Mostly on Mastodon - VP of Security at Anchore - Open Source Security https://opensourcesecurity.io - Hacker History http://hackerhistory.com - He/Himhttps://bsky.app/profile/josh.bressers.namehttps://bsky.app/profile/josh.bressers.name/post/3mvie4gqca22bThe first #CRA requirements started a few days ago. I chatted with Danial Thompson about what that means and what comes next Daniel has a ton of CRA knowledge, this first step isn't going to change a ton, but what's coming next will https://opensourcesecurity.io/2026/2026-09-daniel-cra/14 Sep 2026 14:47 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mvie4gqca22bhttps://bsky.app/profile/josh.bressers.name/post/3muwpbjrjx22hI had a chat with Jaya Baloo from AISLE about why they seem to be finding vulnerabilities even when the new fancy tools aren't finding anything The answer is unsurprisingly "engineering" Jaya has a ton of interesting insight, including how to work with open source projects and what's coming next https://opensourcesecurity.io/2026/2026-09-jaya-aisle/07 Sep 2026 14:19 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3muwpbjrjx22hhttps://bsky.app/profile/josh.bressers.name/post/3muezth6lbc2sI had a chat with Erik Möller from @sovereign.tech about what they're doing in the universe of funding open source Eric breaks down what they're doing, how it works, and how you can apply for funding. We even learn about some similar projects happening in the EU https://opensourcesecurity.io/2026/2026-08-erik-sta/31 Aug 2026 13:40 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3muezth6lbc2shttps://bsky.app/profile/josh.bressers.name/post/3mttenkauwc2dThis week on #OpenSourceSecurity I had a chat with @paulasadoorian.bsky.social about a tool he wrote called Fettle and a report on CVEs he wrote We love making a huge deal about individual CVEs, but most of us have to deal with advisories that clump them together https://opensourcesecurity.io/2026/2026-08-paul-fettle-cve/24 Aug 2026 13:06 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mttenkauwc2dhttps://bsky.app/profile/josh.bressers.name/post/3mtbvd5a3x22uI had a chat with Erin Schnabel and Rob Nalen about a sustainability project between @commonhaus.org and HeroDevs The idea is to bring together the EOL business model from HeroDevs and use that to help further some of the Commonhaus software catalog https://opensourcesecurity.io/2026/2026-08-commonhaus-herodevs/17 Aug 2026 14:16 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mtbvd5a3x22uhttps://bsky.app/profile/josh.bressers.name/post/3ms6qhveyn22lThis week on #OpenSourceSecurity I chat with @patrickmgarrity.bsky.social from @vulncheck.bsky.social about a report they wrote that looked at the number of actually exploited vulnerabilities The increase of CVEs is out of control, but the number of things that get exploited is flat https://opensourcesecurity.io/2026/2026-08-vulncheck-state-of-exploitation/03 Aug 2026 14:46 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3ms6qhveyn22lhttps://bsky.app/profile/josh.bressers.name/post/3mrn5cfle222uI had a chat with @joshcorman.bsky.social about securing critical infrastructure on #OSSPodcast Josh is one of the best in the industry on this topic. He has a ton of interesting (and sometimes scary) things to say about this https://opensourcesecurity.io/2026/2026-07-critical-infrastructure-josh-corman/27 Jul 2026 14:48 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mrn5cfle222uhttps://bsky.app/profile/josh.bressers.name/post/3mr3hzgetvs2fI chatted with Josh Marpet about a report his group, Value Chain Risk Institute, published showing the data behind open source dependencies It's not great, but having data that shows the problem is a big deal. There are a lot of opinions about open source and not a lot of data https://opensourcesecurity.io/2026/2026-07-VCRI-josh-marpet/20 Jul 2026 14:12 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mr3hzgetvs2fhttps://bsky.app/profile/josh.bressers.name/post/3mqjvkqdplk2oI got to chat with @mairin.bsky.social about Red Hat's Project Lightwell on #OpenSourceSecurity It's going to be interesting to figure out how everyone will start interacting with open source projects. This is something Red Hat is pretty good at already https://opensourcesecurity.io/2026/2026-07-lightwell-mo-duffy/13 Jul 2026 14:26 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mqjvkqdplk2ohttps://bsky.app/profile/josh.bressers.name/post/3mpycscxums25I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve #OpenSourceSecurity #rust #RustFoundation https://opensourcesecurity.io/2026/2026-07-rfmf-lori-niko/06 Jul 2026 14:35 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mpycscxums25https://bsky.app/profile/josh.bressers.name/post/3mpgsm32hbs2vI had the pleasure to chat with @allanfriedman.bsky.social about Bill of Materials things on #OpenSourceSecurity We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe https://opensourcesecurity.io/2026/2026-06-allan-omnibom/29 Jun 2026 15:30 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mpgsm32hbs2vhttps://bsky.app/profile/josh.bressers.name/post/3mov34lms4226I had a chat with Jordi Boggiano from Packagist about a heap of security features they recently added and adding in the future The security of the public package repositories is a hot topic right now, Packagist is doing some really interesting things to improve their security https://opensourcesecurity.io/2026/2026-06-packagist-security-jordi/22 Jun 2026 14:15 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mov34lms4226https://bsky.app/profile/josh.bressers.name/post/3modjt77jec26I had a chat on #OpenSourceSecurity with Mike Milinkovich and Thabang Mashologu from @eclipse.org about their new managed Open VSX registry The Eclipse Foundation has a plan that seems pretty sensible to keep the Open VSX registry around for a long time https://opensourcesecurity.io/2026/2026-06-openvsx-mike-thabang/15 Jun 2026 14:50 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3modjt77jec26https://bsky.app/profile/josh.bressers.name/post/3mnru3k2fus2mI had a chat with @francoisproulx.bsky.social about CI/CD security and a tool he built to red team your own pipelines. Holy cow this is a wild topic right now. I chatted with François a bit over a year ago before CI/CD lit on fire, his warnings were very apt https://opensourcesecurity.io/2026/2026-06-fran%C3%A7ois-smoked-meat/08 Jun 2026 14:06 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mnru3k2fus2mhttps://bsky.app/profile/josh.bressers.name/post/3mlldvfj2zs2eI had a chat on #OpenSourceSecurity with Kat Cosgrove about open source being critical infrastructure Kat has a ton of experience in the world of Kubernetes and had some really interesting things to tell us about both successful projects as well as having to shut down projects https://opensourcesecurity.io/2026/2026-05-open-source-infrastructure-kat/11 May 2026 13:09 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mlldvfj2zs2ehttps://bsky.app/profile/josh.bressers.name/post/3mkzxxeld5s2kThe the wrap up with David Bernstein around how to test a disaster recovery / emergency response plan I'm pretty excited to get these out, it feels like this topic is more relevant than it's ever been and David does a nice job explaining it all https://opensourcesecurity.io/2026/2026-05-testing-the-plan-david-bernstein/04 May 2026 15:21 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mkzxxeld5s2khttps://bsky.app/profile/josh.bressers.name/post/3mkic4dbua22sI had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems https://opensourcesecurity.io/2026/2026-04-open-source-pledge-vlad/27 Apr 2026 14:34 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mkic4dbua22shttps://bsky.app/profile/josh.bressers.name/post/3mjws2kzzwk2wI had chat with David Bernstein about creating a disaster recovery plan on #OpenSourceSecurity With all the events unfolding almost every day lately, there's never been a better time to put a plan like this together. In a few weeks David will tell us how to test such a plan once we create it https://opensourcesecurity.io/2026/2026-04-disaster-planning-david-bernstein/20 Apr 2026 15:32 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mjws2kzzwk2whttps://bsky.app/profile/josh.bressers.name/post/3mjmproyi222dA new #HackerHistory is out! This time we hear the story of Pyr0 Pyr0 tells us about a new upcoming conference all about hacker history, NaClCON Then we hear about a lot of awesome hacker history It's a great story! https://hackerhistory.com/podcast/the-history-of-pyr0/16 Apr 2026 15:24 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mjmproyi222dhttps://bsky.app/profile/josh.bressers.name/post/3mjezw62pns22I had a chat with Paul McCarty about his project @opensourcemalware.bsky.social Paul has a ton of great insight into what's happening with the massive influx of malware into our open source ecosystems https://opensourcesecurity.io/2026/2026-04-open-source-malware-paul-mccarty/13 Apr 2026 14:05 +0000at://did:plc:rogdgdlystxgcyh3pg6uswtr/app.bsky.feed.post/3mjezw62pns22