In this episode, CRob talks with Mike Lieberman from Kusari about the current state of open source security. They discuss the growing burden on maintainers from the "deluge" of noisy, low-quality vulnerability reports, often generated by AI tools, and the vital role of "a human in the loop." Mike introduces Kusari's tool, Inspector, explaining how it uses codified security expertise to process data from tools like OpenSSF Scorecard and SLSA, effectively filtering out false positives and giving maintainers only high-quality, actionable reports. They also dive into the design philosophy of "don't piss off the engineers" and share a vision for the future of security tooling that focuses on dramatically better user experience and building security primitives that are "secure by design.Chapters:00:06Introduction: The Biggest Challenge in Security Tooling01:12Overwhelmed Maintainers: The Deluge of Low-Quality AI Reports04:00Introducing Kusari's Inspector: How it Filters False Positives08:40The Secret Sauce: Security Expertise and the Need for Reproducible Tests12:03Meeting Engineers Where They Are: Design Choices to Reduce Maintainer Burden18:16The Future of Open Source Security Tooling: Focusing on Better UX22:19Call to Action: The Responsibility of Large OrganizationsEpisode links:Michael Lieberman’s LinkedIn pageLearn more about Kusari InspectorGet involved with the OpenSSFSubscribe to the OpenSSF newsletterFollow the OpenSSF on LinkedIn

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related