open source security

Evan Czaplicki, creator of Elm, discusses the hard parts of running an open source project: online community conflict, why its patterns arise, and a cultural history of open source. He offers ideas for more civil, productive communication.

Bryan Cantrill's talk on corporate open source anti-patterns, first given at FISL 2012 and again at the Liferay Symposium. He lays out the mistakes companies make when open sourcing code, such as announcing future open sourcing, and discusses licenses.

A dotJS 2012 conference talk by Fat (of Twitter Bootstrap fame) on what open source really means and why maintainers feel guilty about it. It covers the obligations, expectations and burnout that come with releasing popular open source software, delivered with humor.

Tim Ansell presents the SkyWater PDK, a fully open source manufacturable process development kit for a 130nm process, as the first FOSSi Dial-Up talk. He covers its role in a fully open chip design flow.

David Heinemeier Hansson's opening keynote at RailsConf 2019 argues against the expectation of payment for open source work, drawing on his experience releasing Rails. It also includes lighter asides about the industry.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Bryan Cantrill's OSCON 2015 talk on moving a proprietary product to open source, drawing on Sun's history with Solaris and illumos, licensing choices and the relicensing after Oracle's acquisition.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.

Elm creator Evan Czaplicki's 2018 Elm Europe talk on how to define success for an open source project and language community. It argues against judging projects by GitHub activity and touches on community expectations.

Lex Fridman's long podcast interview with Yann LeCun on Meta AI, open source, the limits of LLMs, AGI and the future of AI.

A one-minute demo of Safespaces, an open source 3D and VR desktop built on the Arcan project.

Marcin Jakubowski of Open Source Ecology presents his plan to open-source blueprints for 50 cheap, buildable farming tools, a "civilization starter kit". He argues that opening the means of production can enable self-sustaining lives.

A short hyperlapse of a 2019 Toyota Corolla using comma.ai's OpenPilot 0.6.3 to drive 100 miles with no intervention except for the windshield wipers.

Karen Sandler, then Executive Director of the GNOME Foundation, talks at OSCON 2011 about the risks of proprietary, closed-source software in implanted medical devices like her own pacemaker-defibrillator.

Karen Sandler's keynote at Linux.conf.au 2012 on the software running inside medical devices such as her own pacemaker-defibrillator. She discusses the difficulty of learning what code runs in life-sustaining devices and why open source matters there.

Marco Reps builds and tests an open-source 8.5 digit voltmeter based on CERN's high-precision ADC design. The video walks through assembly, soldering and measurement of the resulting instrument.

Sintel is a 15-minute animated fantasy short made by the Blender Foundation to develop and showcase Blender, funded by community donations and released under Creative Commons.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.

Poul-Henning Kamp's FOSDEM 2014 talk is a hypothetical account of how an intelligence agency such as the NSA would sabotage open source software, standards and online discussion. It covers Skype's history, OpenSSL and psyops against standards.

Donnie Berkholz of RedMonk gives a Monki Gras talk arguing that abusive, toxic contributors damage open source projects. He makes the case for removing them from communities.

Poul-Henning Kamp's FOSDEM 2014 talk presents a fictitious NSA program called ORCHESTRA, satirizing how intelligence agencies could influence startups and open source. It is a humorous but pointed look at surveillance and subverted software.

C J Silverio, former npm CTO, explains how the JavaScript package commons ended up in the hands of a for-profit company with no accountability. She discusses the cost of running a registry and what the community should do next.

Tantacrul tells the story of Audacity, the widely used free audio editor, and announces his involvement in the project. It includes an interview with the original developers and a look at the software's usability.

TED curator Chris Anderson interviews Linus Torvalds about his personality, his engineer's pragmatism, and the creation of Linux and Git. Torvalds also discusses taste in code and why he open sourced Linux.

Urs Hoelzle, Google's SVP of infrastructure, gives the 2012 Open Networking Summit keynote on how Google adopted OpenFlow and software-defined networking in its own networks. The slides are linked in the description.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Lock-picking YouTuber Bill Johnson (BosnianBill) explains how to choose a high-security lock and why, showing examples and comparing designs. It covers what makes some padlocks more pick-resistant than others.

A Wendover Productions explainer on how airport security is designed, covering screening layers, x-ray scanning, and the contrast with Israel's profiling-based approach. It walks through the logic behind why security works the way it does.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

A roughly 14-minute interview with OpenBSD founder Theo de Raadt at ruBSD 2013. He talks about making painful changes, getting real feedback, mitigation techniques compared to other OSs, and virtualization.

A HOPE XI talk on programming by voice with open source speech recognition. The speaker writes Linux systems code by voice and describes building custom voice grammars as an alternative to the keyboard for programmers with repetitive strain injuries.

Part two of a StrictlyVC interview with OpenAI CEO Sam Altman, focused on AI. He discusses regulation, commodification of AI, Google's reluctance to release its own models, and best- and worst-case futures.

Lex Fridman interviews OpenAI CEO Sam Altman about GPT-4, GPT-5, Sora, the OpenAI board saga, Elon Musk, Ilya Sutskever, power and AGI. The conversation runs nearly two hours.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Skateboarding pioneer Rodney Mullen talks about how the open skate community and its environments drive the invention of new tricks out of pure passion. He draws parallels to collaboration and open source.

Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.