Josh Bressers

VP of Security at Anchore - Podcaster (http://opensourcesecuritypodcast.com http://hackerhistory.com) - Blogger (http://opensourcesecurity.io) - He/Him

Podcast: https://opensourcesecurity.io/
Web: https://bress.net
Cookies?: Yes please
TTY: 1
Signal: joshbressers.01

Public Key

npub16g6cmy3pla8nq6sapkm650wdn6szn988u87yzxs62jz6ljy50sjq5xs9jn

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsdydvdjgsl7nesdgwsmda28hxeagpfjnn7rlzprgd9fpd0ez28cfqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsfl6kea

Publishing to

relay.primal.net

nos.lol

relay.damus.io

Author Public Key

npub16g6cmy3pla8nq6sapkm650wdn6szn988u87yzxs62jz6ljy50sjq5xs9jn

Show more details

Last Notes

2026-07-30 14:42:28 UTC

I wrote a blog post
You don't have a supply chain, you have a supply soup
This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is
https://opensourcesecurity.io/2026/07-supply-soup/

2026-06-24 16:40:07 UTC

On this episode of @npub1czd…krzv #HackerHistory I talk to Michael Lenz
It's a great story about starting out with what we now call retro computers, building a SOC and SIEM before those were really things, and eventually putting focus into Burbsec community meetups
https://hackerhistory.com/podcast/the-history-of-michael-lenz/

2026-05-18 15:34:55 UTC

I had a chat with @npub158w…p2m9 about @npub1mtr…trt0 on #OpenSourceSecurity
We cover how it works, the security angles for running an app store, and talk about some of the changes that are coming for Android that will make F-Droid's job a lot harder
I learned a ton from Hans, it's a great discussion
https://opensourcesecurity.io/2026/2026-05-fdroid-hans-steiner/

2026-05-07 21:31:37 UTC

It's the movie Ground Day
Except with a penguin

2026-05-03 00:58:51 UTC

- reply

This post got into my head. I think you're right, the days of coordination are over
So I wrote it down
https://opensourcesecurity.io/2026/05-vulnerability-economics/

2026-05-01 01:43:00 UTC

- reply

every AI vulnerability company wants to find something juicy, and have no idea how to coordinate the findings

2026-04-29 12:27:39 UTC

Remember Linus's Law? While it was never really true, there are now A LOT of people looking for vulnerabilities with LLMs, and they're finding vulnerabilities EVERYWHERE
While Linus's Law was clearly nonsense, this is creating an increase in vulnerabilities the world is completely unprepared to deal with
What happens if we have a million CVEs every year?
https://opensourcesecurity.io/2026/04-linus-law-vulns/

2026-04-11 16:02:04 UTC

I wrote a blog post
Open source was never about trust
https://opensourcesecurity.io/2026/04-never-about-trust/
There's been a lot of really crazy events happening around open source for the last few months. But it's probably all going to be OK

2026-03-05 15:52:34 UTC

Looks like all the cybersecurity stocks have recovered since the "Claude is going to destroy every security company ever" news
Feels like an investing strategy :)

2026-02-09 15:43:55 UTC

I had a chat with Frank Karlitschek from @npub1rk6…hv4q about digital sovereignty
There's a lot of attention lately around digital sovereignty and often that conversation also includes Nextcloud. Frank tells us all about how Nextcloud works, how it can be used to free your data, and has some great insight into what decentralization already looks like and what it could look like soon
https://opensourcesecurity.io/2026/2026-02-nextcloud-frank-karlitschek/

2026-02-06 21:31:25 UTC

- reply

It's always been hard for humans to find security bugs in code, generally we had to focus on one specific area at a time
But the real challenge has always been writing and testing the patches, this is even harder than finding the vulns in many cases
We will of course see claims to "just use an LLM to write the patch", but I've not seen any evidence showing that's realistic yet (there might be something I've missed, goodness knows this space is hard to follow everything)

2026-01-12 15:32:31 UTC

- reply

Thanks!

2026-01-12 15:30:04 UTC

This week on #OpenSourceSecurity I have a chat with [@algernon](https://come-from.mad-scientist.club/@algernon ) about [@iocaine](https://come-from.mad-scientist.club/@iocaine )
Iocaine creates a maze of garbage to trap scraping bots. I love this idea, it has amazing chaotic good energy!
I learn all about how Iocaine works, and even got to see some dashboards showing off the size of the problem and how Iocaine handles it all.
https://opensourcesecurity.io/2026/2026-01-iocaine-algernon/

2026-01-05 14:29:47 UTC

This week on #OpenSourceSecurity I have a chat with @npub17mj…0mhx about #Anubis, the tool that stops web AI scrapers
The scale of web scraping is way worse than I expected, and blocking things is also a lot harder than I expected
This is one of those conversations where I learned how little I know
https://opensourcesecurity.io/2026/2026-01-anubis-xe/

2025-11-24 15:58:53 UTC

#OpenSourceSecurity has a chat with @npub1klc…sud3 about @npub1vv8…6fhk security
Seth has a new whitepaper, there's a CFP open (which you should submit a paper to), and some discussion about the PSF grant situation
It's always fun to chat with Seth, I learn a ton every time!
https://opensourcesecurity.io/2025/2025-11-python-security-seth-larson/

2025-11-04 15:43:43 UTC

I started using @npub1zq5…dlp2 as my search engine
The biggest surprise has been how jarring seeing a search page that isn't full of shit
I didn't realize my brain has come to expect a page of garbage when I search for things, and it doesn't know what to do now

2025-11-03 15:11:58 UTC

This week on #OpenSourceSecurity I talk to @npub1uy3…kphj about his blog post about detecting an attack like xz in Debian
It's a fascinating conversation about a very complicated topic
There are things that could be detected, but this one would have been very very difficult
https://opensourcesecurity.io/2025/2025-11-xz-debian-otto/

2025-10-30 13:14:26 UTC

New project idea
Scream-o-pedia
It's a clone of wikipedia, but filled with endless screaming

2025-10-08 23:44:08 UTC

OK open source security nerds, I need your help
I have a podcast youtube show thing called Open Source Security
https://opensourcesecurity.io/
I'm always looking for guests. Back when I changed formats in January I had a pretty large list of people sent to me as suggestions. I've made it through the list (it took me 10 months)
If you know someone (or are someone) doing open source security work I would love a suggestion. DMs are open and there are other contact things on the website
I especially like guests who are unsung heroes

2025-08-28 01:38:32 UTC

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting. So I wrote a blog post about it
An absolutely ridiculous amount of open source is one person projects. I have the data to prove it
https://opensourcesecurity.io/2025/08-oss-one-person/

2025-08-18 01:16:01 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/047/116/951/360/607/original/f08bfdd22e1784aa.jpeg

2025-04-15 21:08:51 UTC

- reply

A bunch of vulnerability nerds are collecting in a discord server to coordinate whatever will need coordinating for this
https://discord.gg/gSCrXxMuPx
All are welcome, even if it's just to lurk

2025-04-08 14:00:34 UTC

- reply

Now imagine how much value it would be if they were using AI!!!!!
It would be at least NaN dollars!!!!!!!!

2025-02-27 02:21:15 UTC

Is there a web browser that won’t try to shiv me in my sleep?
#askingforafriend

2025-02-24 15:33:34 UTC

This episode #OpenSourceSecurity talks to @npub1frk…5a27 about forking open source projects
It's a lot more complicated than you think it is, and Sheogorath has some first hand experience from one of the most complicated forks I've ever seen in HedgeDoc
It's a fun chat filled with lessons
https://opensourcesecurity.io/2025/2025-02-fork_open_source_sheogorath/

2025-01-01 14:34:03 UTC

Now that 2025 is here, it's time to wind down the #osspodcast
It was a fun run, but it was time to be done.
I have a new project I'm calling "Open Source Security" (the domain is too good to not do something with it)
I want to chat with people securing the use and creating of open source. I explain a lot more in the blog post (which also has audio)
If you're one of these people, let me know! There are a lot of lessons for us all, and the people doing the best work aren't being listened to
https://opensourcesecurity.io/posts/2025-01-the_future_of_open_source_security/

2024-11-12 16:07:13 UTC

Looks like #NVD has stopped enriching #CVE again. So that's neat
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/470/838/253/287/674/original/1ef64d2e900d9ebd.png

2024-10-15 13:18:04 UTC

- reply

Hungry for McRib!!!

2024-10-15 12:51:21 UTC

I wrote a blog post about the #SBOM complaining that seems to pop up every few months
https://opensourcesecurity.io/2024/10/15/the-useful-uselessness-of-sboms/
SBOMs are used all over the place, they're just not always called SBOMs

2024-10-07 15:47:33 UTC

[@jwildeboer](https://social.wildeboer.net/@jwildeboer ) I printed the meshtastic case you've been showing off here, HOLY COW it's awesome. I can fit a massive battery in it that gets me over 25 hours of life, and it still fits in my pocket

2024-10-05 01:02:54 UTC

OK #meshtastic nerds
I've been working on a Meshtastic BBS that communicates through a meshtastic node (I took the TC2-BBS code and change it ... a lot)
https://github.com/joshbressers/meshbbs
The goal here is to make something that's REALLY easy to hack on (this was my complaint about TC2-BBS, it was hard to change)
It's still very much a prototype, but I think I'm at a point where feedback and ideas would be good
And of course patches :)

2024-09-26 18:29:27 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/205/269/964/261/578/original/08780f70e49b426e.png

2024-09-14 12:29:17 UTC

- reply

Bambu built on top of all the open work the community. I’m glad something easy to use exists, but I think the work of the community is a very important part of the story
You almost certainly don’t intend to come off that way, but it reads like it