<p dir="auto"><a href="https://infosec.exchange/@joshbressers" rel= "nofollow">Josh</a> and <a href= "https://infosec.exchange/@kurtseifried" rel="nofollow">Kurt</a> talk about an attack against PyTorch and NPM. The PyTorch attack shows the difficulty of trying to operate a large open source project. The NPM problem is one of the difficulty in trying to backdoor open source. A lot of people are watching and it only takes one person to notice a problem and we all benefit.</p> Show Notes <ul dir="auto"> <li><a href="https://youtu.be/wwP5N44Lcd8?si=FJ0uIrDWgXLvtZlc" rel= "nofollow">Peanut Butter the dog plays Gyromite</a></li> <li><a href="https://en.wikipedia.org/wiki/The_Wizard_(1989_film)" rel="nofollow">The Wizard movie</a></li> <li><a href= "https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/" rel="nofollow">PyTorch supply chain attack</a></li> <li><a href= "https://blog.phylum.io/npm-package-found-delivering-sophisticated-rat/" rel="nofollow">npm Package Found Delivering Sophisticated RAT</a></li> <li><a href= "https://blog.aquasec.com/deceptive-deprecation-the-truth-about-npm-deprecated-packages" rel="nofollow">Deceptive Deprecation: The Truth About npm Deprecated Packages</a></li> <li><a href="https://www.youtube.com/watch?v=AbSehcT19u0" rel= "nofollow">Changing a lightbulb</a></li> <li><a href="https://www.youtube.com/watch?v=Ud9jWbXq4aQ" rel= "nofollow">Spelunking the Bitcoin Blockchain with Josh Bressers | CypherCon 4.0</a></li> <li><a href= "https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers" rel="nofollow">Operation Triangulation - What You Get When Attack iPhones of Researchers</a></li> <li><a href= "https://www.sonatype.com/state-of-the-software-supply-chain/introduction" rel="nofollow">9th Annual State of the Software Supply Chain</a></li> </ul>

Episode 414 - The exploited ecosystem of open source

Open Source Security is a media project to help showcase and educate on open source security. Our goal is to give the community a platform educate both developers and users on how open source security works.

There's a lot of good work happening that doesn't get attention because there's no marketing department behind it, they don't have a developer relations team posting on LinkedIn every two hours. Let's focus on those people and teams then learn what they do and how they do it. The goal is to hear from the people doing the work, they know what's up, they have a lot to teach us. We just have to listen.