Episode 880 transcript

FLOSS-880 Jonathan: [00:00:00] Hey, folks. This week I talk with Benjamin Samuels of Trail of Bits and we're talking about Patch the Planet. That's the Trail of Bits initiative to help open source projects deal with the absolute tidal wave we're all seeing of pull requests, bug reports, and vulnerability disclosures. This is Floss Weekly, episode 880, recorded Tuesday, September the 1st. The two wolves It's time for Floss Weekly. That's the show about free, libre, and open source software. I'm your host, Jonathan Bennett, and today we're talking about something really cool. We've got Benjamin Samuels of Trail of Bits, and he does their boring blockchain thing that we may cover a little bit. But the other thing he's involved in is Patch the Planet, which is all about helping open source projects with security problems. And reading the notes ahead of time, I happen to know that, take a drink, we're gonna talk about AI. But not necessarily the [00:01:00] everybody should using it, but this is causing a problem for some open source projects. Like, how do we deal with that? We'll get into all of that. Let's go ahead and bring him on. Benjamin, hey. I'm super glad that you're here. Welcome to the show. Benjamin: Absolutely. Thank you for having me. Jonathan: Yeah. So tell me... Let's see. Where do we start? You've got a background in electronics. You were telling me before the show started that was your college major. And you found Hackaday way back in the day- Yeah ... looking for I think like a lot of us did, looking for information about what's practical for me to try to tackle in the electronics world? Benjamin: Yeah. Back in the day, back in college, poor college kid it's really hard to figure out, what kind of electronics projects can you actually do on your own that you don't need a whole lot of equipment for? And it was way back before Arduino like you a- if you wanted a microcontroller, you had to buy a pick, and you had to buy a programmer, and just getting into stuff could be like, $500 to $1,000. And the real struggle was, like, looking for projects that, [00:02:00] I could actually tackle. 'Cause, you're learning electronics, you wanna actually do it. But it was a really high barrier for entry, and Hackaday was a s- a source of some of my earliest projects, just trying to reproduce what other people had built. It's a lot of fun. Yeah. I remember I've told them this story ahead, before the show started, w- when I was first trying to run some ethernet and trying to figure out how to terminate ethernet. I think I learned that from Hackaday, and that may have been one of my first exposures to this world that we now all live in. Jonathan: But one of the other really interesting things I did very early was toner transfer method for making PCBs- Yeah ... and that was surprisingly easy for a, I think, t- maybe teenager, either teenager or college student, myself at the time, to get into. It's like, 'cause you could get a magazine and print onto the magazine. S- if you had the right kind of printer that did waterproof toner, and then you could take, and you flip it upside down, and you put it on your PCB board, and you take an iron and iron it, and the toner would transfer. And you could caref- I think you had to use water because you wanted that, you wanted the paper itself to disintegrate and leave the toner [00:03:00] behind. And then you could dump that into a bath of what was it? Hydrochloric and muriatic acid, the mix? Something like that. Yeah. And it would etch the copper, but leave where the toner was. And so that was... I, man, I remember that. I have... I still somewhere around here, I have a device that I built that way. It was a- ... headphone preamp. My, my first foray into playing with tubes as well. Sup- super cool times, man. I hadn't thought about that in a long time. Thank you. Thank you, Hackaday. Benjamin: Thank you, Hackaday. Yes. Jonathan: So you kinda went from the hardware to the software and security, and you're now at Trail of Bits. What do what do you do at Trail of Bits? What's your job there? Benjamin: So I'm the director of engineering of the blockchain practice and we're a part of a larger group called Assurance, which means software assurance, trying to make sure that software is secure and to have all kinds of companies out there that have very high impact software where