In this episode Seth Larson gives us a cornucopia of topics relating to Python security. Seth discusses the Python Software Foundation's decision to reject a significant grant NSF. Diversity is a big deal to python, so this was a no brainier. We discuss the upcoming PyCon US conference, featuring a new security track that fosters collaboration between developers and security experts. Josh is a huge fan of having a security track at developer conferences. And we close on a paper about zip and tar archives Seth wrote. It seems like we should have zip and tar security figured out by now, but we don't. Thankfully Seth is working on it.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2025/2025-11-python-security-seth-larson/
Josh chats with Lance and Anton from Caution about verifiable computing. We start out discussing all the challenges in bootstrapping software that almost nobody thinks about anymore. We then make our way into discussing the art of the possible. There are some great things happening in this space today and plenty of solutions we can use right now. There's a ton to learn and it's never been easier to trust your software.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-11-trust-lance-anton
Josh chat with Roi Nisimi about some research he's done into missing backport security fixes. Roi calls these Backport Gaps. The idea is looking for security fixes on the main branch of a project but not in a released version. This is the sort of thing that was very hard in the past, but is very easy to do now. Roi has some marvelous insights into how things used to work, how they work now, and what the future could look like. It's one of those new and complicated security problems nobody really knows how to solve.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-11-backport-gaps-roi
Josh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There's no single thing we can do here, it's all about knowing what you have every step of the way. It's easy to say, but certainly a challenge to do right. James is a ton of fun to chat with and filled with energy and knowledge.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-10-james-cloudsmith
Josh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions can affect a county and its open source. It seems sometimes like open source is a global phenomenon, but there are always country wide considerations. This is what the OpenUK is doing in the UK. The discussion is great and the things the OpenUK is dealing with will affect many of us moving forward, even if we would prefer to ignore our digital borders.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-OpenUK-amanda-brock
Josh chats with Daniel and Stefan from curl about their summer of bliss. Curl stopped taking vulnerability reports for a month and nothing much happened really. Daniel and Stefan have a really pragmatic view of all the new LLM powered vulnerability detection tools. The cost of finding a vulnerability has dropped dramatically, but the cost of fixing those bugs hasn't changed. Taking some time off is important for anyone in the middle of these reports. Daniel and Stefan have some great experience and ideas on how to make this all happen. It's great advice for anyone working on software, not just open source.
The show notes and blog post for this episode can be found at
https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel
This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.
