Pentesting 101: Hacking Legally With Warren Houghton Nerding Out With Viktor podcast

50:37

In this episode of Nerding Out with Viktor, host Viktor Petersson speaks with Joshua Watt of Garmin and Ross Burton of ARM to explore how the Yocto Project is evolving to meet the growing demands of software supply chain security, embedded Linux customization, and long-term product maintenance. As two long-time contributors to Yocto and OpenEmbedded, Joshua and Ross share hard-earned insights on how build-time Software Bill of Materials (SBOMs) offer deeper accuracy and compliance benefits compared to traditional post-build analysis. They dig into how the integration of SPDX 3.0 in Yocto enables better license tracking, reproducibility, and component transparency, critical features for developers building connected products in regulated industries like industrial IoT, telecom, and automotive. The conversation also covers how VEX metadata can be used to prioritize vulnerabilities in real-world environments, and why reproducible builds using BitBake's hashserver infrastructure are becoming a cornerstone of secure firmware development. As global regulatory frameworks like the EU Cyber Resilience Act (CRA) push for stricter transparency and vulnerability management, the Yocto Project's native SBOM tooling is helping teams future-proof their embedded Linux stacks. Joshua and Ross also discuss the challenges of managing multi-layer board support packages (BSPs), handling closed-source components responsibly, and navigating SBOM creation across vendors in complex system builds. This episode is a must-listen for embedded engineers, firmware architects, and product teams who want to build secure, scalable Linux-based devices while staying ahead of compliance and lifecycle management needs. ]]>…

Nerding Out With Viktor

1
Startup Founder Lessons on Scaling Teams, Systems, and Culture with Kevin Henrikson 1:16:09

28 days ago1:16:09

1:16:09

In this episode of Nerding Out with Viktor, host Viktor Petersson is joined by Kevin Henrikson, an experienced engineering leader who's worked with Zimbra, Microsoft, and Instacart, to share real startup founder lessons on how to scale engineering teams, build resilient systems, and manage growth through acquisitions. Kevin explains what founders often get wrong when scaling, why a simple weekly shipping cadence changed everything at Outlook Mobile, and how aligning around a single operational metric helped Instacart navigate massive demand during the COVID surge. We talk about how to avoid "organ rejection" during an acquisition, the shift from founder to advisor inside large companies, and what breaks first when scaling from 10 to 1500 engineers. Kevin also covers org design for distributed teams, why CTOs need to think about people and systems as much as code, and how he's using AI and automation to operate leaner, more scalable SaaS businesses. Whether you're a startup founder, CTO, or building your first technical team, this episode is packed with insights from someone who has done it at every stage. ]]>…

Nerding Out With Viktor

1
Reimagining CI/CD and Engineering Culture at Scale with Vlad A. Ionescu from Earthly 1:10:06

6 weeks ago1:10:06

1:10:06

In this episode of "Nerding Out with Viktor," host Viktor Petersson is joined by Vlad A Ionescu, founder and CEO of Earthly, to explore the realities of modern CI/CD pipelines, why developer experience remains fragmented, and how platform and security teams can work more effectively across organizations. Vlad outlines the origins of Earthly and how their open-source build automation tool enables consistent CI/CD across teams. The conversation covers GitHub Actions, the challenge of running pipelines locally, and why container-based workflows offer practical improvements in debugging and collaboration. The discussion moves to Earthly's second product, Lunar, which focuses on monitoring and enforcing engineering practices in the SDLC. Vlad explains how this enables organizations to apply policies like test coverage and vulnerability scanning, without relying solely on teams to adopt them individually. Other key topics include plugin governance, differences in developer infrastructure at large companies versus smaller teams, and the complexity of managing shared CI/CD ownership. The conversation also touches on hybrid work challenges, remote team management, and strategies for building trust and documentation in distributed teams. Toward the end, the episode explores the potential impact of AI in software development. Vlad shares why he sees AI as a tool for accelerating skilled engineers, rather than a full replacement, and highlights the risks of relying on machine-generated code without proper verification. Whether you're working on developer tooling, building remote teams, or thinking about the role of AI in engineering workflows, this episode offers a grounded and technical perspective. ]]>…

Nerding Out With Viktor

1
Europe's Battle for Tech Sovereignty: Why OpenStack Matters 1:12:11

8 weeks ago1:12:11

1:12:11

In this episode of "Nerding Out with Viktor," I'm joined by Johan Christenson, founder of Cleura, to dig into one of the most critical questions facing European tech today: how do we build a sovereign cloud that can actually compete? Johan brings decades of experience in open infrastructure and a front-row seat to the evolution of cloud computing. We talk about why Europe still leans so heavily on U.S. cloud platforms, and the real-world risks that come with that dependency whether it's pricing, control, or strategic leverage. We get into the friction points that keep Europe from moving faster: outdated procurement practices, broken incentive structures, and the lack of deep technical understanding inside policymaking circles. Johan also shares what it's been like building on OpenStack from the early days, and what Cleura has learned about scaling sovereign infrastructure in a space dominated by hyperscalers. I really enjoyed diving into how cloud-native tools like Kubernetes can unlock more flexibility and how standardization could help level the playing field for smaller providers. We also touch on the limitations of regulation when enforcement is missing, and why alignment between government goals and operational behavior is long overdue. Whether you're in cloud infrastructure, policy, or just curious about how Europe can chart its own course, this one's packed with insight. ]]>…

Nerding Out With Viktor

1
Physical Pen Testing Secrets: Covert Building Infiltration Explained 1:09:19

10 weeks ago1:09:19

1:09:19

In this episode of "Nerding Out with Viktor," Warren Houghton returns to pull back the curtain on the covert world of physical penetration testing. As a seasoned security expert from Pentest Partners, Warren shares his extensive experience in breaching physical security measures, offering listeners a rare glimpse into the methodologies and techniques used by professional security testers. Viktor and Warren explore the fascinating realm of physical security assessments, from initial reconnaissance and planning to the execution of sophisticated social engineering tactics. Warren reveals how security professionals can clone access badges, bypass reception areas, and exploit human psychology to gain unauthorized access to secured facilities. Through compelling real-world examples, he demonstrates how even seemingly robust security systems can be compromised by determined adversaries who understand the vulnerabilities in both technology and human behavior. The conversation delves into the critical importance of physical security in the overall security posture of organizations, particularly those with sensitive data centers or restricted areas. Warren provides valuable insights into common weaknesses in building security, explaining how organizations can identify and address these vulnerabilities before they're exploited by malicious actors. He also discusses the ethical considerations and legal frameworks that govern physical penetration testing, emphasizing the importance of proper authorization and scope definition. Whether you're a security professional looking to enhance your organization's physical defenses, an IT manager concerned about holistic security approaches, or simply fascinated by the world of security testing, this episode offers invaluable knowledge about the realities of physical security in today's complex threat landscape. Join Viktor and Warren for this eye-opening discussion that will forever change how you view the security of physical spaces around you. ]]>…

Nerding Out With Viktor

1
Balena, IoT Security, and the Future of Connected Devices 1:06:14

12 weeks ago1:06:14

1:06:14

Join host Viktor Petersson as he sits down with Marc Pous of Balena to explore the ever-evolving world of IoT, from remote management and fleet updates to security legislation and software bills of materials (SBOMs). Marc reveals how Balena pioneered container-based deployments on devices like Raspberry Pi, explains why over-the-air (OTA) updates are critical for any hardware project, and offers insights into upcoming regulations such as the Cyber Resilience Act (CRA). Discover why IoT is quickly becoming "just connected products," how businesses can adapt to this new era, and why it's time to rethink everything from SD cards to DevOps workflows. Whether you're an IoT veteran or curious about the future of connected tech, this episode offers a deep dive into managing devices at scale and keeping them secure. ]]>…

Nerding Out With Viktor

1
Dustin Kirkland on Chainguard, Zero-CVE Containers, and Supply Chain Security 59:15

14 weeks ago59:15

59:15

In this episode of Nerding Out with Viktor , host Viktor Petersson sits down with Dustin Kirkland from Chainguard for an illuminating discussion on modern supply chain security and container hardening. Drawing from his rich experience across tech giants like IBM, Red Hat, Canonical, and Google, Dustin shares invaluable insights into the evolution of container security and the critical importance of maintaining secure infrastructure. The conversation delves deep into Chainguard's innovative approach to building minimal, hardened container images directly from source code. Dustin explains their groundbreaking Zero-CVE initiative, demonstrating how continuous rolling updates and careful dependency management can dramatically reduce vulnerability exposure. Through practical examples and real-world scenarios, he illustrates the delicate balance between security, functionality, and maintainability in modern container deployments. Viktor and Dustin explore the intricate world of Software Bills of Materials (SBOMs), diving into how attestations and digital signatures through tools like Sigstore and Cosign create a robust chain of trust. The discussion illuminates the critical role these technologies play in guaranteeing software provenance and enabling rapid vulnerability patching across complex deployments. The episode also tackles the challenges of navigating stringent compliance requirements such as FedRAMP and HIPAA, with Dustin sharing practical strategies for maintaining security without sacrificing agility. The conversation extends to the nuances of open source licensing and the future landscape of infrastructure security, offering listeners valuable insights into maintaining secure, modern systems in an increasingly complex technological environment. Whether you're a security professional, container enthusiast, or technology leader, this episode provides essential knowledge about the future of supply chain security and container hardening. Don't miss this comprehensive exploration of how organizations can build and maintain secure infrastructure in today's rapidly evolving technology landscape. ]]>…

Nerding Out With Viktor

1
Pentesting 101: Hacking Legally with Warren Houghton 1:01:25

16 weeks ago1:01:25

1:01:25

In this episode of "Nerding Out with Viktor," Warren Houghton from Pentest Partners joins Viktor to explore the fascinating world of professional penetration testing. As they delve into the intricacies of "legal hacking," Warren shares invaluable insights into the methodologies, tools, and best practices that define ethical hacking in today's cybersecurity landscape. The conversation covers crucial aspects of pentesting, from obtaining proper authorization and managing scope to selecting the right tools for different scenarios. Warren explains how seemingly minor oversights, such as exposed .git directories, can lead to significant security breaches, and demonstrates why thorough documentation and proper paperwork are as critical as technical expertise in professional pentesting. Viktor and Warren explore the essential toolkit of a modern pentester, discussing tools like Burp Suite for web application testing, Nmap for network discovery, and Metasploit for exploitation. Through real-world examples and engaging stories from the field, Warren illustrates how attackers can leverage small vulnerabilities to gain broader access to networks and systems. The episode also serves as a valuable resource for aspiring cybersecurity professionals, with Warren offering guidance on certifications, practical experience, and developing the investigative mindset necessary for success in the field. The discussion concludes with a preview of physical security testing, highlighting how the principles of penetration testing extend beyond the digital realm to encompass physical security controls and access systems. ]]>…

Nerding Out With Viktor

1
A deep dive into the SBOM format SPDX with Kate Stewart and Gary O'Neall 50:14

18 weeks ago50:14

50:14

In this episode of "Nerding Out with Viktor," Kate Stewart from the Linux Foundation and Gary O'Neall, a long-time SPDX contributor, join Viktor to explore the evolution and impact of SPDX (Systems Package Data Exchange) in software transparency. The conversation traces SPDX's journey from its origins in license compliance to its current pivotal role in security and vulnerability tracking, revealing how this open standard is shaping modern software development practices. Kate and Gary provide deep technical insights into the challenges teams face when generating accurate Software Bills of Materials (SBOMs), including complex scenarios involving circular dependencies and component uncertainty. Through practical examples from their work with various organizations, they demonstrate how these real-world challenges have influenced the development of SPDX tools and specifications. The discussion delves into current initiatives for integrating SBOM generation into build systems, with specific focus on implementations in the Zephyr and Yocto projects. They also explore ongoing efforts to implement build-time SBOM generation for the Linux kernel, highlighting both the technical approach and practical benefits for development teams. Viktor, Kate, and Gary examine the growing regulatory requirements surrounding SBOMs, particularly in safety-critical systems, and how SPDX 3.0 is being designed to meet these demands while supporting modern CI/CD pipelines. The conversation illuminates the technical considerations behind maintaining compatibility with existing tools while expanding functionality for new use cases. As an open, community-driven project, SPDX continues to evolve with industry needs, offering solutions for compliance, security vulnerabilities, and supply chain transparency in modern software development workflows. ]]>…

Nerding Out With Viktor

1
All things ZFS and FreeBSD with Allan Jude 1:18:17

24 weeks ago1:18:17

1:18:17

In a captivating deep dive into the world of advanced storage systems, Viktor welcomes ZFS expert and FreeBSD developer Allan Jude to explore the intricate landscape of modern filesystem architecture. This episode of Nerding Out with Viktor peels back the layers of enterprise storage solutions, offering listeners a masterclass in both theoretical foundations and practical implementations. Allan, drawing from his extensive experience in FreeBSD development and ZFS optimization, guides listeners through the sophisticated underpinnings of ZFS's copy-on-write architecture. The discussion illuminates how this fundamental design choice revolutionizes data integrity and storage management, while exploring the real-world implications for enterprise deployments. Through concrete examples and technical insights, Allan demonstrates why ZFS continues to be the go-to solution for organizations demanding unwavering data reliability. The conversation takes an exciting turn as Viktor and Allan explore FreeBSD's networking capabilities, unraveling how its architectural decisions contribute to its reputation for exceptional performance in production environments. Allan shares fascinating insider perspectives on why industry giants repeatedly choose FreeBSD for their critical infrastructure, backing these insights with compelling technical analysis and real-world case studies. Listeners will find themselves immersed in practical wisdom as Allan shares battle-tested strategies for ZFS deployment and optimization. The discussion covers everything from fine-tuning storage pools to leveraging advanced features for maximum efficiency, providing administrators and developers with actionable takeaways they can implement immediately. The episode also ventures into forward-looking territory, examining emerging trends in storage technology and operating system development. What sets this episode apart is Allan's remarkable ability to convey complex technical concepts with clarity and precision, making advanced topics accessible without sacrificing technical depth. Whether you're managing enterprise storage infrastructure, developing system-level software, or simply passionate about cutting-edge filesystem technology, this conversation offers invaluable insights into the present and future of storage solutions. Allan's expertise, combined with Viktor's engaging interview style, creates a compelling narrative that bridges theoretical knowledge with practical application in the ever-evolving landscape of enterprise storage and operating systems. ]]>…

Nerding Out With Viktor

1
Hacking airplanes, ships and IoT devices with Ken Munro 1:06:14

26 weeks ago1:06:14

1:06:14

In this thrilling episode of Nerding Out with Viktor , host Viktor Petersson is joined by Ken Munro, a leading figure in cybersecurity and an expert in penetration testing. Together, they dive into the hidden world of aviation cybersecurity, shedding light on the challenges, discoveries, and unexpected vulnerabilities that exist within modern aircraft systems. With decades of experience and a passion for making aviation safer, Ken guides listeners through some of the most fascinating aspects of airplane hacking, responsible disclosures, and how his team tests aircraft security to uncover vulnerabilities. The conversation kicks off with an exploration of how Ken entered the field of aviation cybersecurity, sharing tales of hacking decommissioned planes in a scrapyard—a unique method that allowed his team to practice without endangering passengers or active fleets. Ken provides insight into his early career in the antivirus industry, his background as a general aviation pilot, and how these experiences culminated in his journey into the world of aviation security. He talks about the infamous time he hacked airplane entertainment systems and even how, with the right setups, it's possible to rickroll an entire flight! Ken and Viktor then turn their attention to one of aviation's most pressing security concerns: the electronic flight bag (EFB). EFBs, now commonly used in commercial cockpits, have replaced the hefty stacks of maps and manuals pilots once carried. Yet, while EFBs improve efficiency, Ken highlights the vulnerabilities in their design. For instance, by manipulating data within the EFB's performance calculators, attackers could mislead pilots about crucial factors like runway length or engine thrust. Ken explains the dire implications of these weaknesses and the sophisticated tactics used to secure these systems. The episode also covers GPS spoofing, a technique used by some adversaries to mislead or disrupt an aircraft's navigation system. Ken describes the complexities of GPS spoofing and jamming, explaining how such attacks can confuse onboard navigation and leave pilots relying on outdated or incorrect data until they're able to safely land. Ken's research into GPS vulnerabilities has revealed the scope of these threats, particularly in areas of high political tension. The discussion moves into the intricacies of responsible disclosure in the aviation industry, as Ken explains the delicate balance between informing manufacturers about security issues while respecting the time-consuming processes they require for safety certification. He shares examples of working with Boeing and Airbus, noting how long it can take to fix even minor vulnerabilities due to the rigorous testing needed to maintain passenger safety. Ken even praises Boeing for their commitment to addressing issues, despite the inevitable delay between discovery and patching. Viktor and Ken wrap up by discussing the industry's gradual shift towards transparency in handling disclosures and threats. They talk about the importance of collaboration between cybersecurity professionals, manufacturers, and government regulators to enhance aviation security continuously. Ken emphasizes that, while security is critical, safety remains paramount in aviation, which often means extended timelines for vulnerability patches. For anyone fascinated by cybersecurity, aviation, or the hidden challenges of keeping the skies secure, this episode of Nerding Out with Viktor is an eye-opening deep dive into a world that affects millions of passengers daily. Ken Munro's expertise, combined with Viktor's curiosity and insights, makes for a compelling and informative conversation that reveals both the resilience and the risks of modern aviation systems. Don't miss this must-listen episode on the cutting edge of cybersecurity and aviation. ]]>…

Nerding Out With Viktor

1
From Passwords to Passkeys: Exploring the Future of Authentication with Massi Gori 1:04:29

28 weeks ago1:04:29

1:04:29

In this enlightening episode of Nerding Out with Viktor, Viktor Petersson welcomes authentication expert Massi Gori to delve deep into the ever-evolving world of digital identity and security. Massi, a seasoned product manager at Canonical, brings over 17 years of experience in identity management, from foundational protocols like LDAP and Kerberos to the latest advancements in passkeys and zero-trust models. The conversation begins with a historical journey through the evolution of authentication technologies, highlighting the pivotal roles of LDAP and Kerberos, which laid the groundwork for modern identity verification. Massi reflects on the shift from SAML to OAuth and OpenID, underscoring how these standards set the stage for today's Single Sign-On (SSO) systems and federated identity management. Viktor and Massi explore the crucial distinction between authentication (verifying who you are) and authorization (determining what you can access), unraveling the often-complex concepts behind identity management. Massi emphasizes the importance of user management and identity governance, illustrating how each plays a vital role in securing enterprise environments. They also cover the rising significance of Multi-Factor Authentication (MFA) and the progression from hardware tokens to modern soft tokens, which have simplified yet bolstered the security framework for millions. The discussion transitions to FIDO2 and WebAuthn standards, a major leap toward a passwordless future. Massi shares insights into the mechanics behind these protocols and how FIDO2's architecture enhances security against adversaries-in-the-middle and other sophisticated attacks. He also addresses the role of biometrics, behavioral metrics, and device-based security as essential components of the zero-trust framework, shedding light on why continuous verification is more important than ever in the digital age. Towards the end, Viktor and Massi discuss passkeys—the new generation of passwordless authentication. Massi explains how passkeys combine the security of FIDO2 with the convenience of cloud sync, making it easier for users to recover credentials without sacrificing security. The duo addresses the trade-offs between using traditional hardware tokens like YubiKeys and the cloud-based flexibility of passkeys, giving listeners a comprehensive look at the future of authentication. This episode is a must-listen for tech enthusiasts and professionals alike, offering a thorough understanding of where digital identity is headed and what companies can do to stay ahead in securing user access. ]]>…

Nerding Out With Viktor

1
SBOMs, CycloneDX, and Software Security with Steve Springett 1:12:05

30 weeks ago1:12:05

1:12:05

In this episode of Nerding Out With Viktor , host Viktor Petersson sits down with Steve Springett, a leading figure in the world of Software Bill of Materials (SBOMs) and the primary maintainer of CycloneDX, to explore the evolving landscape of software security and SBOMs. Steve shares his journey into the SBOM space, starting with his early experiences in supply chain management and the creation of OWASP Dependency-Track, a project that began out of necessity to manage full-stack inventories of hardware and software. Steve discusses the challenges faced during the early days, the limitations of existing tools, and how these experiences informed his later contributions to CycloneDX. The conversation dives deep into the technical nuances of SBOMs, including the differences between CycloneDX and SPDX, two of the most prominent SBOM standards. Steve and Viktor debate the pros and cons of each, with Steve emphasizing CycloneDX's pragmatic and automatable design philosophy. The discussion also touches on the complexities of supply chain security, including the importance of provenance, the challenges of dependency tracking, and the potential risks posed by nation-state adversaries. Steve provides insights into the future of SBOMs and how they will likely become as standard in software development as unit testing is today. He also introduces the concept of OBOMs (Operational Bill of Materials), explaining how SBOMs can extend to cover runtime environments and services, ensuring a more comprehensive approach to managing and securing software stacks. Key topics covered: - Steve Springett's journey into SBOM and CycloneDX - Differences between CycloneDX and SPDX - The role of provenance in software supply chains - The future of SBOMs and their importance in cybersecurity compliance - Introduction to OBOMs and how they expand the SBOM concept If you're working in software development, DevOps, or cybersecurity, this episode is packed with practical advice and forward-thinking insights on how SBOMs are reshaping the industry. Tune in to learn from one of the leading voices in the SBOM world and stay ahead in securing your software supply chain. Check out sbomify at sbomify.com for a tool that simplifies SBOM generation and management! ]]>…

Nerding Out With Viktor

1
RFID Hacking with Iceman: Exploring the Intricacies RFID Security 1:07:03

32 weeks ago1:07:03

1:07:03

In this episode of Nerding Out with Viktor, I sit down with Iceman, a well-known figure in the RFID hacking community. You might have caught one of his DEFCON talks, where he's done some groundbreaking work in RFID security. Today, we're diving deep into RFID technology, hacking techniques, and security vulnerabilities that many of us take for granted in everyday systems. RFID (Radio-Frequency Identification) is all around us—from access control systems in buildings to payment cards, car immobilizers, and even alarm systems. While it's widely used, few people realize how vulnerable this technology can be. Iceman is here to break it all down, helping us understand the difference between RF and RFID, and explaining the various frequency ranges, from low frequency (125 kHz) to high frequency (13.56 MHz) and ultra-high frequency (800-900 MHz). Whether you're a seasoned RF enthusiast, a hacker, or just curious about the technology behind the systems we rely on, this episode offers a deep dive into the world of RFID hacking. Iceman walks us through the basics, discussing different types of key fobs, cards, and readers. He also explains how people often buy RFID cloners only to realize they can't clone certain cards due to the specific technology used. I learned this the hard way when I stumbled upon an RFID cloner at DEFCON—where I'd gone for my general interest in security—and it opened my eyes to the whole world of RFID hacking. Iceman reveals the essential tools of the trade, from the Proxmark to the Blue Gun Cloner, to more advanced gear like the iCopyX. We talk about the different tools available at all levels, from hobbyist to professional pentesters. But we don't stop at the tools—he breaks down how RFID authentication and encryption work, and how vulnerabilities like static and dynamic nonces leave even "secure" systems exposed. One of the most exciting parts of the conversation is learning that RFID hacking isn't just about cloning a fob or breaking into a building. Iceman talks about how the hacking community is really about exploring, learning, and pushing the boundaries of technology. His story about creating the Iceman Fork of the Proxmark repository is a great example of how hackers collaborate to improve tools and share knowledge. We also get into more advanced RFID attacks like downgrade attacks, where hackers exploit systems that still support older, less secure versions of card technology. Iceman shares some real-world examples of how these vulnerabilities play out, giving us a peek behind the curtain at how hackers find and exploit these security gaps. We explore the security (or lack thereof) in systems we encounter every day—like hotel room key cards and smart locks. Iceman breaks down how even high-end systems can be vulnerable to simple cloning or more sophisticated downgrade and replay attacks. We also touch on newer technologies like NFC and mobile credentials, discussing how they compare to older RFID systems. For those of you looking to get started with RFID hacking or to deepen your knowledge, Iceman has some great advice on tools to buy, where to start, and how to get involved in the community. He also shares where you can pick up a Proxmark device and how to join the Proxmark Discord community, which is full of discussions, support, and new insights. So, whether you're here to learn about RFID technology, interested in ethical hacking, or just love getting nerdy about tech, this episode is packed with great information and stories from one of the top minds in RFID hacking. ]]>…

Nerding Out With Viktor

1
Uncovering Firmware Security: A Deep Dive with Binarly's Philipp Deppenwiese 1:00:20

34 weeks ago1:00:20