What's in the SOSS? An OpenSSF Podcast

In this episode of What's in the SOSS’s “Big Thoughts, Open Sources,” host CRob sits down with Vincent Danen, Vice President of Product Security at Red Hat, for a deep dive into the evolving landscape of open source vulnerability disclosure. Drawing on over two decades of open source security experience, Vincent reflects on the history and critical role of the CVE program while addressing modern challenges like the rise of alternative advisory systems and the flood of AI-assisted vulnerability disclosures. The conversation explores the shifting dynamics between upstream maintainers and downstream consumers, the practical utility – and missing user experience – of SBOMs, and how emerging regulations like the EU Cyber Resilience Act impact global software supply chain security. 

Chapters
00:00 – Introduction & Open Source Origins
04:26 – The Evolution of CVE and Vulnerability Data
11:02 – Coordinated Vulnerability Disclosure in a Fast-Paced World
17:53 – AI’s Impact on Vulnerability Discovery & Response
27:20 – Realizing the Value of SBOMs and VEX
35:05 – Contextualizing Risk and Exploitability
42:55 – Regulatory Expectations and the Future of Supply Chain Security

Episode links:
Vincent Danen’s LinkedIn page
Red Hat 
CVE Program
National Vulnerability Database (NVD)
EU Cyber Resilience Act (CRA) Information
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What’s in the SOSS?, host Sally Cooper interviews Angie Jones, VP of Developer Experience at the Agentic AI Foundation (AAIF). Angie shares her career journey from software engineering and holding 27 patents at IBM to leading open source protocol and developer relations initiatives. She details the mission of the Agentic AI Foundation as a neutral home for governing open source standards and technologies such as the Model Context Protocol (MCP), Goose, Agents.md, and Google's Agent-to-Agent (A2A) protocol. The conversation explores how cross-industry collaboration addresses the reliability and security of AI agents in production, key considerations for the shift toward agentic engineering, and what attendees can expect at the upcoming AgentCon and MCPCon North America.

Chapters:
00:00 - Introduction
00:28 - Welcome Angie Jones
01:47 - Angie’s Career Journey: From IBM Patents to Open Source
06:56 - Mission of the Agentic AI Foundation & Governing Open Standards
11:47 - Preparing for the Era of Agentic Engineering
13:20 - Preview of AgentCon and MCPCon North America
17:32 - Rapid Fire Questions
18:36 - Wrap-up & OpenSSF Resources

Episode links:
Angie Jones’ LinkedIn
Angie Jones’ Blog
Agentic AI Foundation (AAIF)
Model Context Protocol (MCP)
goose: Open source AI agent
AGENTS.md
Agent2Agent (A2A) Protocol
AAIF Working Groups
AAIF Agentic Commerce Working Group
OpenSSF AI/ML Security Working Group
Secure Agentic Framework (SAF)
Register for AGNTCon + MCPCon North America
AGNTCon + MCPCon North America: Full Schedule
Let’s Play the Agentic AI Supply Chain Game! — Sarah Evans and Christopher Robinson (CRob) 
Workshop: Secure Agentic Framework (SAF) for Agentic AI — Sarah Evans, Jautau “Jay” White, Frederick Kautz, and Laura Guazzelli
GitHub Octodex: Meet the Octocats
Linux Foundation Projects
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What’s in the SOSS, host Sally Cooper sits down with technology executive and ActiveState CEO Abby Kearns to break down the rapidly evolving open source security landscape. Together, they dissect why reactive post-build scanning fails to prevent dependency debt, how machine-speed AI ingestion is overwhelming human maintainers, and what the impending EU Cyber Resilience Act (CRA) mandates mean for enterprise software supply chains. Abby offers actionable insights into why building a "start secure, stay secure" paradigm is essential for modern software pipelines and why open source communities must unite to redefine repository economics in an AI-dominated world.

Chapters:
00:00 - Introduction: Sally Cooper welcomes Active State CEO Abby Kearns to discuss AI, vulnerability management, and open source security.
01:27 - The Limits of Reactive Scanning: Why controlling components at the build source beats post-build scanners.
04:26 - AI Agents and Ingestion Risk: Managing governance and dependency debt when code moves at automated machine speed.
07:27 - Regulatory Pressures & The CRA: Preparing for 24-hour vulnerability reporting deadlines and mandatory SBOM provenance.
11:00 - Upstream Package Repository Economics: Addressing maintainer burnout and the influx of AI-generated PRs.
14:02 - The True Cost of Exposure: Mitigating enterprise risk across foundational open source language libraries.
16:27 - Rapid Fire Round: Tux the Penguin, favorite emojis, time travel, and key takeaways for the community.

Episode links:
Abby Kearns’ LinkedIn Page
Active State Website
EU Cyber Resilience Act (CRA) Overview
Linux Foundation Projects
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What's in the SOSS?, host CRob sits down with Mark Russinovich – CTO and Deputy CISO of Azure, as well as Board Chair for the Open Source Security Foundation (OpenSSF) – for a wide-ranging conversation on the changing landscape of software security. Mark shares insights from his journey from Sysinternals to Azure leadership, exploring how generative AI is delivering dramatic productivity boosts while creating new talent pipeline challenges for early-in-career engineers. The discussion dives into the shift toward hardware-backed "what, not who" supply chain identity, the urgent rolling Y2K effort to fix AI-discovered vulnerabilities via initiatives like Accretis, and the reality of persistent AI hallucinations. Finally, Mark details OpenSSF's strategic priorities for package registry sustainability and gives a sneak peek into his personal vibe-coded side projects like Polypost. 
Chapters:
00:00 – Sysinternals & Career Journey: Mark reflects on his transition from Sysinternals to Microsoft Azure leadership.  
02:08 – OpenSSF Board Leadership: Mark outlines his vision and key priorities as the new OpenSSF Board Chair. 
03:32 – Corporate & Community Alignment: How Microsoft balances its enterprise goals with open source community needs.  
05:40 – AI's Impact on Software Engineering: Why AI coding shifts developer roles toward architecture, review, and preceptorships.  1
2:35 – Finding vs. Fixing Vulnerabilities: Managing the rapid race against AI-assisted threats across modern systems.  
16:07 – LLM Code Quality & Edge Cases: Exploring prompt specification limits and unexpected model behaviors.  
22:07 – Navigating AI Hallucinations: Why model hallucinations persist despite web grounding and how experts mitigate them.  
26:34 – Supply Chain: Shifting "Who" to "What": Establishing identity using hardware attestation and confidential computing.  
30:44 – Machine Unlearning & Model Safety: Mark details his research on targeted unlearning and model alignment experiments.  
34:06 – Rapid Response & Accretis: Standing up coordinated responses to patch critical open source vulnerabilities.  
39:39 – Package Registry Sustainability: Securing package repositories and building sustainable funding models.  
45:44 – Personal Projects & Vibe-Coding: Mark discusses his current AI coding stack, Polypost, and gaming.  
53:44 – Rapid Fire Round: Quick takes on Emacs, Star Wars, and favorite dystopian robots.

Episode links:
Mark Russinovich’s LinkedIn page
Microsoft Azure
OpenSSF Guide: Principles for Package Repository Security
Who's Harry Potter? Approximate Unlearning in LLMs Paper
HALU Bench: Hallucination Benchmark Research
SCITT (Supply Chain Integrity, Transparency, and Trust - IETF)
Microsoft Signing Transparency
Polypost GitHub
Polypost WebApp
Get involved with the OpenSSF
Learn more about the OpenSSF Governing Board
Subscribe to the OpenSSF Newsletter
Follow the OpenSSF on LinkedIn

In this episode of What’s in the SOSS, host Sally Cooper is joined by Madalin Neag, EU Policy Advisor at the OpenSSF, to demystify the European Union’s Cyber Resilience Act (CRA). As the tech industry shifts from treating open source as a free buffet to navigating a new era of regulatory liability, Madalin explains how the CRA establishes a horizontal cybersecurity baseline for digital products. The conversation explores the innovative concept of "open source software stewards," the importance of moving beyond passive consumption to active upstream contribution, and why compliance should be viewed as an outcome of good engineering rather than a separate checkbox exercise. Whether you are a manufacturer of smart devices or a volunteer maintainer, this episode provides essential insights into how the CRA will reshape the global software supply chain, encouraging a secure-by-design mindset that strengthens the entire digital ecosystem.
Chapters:
00:23 - Introductions and Madalin’s role at OpenSSF
03:42 - What is the Cyber Resilience Act (CRA)?
05:27 - The CRA in the global regulatory landscape
09:05 - Relevance to open source and the "Software Steward" concept
13:02 - Moving from passive consumption to upstream contribution
16:20 - Practical steps for organizational readiness
20:26 - Should open source maintainers be worried?
24:12 - Insights from the Linux Foundation CRA Readiness Report
31:32 - What to watch for in the coming year
34:07 - Rapid fire round and concluding thoughts

Episode links:
Madalin Neag’s LinkedIn page
Cyber Resilience Act - Implementation
Global Cyber Policy Working Group
Linux Foundation 2026 CRA Awareness and Readiness Report
Case Study: Defending the Open Source Supply Chain in a New Regulatory Era
OpenSSF’s Global Cyber Policy Working Group European Union Cyber Resilience Act (CRA) Information, Resources & Guides Page
Open Source Project Security Baseline (OSPS)
SLSA
Gemara
GUAC
OpenSSF Projects
Understanding the EU Cyber Resilience Act (CRA) (LFEL1001)
Global Cyber Policy GitHub Repository
Join us at Open Source Summit and OpenSSF Community Day in Prague 
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn