This post was prompted by a discussion on the Open Source Security Foundation (OpenSSF) Slack channel that was so interesting it warranted being posted to the SIREN mailing list. But this isn't your typical vulnerability or security advisory, but rather it's about a practice that seems…
I want to talk about a recent conversation on the Open Source AI definition, but before that I want to do an acknowledgement. My position on the uptake of "AI" is that it is morally unconscionable, short-sighted, and frankly, just stupid. In a time of snowballing climate crisis…
For open-source developers, the landscape of cybersecurity regulations has been evolving rapidly, and it can be daunting to figure out what requirements to follow. One of these requirements that keep coming up is SBOMs, but what are they, and who's required to implement them and how? In this…
It's EU Parliament elections time, and I thought it would be a good chance to give a short recap on significant and recent EU digital regulations, for those wondering how the elections can impact our digital lives. If you're deep into digital policy, this probably isn&…
Updates/Edits: * Since I wrote this, I found out the names of both persons who wrote the case study and shared it on my Mastodon feed so I updated the article accordingly. * The day after this was written, the news broke about how much the federal government pays on license…
The Border Gateway Protocol is an important part of our internet infrastructure. It's essentially a big set of rules that govern how data is routed around the many networks that form the internet. If DNS is the address book of the internet, BGP is the Autobahn. For the…
I don't know how your April went, but if it was anything like mine, you would have spent an uncharacteristic amount of time talking about compression tools, "insider attacks", and build tooling. That's because on March 29th, 2024, a backdoor was discovered in the…
I attended a meeting for a newly proposed working group called SCONEPRO where some interent service providers like comcast and at&t and large video content platforms like youtube and tiktok want to work together to make the controversial practice of traffic shaping work slightly better.…