In this episode of What's in the SOSS’s “Big Thoughts, Open Sources,” host CRob sits down with Vincent Danen, Vice President of Product Security at Red Hat, for a deep dive into the evolving landscape of open source vulnerability disclosure. Drawing on over two decades of open source security experience, Vincent reflects on the history and critical role of the CVE program while addressing modern challenges like the rise of alternative advisory systems and the flood of AI-assisted vulnerability disclosures. The conversation explores the shifting dynamics between upstream maintainers and downstream consumers, the practical utility – and missing user experience – of SBOMs, and how emerging regulations like the EU Cyber Resilience Act impact global software supply chain security. 


Chapters

  • 00:00 – Introduction & Open Source Origins
  • 04:26 – The Evolution of CVE and Vulnerability Data
  • 11:02 – Coordinated Vulnerability Disclosure in a Fast-Paced World
  • 17:53 – AI’s Impact on Vulnerability Discovery & Response
  • 27:20 – Realizing the Value of SBOMs and VEX
  • 35:05 – Contextualizing Risk and Exploitability
  • 42:55 – Regulatory Expectations and the Future of Supply Chain Security


Episode links:

Rss Apple Podcaster
Podden och tillhörande omslagsbild på den här sidan tillhör OpenSSF. Innehållet i podden är skapat av OpenSSF och inte av, eller tillsammans med, Poddtoppen.