Josh Bressers

I had the joy to chat with @bagder@mastodon.social and @icing@chaos.social about #curl security things We discussed the Summer of Bliss, the influx of LLM vulnerability reports. The stress of dealing with these things, and how much effort all this security work has become They are both amazing people who have a ton of knowledge and experience to share https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel/ #OpenSourceSecurity #security #vulnerability

I wrote a blog post You don't have a supply chain, you have a supply soup This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is https://opensourcesecurity.io/2026/07-supply-soup/

@grumpygamer@mastodon.gamedev.place @Viss@mastodon.social I don’t understand how this isn’t just the status quo If you tried to claim something was the fault of autocorrect everyone would call you an idiot And they would be right

@gregkh @wdormann @Viss This post got into my head. I think you're right, the days of coordination are over So I wrote it down https://opensourcesecurity.io/2026/05-vulnerability-economics/

@andrewnez@mastodon.social How nice of them to let you know

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve https://opensourcesecurity.io/2026/2026-07-rfmf-lori-niko/ #OpenSourceSecurity #rust #RustFoundation

I had the pleasure to chat with @allanfriedman@infosec.exchange about Bill of Materials things on #OpenSourceSecurity We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe https://opensourcesecurity.io/2026/2026-06-allan-omnibom/

@andrewnez@mastodon.social this is a work of art Well done

@mttaggart@infosec.exchange 5.6 million crimony

@andrewnez@mastodon.social The number of people who understand this is an extremely small number My poster child for this is https://github.com/ossf/tac/issues/101 It's filled with opinions that don't change even when shown the data. Those are the same people that then built scorecard

On this episode of @CypherCon@infosec.exchange #HackerHistory I talk to Michael Lenz It's a great story about starting out with what we now call retro computers, building a SOC and SIEM before those were really things, and eventually putting focus into Burbsec community meetups https://hackerhistory.com/podcast/the-history-of-michael-lenz/

I miss the days when my spellchecker just worked

@andrewnez@mastodon.social We can hope you've ruined the day for some well funded security company totally not illegally scraping your data :)

@andrewnez@mastodon.social @Di4na@hachyderm.io @Rairii@labyrinth.zone did someone finally rewrite curl in a weekend?

@mattblaze@federate.social @robpike@hachyderm.io hey now. It’s TWO resistors!

@andrewnez@mastodon.social That's all your satire posts :)

@wdormann@infosec.exchange I wonder if it will get actual 0days or just be a slopfest

@wdormann@infosec.exchange Deer are assholes So are squirrels

@gregkh @deftpunk @wdormann @Viss I do think signaling intent to publish a website and make noise falls under a proper disclosure plan

@jacques@mastodon.chester.id.au indeed

@icing@chaos.social Sadly this is probably correct

@ancoghlan@mastodon.social I'm not opposed to a company employing people at a given project to get some advanced notice The devil is in the details, but I think in many cases it could work

@gregkh @deftpunk @wdormann @Viss You said this wasn't reported to the kernel security team From where I sit (and I'm not in the middle of this) it seems like if you plan to make a website and give something a name, tell the securiy team If you're OK with the current process though I shall trust you on this, you're the expert, I'm just the peanut gallery

@simplenomad@rigor-mortis.nmrc.org I’ve done several things like this and requested passing the EFF. The taxes weren’t going to be worth it

@ryan@m29.us When I chatted with @cadey@pony.social about Anubis, they called it a "waifuectomy", which is the best name for anything ever https://opensourcesecurity.io/2026/2026-01-anubis-xe/

@andrewnez@mastodon.social @Viss@mastodon.social Poe's Law FTW!!!

@Le_suisse@social.gerbet.me @ariadne@social.treehouse.systems @gregkh@social.kernel.org @wdormann@infosec.exchange @Viss@mastodon.social @andrewnez@mastodon.social @Di4na@hachyderm.io Yes! The #GCVE folks are really on the ball about all this I would be willing to bet a milkshake they will be one of the more authoritative sources in the future

@ra6bit@infosec.exchange @ariadne@social.treehouse.systems @gregkh@social.kernel.org @wdormann@infosec.exchange @Viss@mastodon.social @andrewnez@mastodon.social @Di4na@hachyderm.io Every single time an open source database has been tried it has failed spectacularly. For whatever reason the consumers of that data take and give nothing back then the project dies

@andrewnez@mastodon.social @mainec@fromm.social you know it’s all of them :)

@ra6bit@infosec.exchange @ariadne@social.treehouse.systems @gregkh@social.kernel.org @wdormann@infosec.exchange @Viss@mastodon.social @andrewnez@mastodon.social @Di4na@hachyderm.io It's a very valid question that gets asked quite a bit It *seems* like it's something should work. But sadly it doesn't

@siddhesh_p@mastodon.social @gregkh@social.kernel.org @wdormann@infosec.exchange @Viss@mastodon.social Every project is really its own ecosystem I think glibc does a really good job with CVEs But I suspect if you go from 12 a year to 12 a month your process will have to change It's possible you would adopt the "give it a CVE and move on" approach, or because there is so much attention from the distros you could get some extra help to deal with the volume

@Di4na@hachyderm.io @gregkh@social.kernel.org @wdormann@infosec.exchange @corsac@mastodon.social @Viss@mastodon.social Yeah, this Which then goes back to your comments about our tooling being horrid and makes updates slow and painful

@wdormann @gregkh @deftpunk @Viss Ugh, I misread your 14 as a 4 it seems 14 is still pretty good for most things, I won't argue about that

@ariadne@social.treehouse.systems Ahhh, I didn't know it could already do PURLs, very nice! Adding CPE certainly wouldn't hurt. and there are things CPE can identify PURL can't I still hate them though :)

I had a chat with @joshcorman@infosec.exchange about securing critical infrastructure on #OSSPodcast Josh is one of the best in the industry on this topic. He has a ton of interesting (and sometimes scary) things to say about it all https://opensourcesecurity.io/2026/2026-07-critical-infrastructure-josh-corman/

I might be missing something here I'm seeing what I think is a pattern with all these vulnerability clearing houses coming out of the woodwork The common theme seems to be "give us money and we will make sure you know about embargoed vulnerabilities" It's hard to see the logical end to this is anything other than researchers just dropping 0days

@sethmlarson@mastodon.social @yossarian@infosec.exchange if AI says it’s true then it is Embrace your destiny

@christianmlong@wandering.shop Awesome, thanks!

@ariadne@social.treehouse.systems CPE sucks rocks. I would allow other identifiers like PURL also

@wdormann@infosec.exchange I suggest you buy a feral wolf, that seems like the most practical solution

@bagder@mastodon.social the reply would probably be “what are YOU willing to pay for windows support” ;)

@ariadne@social.treehouse.systems For sure, that's a obvious hand waive to start the show Until a bunch of 0days start to show up :)

@petrillic@hachyderm.io I assume that's just an empty file :)

@ariadne@social.treehouse.systems this all reeks of Thatcher’s “there is no alternative” which is code for “shut up and let me destroy society “

@andrewnez@mastodon.social I dig this and I'm glad it's a big topic Something I was thinking about during my morning bike ride after reading this, is it's sort of sideways comparison Roads and bridges were built on purpose by the people who have to take care of them Open source is more like I build a road through my back yard, and it suddenly becomes critical infrastructure because it's the only road to the new restaurant I don't think that makes it less important, but it also is a weird problem to understand and solve

@notting@mas.to This is a great idea 1) Find vulnerability 2) Bet on market for the next vulnerability to be found 3) Probably go to jail for fraud 4) Hahahahaha just kidding everything is fine

@Di4na@hachyderm.io @gregkh@social.kernel.org @deftpunk@fosstodon.org @wdormann@infosec.exchange @Viss@mastodon.social That's also a good point It's extra frustrating when there's nothing us unwashed masses can do except wait

@gregkh@social.kernel.org @deftpunk@fosstodon.org @wdormann@infosec.exchange @Viss@mastodon.social I do wonder sometimes how many of those CVEs you file could be a privilege escalation with a proper reproducer I'm sure it's not zero

@adamshostack@infosec.exchange that’s just the sort of thing the AI would say!