Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security

Kyle Kelly joins Chris to explore the wild west of software supply chain security. Kyle, author of the CramHacks newsletter, sheds light on the complicated and often misunderstood world of software supply chain security. He brings unique insights into the challenges, issues, and potential solutions in this constantly growing field. From his experiences in sectors like cybersecurity and security research, he adapts a critical perspective on the state of the software supply chain, suggesting it is in a 'dumpster fire' state. We'll dissect that incendiary claim and discuss the influence of open-source policies, the role of GRC, and the importance of build reproducibility. From starters to experts, anyone with even a mild interest in software security and its future will find this conversation enlightening.

Connect with Kyle Kelly:
→ CramHacks
→ Solve for Happy by Mo Gawdat

Mentioned in this episode:
→ CramHacks
→ Solve for Happy by Mo Gawdat
→ Semgrep
→ Log4j
→ OWASP Dependency-Track
→ OpenSSF
→ OpenSSF Scorecard
→ GitHub Dependabot
→ ReversingLabs
→ Roblox
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kyle Kelly: The Dumpster Fire of Software Supply Chain Security
04:23 Very cool. Very cool. So let's, let's, uh, engage on this
08:27 Yeah, I mean, so when you think about SolarWinds then, and
09:39 Yeah, I think at the end of the day, many of
11:43 Okay. And so let's come back around to the, to the
19:13 I think the reality is nobody actually does. Because it's not
23:09 I think that's a good way to get fired as well
24:30 Mean, that's a great, it's a great practice. If you have
30:11 Yeah. And that, that just, I mean, it gets to the
31:39 Yeah. And then you've got like the scorecard, right
34:13 Good luck with that. I think you will get zero total
37:11 Yeah, I mean, there's, there's some truth to that in the
40:14 Alright. How about a key takeaway or a call to action