/792/original/49e71d2fbf1754d0.jpg https://media.infosec.exchange/infosec.exchange/accounts/avatars/000/007/792/original/49e71d2fbf1754d0.jpg https://yabu.me/nevent1qqsw0hdsf44kw4yzz47l5225e9zw2uqg7dd4txa7cr5k9wcsptwmh4szyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg3xnx67 It&#39;s the movie Ground Day<br/><br/>Except with a penguin 2026-05-07T21:31:37Z https://yabu.me/nevent1qqszl2g7gjpeh5xs2whtpwl66ja0v2mjpnvrdjf483sj98sjgu2zquczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgeeu5d8 In reply to <a href='/nevent1qqsvqja6ecf0unau3qr6qchpp6zgympcfjjugwxmvnlpfqz28cv37usx6tc83'>nevent1q…tc83</a><br/>_________________________<br/><br/>This post got into my head. I think you&#39;re right, the days of coordination are over<br/><br/>So I wrote it down<br/><a href="https://opensourcesecurity.io/2026/05-vulnerability-economics/">https://opensourcesecurity.io/2026/05-vulnerability-economics/</a> 2026-05-03T00:58:51Z https://yabu.me/nevent1qqsfxzka0y7swfnrlxgcx4xst7ujuley304hh6xwcqeavu3gskwv62gzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg9d3urz In reply to <a href='/nevent1qqs24pxnzy4xga3s99l0nvhk2sgctde8s9llpelmlszs0ahxld4pljq9h8dx5'>nevent1q…8dx5</a><br/>_________________________<br/><br/>every AI vulnerability company wants to find something juicy, and have no idea how to coordinate the findings 2026-05-01T01:43:00Z https://yabu.me/nevent1qqs8nzspq9d736v6jvnhfe7gj0tek6a6dfeal5del6rf3h90egyauhszyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg5fyxl4 Remember Linus&#39;s Law? While it was never really true, there are now A LOT of people looking for vulnerabilities with LLMs, and they&#39;re finding vulnerabilities EVERYWHERE<br/><br/>While Linus&#39;s Law was clearly nonsense, this is creating an increase in vulnerabilities the world is completely unprepared to deal with<br/><br/>What happens if we have a million CVEs every year?<br/><br/><a href="https://opensourcesecurity.io/2026/04-linus-law-vulns/">https://opensourcesecurity.io/2026/04-linus-law-vulns/</a> 2026-04-29T12:27:39Z https://yabu.me/nevent1qqs286zmmxwpqefr6zsgxjnt0xuyzw4aeznhmsdxpphwzq4tvleuetqzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zga2pe20 I wrote a blog post<br/><br/>Open source was never about trust<br/><br/><a href="https://opensourcesecurity.io/2026/04-never-about-trust/">https://opensourcesecurity.io/2026/04-never-about-trust/</a><br/><br/>There&#39;s been a lot of really crazy events happening around open source for the last few months. But it&#39;s probably all going to be OK 2026-04-11T16:02:04Z https://yabu.me/nevent1qqsfculm348w02c4v5n567rquma8xh2cy0uanak6qz0wcdyakczu0wqzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgt807x8 Looks like all the cybersecurity stocks have recovered since the &#34;Claude is going to destroy every security company ever&#34; news<br/><br/>Feels like an investing strategy :) 2026-03-05T15:52:34Z https://yabu.me/nevent1qqsgqyu9jgm67e8el268n8d2dyxplaptqndxpt67arju9ljvjls3pkczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgam989l I had a chat with Frank Karlitschek from <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1rk6czmpvny876kqvc4aqseuku3zmnxlphyxs2940g6u59te5m2yq57hv4q" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Nextcloud 📱☁️💻</span> (<span class="italic">npub1rk6…hv4q</span>)</a></span> about digital sovereignty<br/><br/>There&#39;s a lot of attention lately around digital sovereignty and often that conversation also includes Nextcloud. Frank tells us all about how Nextcloud works, how it can be used to free your data, and has some great insight into what decentralization already looks like and what it could look like soon<br/><br/><a href="https://opensourcesecurity.io/2026/2026-02-nextcloud-frank-karlitschek/">https://opensourcesecurity.io/2026/2026-02-nextcloud-frank-karlitschek/</a> 2026-02-09T15:43:55Z https://yabu.me/nevent1qqszwxpqmlqmn2e69jp5f4prlveh6x0awx4uteut88xrqrs2tchnreczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg4afgke In reply to <a href='/nevent1qqst2ftzr76da3x39sam6z2sq96j9x86pskn4uk8r2hk0lnw9paxefc9zsnu0'>nevent1q…snu0</a><br/>_________________________<br/><br/>It&#39;s always been hard for humans to find security bugs in code, generally we had to focus on one specific area at a time<br/><br/>But the real challenge has always been writing and testing the patches, this is even harder than finding the vulns in many cases<br/><br/>We will of course see claims to &#34;just use an LLM to write the patch&#34;, but I&#39;ve not seen any evidence showing that&#39;s realistic yet (there might be something I&#39;ve missed, goodness knows this space is hard to follow everything) 2026-02-06T21:31:25Z https://yabu.me/nevent1qqs9m22rtkeywjyc63flyhqv2he4dy9m3njk8c9ntfmtjx5ay9en2fszyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg2rta6h In reply to <a href='/nevent1qqszywkf5f7krul0gezhlxhjfpt7399vfa4wngx34ve5y542hh7vmws4s9m48'>nevent1q…9m48</a><br/>_________________________<br/><br/>Thanks! 2026-01-12T15:32:31Z https://yabu.me/nevent1qqsy02y7w7d6222vsxfsaav85jyrjchgg7arznv6nl3jlul7ps0kexgzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg9937lf This week on #OpenSourceSecurity I have a chat with [@algernon](<a href="https://come-from.mad-scientist.club/@algernon">https://come-from.mad-scientist.club/@algernon</a> ) about [@iocaine](<a href="https://come-from.mad-scientist.club/@iocaine">https://come-from.mad-scientist.club/@iocaine</a> ) <br/><br/>Iocaine creates a maze of garbage to trap scraping bots. I love this idea, it has amazing chaotic good energy!<br/><br/>I learn all about how Iocaine works, and even got to see some dashboards showing off the size of the problem and how Iocaine handles it all.<br/><br/><a href="https://opensourcesecurity.io/2026/2026-01-iocaine-algernon/">https://opensourcesecurity.io/2026/2026-01-iocaine-algernon/</a> 2026-01-12T15:30:04Z https://yabu.me/nevent1qqsfvustnsf9wyt8ffgcc4gmurzunrtc9ydr99y7zdnfrykk6v59egczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg8w60pn This week on #OpenSourceSecurity I have a chat with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub17mj525xqpm2c7urrkytdpvpv37thhnfq2e575s054svh69su9z2qcl0mhx" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Xe :verified:</span> (<span class="italic">npub17mj…0mhx</span>)</a></span> about #Anubis, the tool that stops web AI scrapers<br/><br/>The scale of web scraping is way worse than I expected, and blocking things is also a lot harder than I expected<br/><br/>This is one of those conversations where I learned how little I know<br/><br/><a href="https://opensourcesecurity.io/2026/2026-01-anubis-xe/">https://opensourcesecurity.io/2026/2026-01-anubis-xe/</a> 2026-01-05T14:29:47Z https://yabu.me/nevent1qqs8spmxnazqxgcrdm4372rvp2qfv72fzr46waefnumjnr36kz8688czyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zguvrv2q #OpenSourceSecurity has a chat with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1klc09gu7vzsv5cz2dg97rq3ahgjldp653999sxs5qmd2pu6eat5szrsud3" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Seth Larson</span> (<span class="italic">npub1klc…sud3</span>)</a></span> about <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1vv848aca8vpv9lt2l2tj6wwehw7drwrs2e3ev9693rwz02jh448qcc6fhk" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Python Software Foundation</span> (<span class="italic">npub1vv8…6fhk</span>)</a></span> security<br/><br/>Seth has a new whitepaper, there&#39;s a CFP open (which you should submit a paper to), and some discussion about the PSF grant situation<br/><br/>It&#39;s always fun to chat with Seth, I learn a ton every time!<br/><br/><a href="https://opensourcesecurity.io/2025/2025-11-python-security-seth-larson/">https://opensourcesecurity.io/2025/2025-11-python-security-seth-larson/</a> 2025-11-24T15:58:53Z https://yabu.me/nevent1qqs0jdrrm7nhv64gzggv03t48eqe5ls5y7cwj4a4hjcl8xjzre495fqzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg9q9yr0 I started using <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1zq54veajsqqdzcdprz3j8var8j6akpsqnhka2w9wd9gv879twx9sc6dlp2" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Kagi HQ</span> (<span class="italic">npub1zq5…dlp2</span>)</a></span> as my search engine<br/><br/>The biggest surprise has been how jarring seeing a search page that isn&#39;t full of shit<br/><br/>I didn&#39;t realize my brain has come to expect a page of garbage when I search for things, and it doesn&#39;t know what to do now 2025-11-04T15:43:43Z https://yabu.me/nevent1qqsymp4lnxdespgh9duphypep8wylfpggq2k9lylyys2mnl0zymf9yqzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgjcxtny This week on #OpenSourceSecurity I talk to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1uy3szhxu5ee9dmhlqysh9jesrdd9d7jv67chmfzclqsh25kyywuqcpkphj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Otto</span> (<span class="italic">npub1uy3…kphj</span>)</a></span> about his blog post about detecting an attack like xz in Debian<br/><br/>It&#39;s a fascinating conversation about a very complicated topic<br/><br/>There are things that could be detected, but this one would have been very very difficult<br/><br/><a href="https://opensourcesecurity.io/2025/2025-11-xz-debian-otto/">https://opensourcesecurity.io/2025/2025-11-xz-debian-otto/</a> 2025-11-03T15:11:58Z https://yabu.me/nevent1qqsd8zsezl2lnpzsqx8aynpcmpml2exhwtx7ggemhphp7pam6u9692gzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgtyrvaz New project idea<br/><br/>Scream-o-pedia<br/><br/>It&#39;s a clone of wikipedia, but filled with endless screaming 2025-10-30T13:14:26Z https://yabu.me/nevent1qqswk7860rnxefya6ayg5sughcs4gl6xwamw5wnx336666z42mtalcgzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgft8dsy OK open source security nerds, I need your help<br/><br/>I have a podcast youtube show thing called Open Source Security<br/><br/><a href="https://opensourcesecurity.io/">https://opensourcesecurity.io/</a><br/><br/>I&#39;m always looking for guests. Back when I changed formats in January I had a pretty large list of people sent to me as suggestions. I&#39;ve made it through the list (it took me 10 months)<br/><br/>If you know someone (or are someone) doing open source security work I would love a suggestion. DMs are open and there are other contact things on the website<br/><br/>I especially like guests who are unsung heroes 2025-10-08T23:44:08Z https://yabu.me/nevent1qqsx299ahf2uedgdvlsm3jgl3zpw9pyzzzj909zzrqe044pddw6pu9qzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgltljl2 The Register wrote a story about a single maintainer open source project, I think it&#39;s shameful and upsetting. So I wrote a blog post about it<br/><br/>An absolutely ridiculous amount of open source is one person projects. I have the data to prove it<br/><br/><a href="https://opensourcesecurity.io/2025/08-oss-one-person/">https://opensourcesecurity.io/2025/08-oss-one-person/</a> 2025-08-28T01:38:32Z https://yabu.me/nevent1qqsyv0zx2ughfkj5dhx5tp2mcgkydapz09gnnfqe0zc3v8fjdf07dyszyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg30wjxs <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/047/116/951/360/607/original/f08bfdd22e1784aa.jpeg"> <br/> 2025-08-18T01:16:01Z https://yabu.me/nevent1qqsf9htddu5dd0x6gcaphjat4p4uauye4mm4xs0h8mhctuq4ttsjtaczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg7djm23 In reply to <a href='/nevent1qqsfn5z6dk06tnekdnyrkqk8vlckht8gls9f8nkhw48j73nqdyayxaq40x6kt'>nevent1q…x6kt</a><br/>_________________________<br/><br/>A bunch of vulnerability nerds are collecting in a discord server to coordinate whatever will need coordinating for this<br/><br/><a href="https://discord.gg/gSCrXxMuPx">https://discord.gg/gSCrXxMuPx</a><br/><br/>All are welcome, even if it&#39;s just to lurk 2025-04-15T21:08:51Z https://yabu.me/nevent1qqsxvlx9fxd2a7waug6g8d0tu2dcgy9stlajvet07pgezmy22pc225gzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgjf3k4q In reply to <a href='/nevent1qqs0y96z3emmskkmg4tw5v8q984qmmkl7z4pyqdqu0vxg2738xtlpgge5tepn'>nevent1q…tepn</a><br/>_________________________<br/><br/>Now imagine how much value it would be if they were using AI!!!!!<br/><br/>It would be at least NaN dollars!!!!!!!! 2025-04-08T14:00:34Z https://yabu.me/nevent1qqs06m7q6qtprm9tyz2a7kj9nt5n6e80d55v90hcfwllamqqejwmksczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgkfwcyk Is there a web browser that won’t try to shiv me in my sleep?<br/><br/>#askingforafriend 2025-02-27T02:21:15Z https://yabu.me/nevent1qqsdpcwh9zktqcc799g9hs88gjwp4a5swexuchjwtlsnk3k8rxsqq0czyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg0pwcfn This episode #OpenSourceSecurity talks to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1frkedgrjevuxctmsfkh2c8f2rmfq8mjk9rlufuvr9ujrwwdcd48sva5a27" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Sheogorath</span> (<span class="italic">npub1frk…5a27</span>)</a></span> about forking open source projects<br/><br/>It&#39;s a lot more complicated than you think it is, and Sheogorath has some first hand experience from one of the most complicated forks I&#39;ve ever seen in HedgeDoc<br/><br/>It&#39;s a fun chat filled with lessons<br/><br/><a href="https://opensourcesecurity.io/2025/2025-02-fork_open_source_sheogorath/">https://opensourcesecurity.io/2025/2025-02-fork_open_source_sheogorath/</a> 2025-02-24T15:33:34Z https://yabu.me/nevent1qqs8yn0juh8kpv3ptu4jq0dq56nwnql4tjtdy577axzxm0anz02yq5qzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgnxtmka Now that 2025 is here, it&#39;s time to wind down the #osspodcast<br/><br/>It was a fun run, but it was time to be done.<br/><br/>I have a new project I&#39;m calling &#34;Open Source Security&#34; (the domain is too good to not do something with it)<br/><br/>I want to chat with people securing the use and creating of open source. I explain a lot more in the blog post (which also has audio)<br/><br/>If you&#39;re one of these people, let me know! There are a lot of lessons for us all, and the people doing the best work aren&#39;t being listened to<br/><br/><a href="https://opensourcesecurity.io/posts/2025-01-the_future_of_open_source_security/">https://opensourcesecurity.io/posts/2025-01-the_future_of_open_source_security/</a> 2025-01-01T14:34:03Z https://yabu.me/nevent1qqsffrss9ugfda5cj7qguqp45h4p5r8h2jdfwdsyt5celk73xvjy2cgzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg47dh7h Looks like #NVD has stopped enriching #CVE again. So that&#39;s neat<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/470/838/253/287/674/original/1ef64d2e900d9ebd.png"> <br/> 2024-11-12T16:07:13Z https://yabu.me/nevent1qqspmtpqwz8tvxwpxg3rwagvplsq9cdzhwzslk3dyqf8adqa2umf3vczyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgufl2vr In reply to <a href='/nevent1qqsfaz02clm5ka36kkch9frgqzumv043fz8c7vlu865nkq6ae3594uqluxcew'>nevent1q…xcew</a><br/>_________________________<br/><br/>Hungry for McRib!!! 2024-10-15T13:18:04Z https://yabu.me/nevent1qqsg3ry8huq0p260uwl9udtygjj666us8wjl9zzrt0mk7d49gnjvdyszyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg8rrfwy I wrote a blog post about the #SBOM complaining that seems to pop up every few months<br/><br/><a href="https://opensourcesecurity.io/2024/10/15/the-useful-uselessness-of-sboms/">https://opensourcesecurity.io/2024/10/15/the-useful-uselessness-of-sboms/</a><br/><br/>SBOMs are used all over the place, they&#39;re just not always called SBOMs 2024-10-15T12:51:21Z https://yabu.me/nevent1qqs0lawp0dttqjg5qru68xptkptrqthhax37ueqq7syu4y6xynelrzqzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgd2l3td [@jwildeboer](<a href="https://social.wildeboer.net/@jwildeboer">https://social.wildeboer.net/@jwildeboer</a> ) I printed the meshtastic case you&#39;ve been showing off here, HOLY COW it&#39;s awesome. I can fit a massive battery in it that gets me over 25 hours of life, and it still fits in my pocket 2024-10-07T15:47:33Z https://yabu.me/nevent1qqsfgewre2yt6vpcauf9tp8g0rx5ce0epz3aqe8sjx5m42vnpu4le0szyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgmauhkk OK #meshtastic nerds<br/><br/>I&#39;ve been working on a Meshtastic BBS that communicates through a meshtastic node (I took the TC2-BBS code and change it ... a lot)<br/><br/><a href="https://github.com/joshbressers/meshbbs">https://github.com/joshbressers/meshbbs</a><br/><br/>The goal here is to make something that&#39;s REALLY easy to hack on (this was my complaint about TC2-BBS, it was hard to change)<br/><br/>It&#39;s still very much a prototype, but I think I&#39;m at a point where feedback and ideas would be good<br/><br/>And of course patches :) 2024-10-05T01:02:54Z https://yabu.me/nevent1qqs0rh9fxmrl4tyxyka9zd80657fugfl2h4qdauukgesp6pn5fqas0qzyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zg02sssf <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/205/269/964/261/578/original/08780f70e49b426e.png"> <br/> 2024-09-26T18:29:27Z https://yabu.me/nevent1qqsqhsge88uypq4zhxw7nd508c0887yjwcmq8unem3qn9vnhkj9z8dszyrfrtrvjy8l57vr2r5xm023aek02q2v5ulslcsg6rf2gtt7gj37zgztmjfn In reply to <a href='/nevent1qqsgxd4e2crrtgs0q645nzweskz32mrmw2kf6gpk6efwc45gg3auypgdpszc6'>nevent1q…szc6</a><br/>_________________________<br/><br/>Bambu built on top of all the open work the community. I’m glad something easy to use exists, but I think the work of the community is a very important part of the story<br/><br/>You almost certainly don’t intend to come off that way, but it reads like it 2024-09-14T12:29:17Z