GitHub’s Mike Hanley and Transforming the “Dept. of No” Into the "Dept. of Yes, And…”

What's in the SOSS? An OpenSSF Podcast

#Tech #Omkhar Arasaratnam, Open SSF #Omkhar Arasaratnam #Open SSF

40:34

We’ve turned intuition into a buzzword—flattened it into a slogan, a gut feeling, or a vague whisper we don’t always know how to hear. But what if intuition is so much more? What if it's one of the most powerful tools we have—and we’ve just forgotten how to use it? In this episode, I’m joined by Hrund Gunnsteinsdóttir , Icelandic thought leader, filmmaker, and author of InnSæi: Icelandic Wisdom for Turbulent Times . Hrund has spent over 20 years studying and teaching the science and art of intuition through her TED Talk, Netflix documentary (InnSæi: The Power of Intuition), and global work on leadership, innovation, and inner knowing. Together, we explore what intuition really is (hint: not woo-woo), how to cultivate it in a culture obsessed with logic and overthinking, and why your ability to listen to yourself might be the most essential skill you can develop. In This Episode, We Cover: ✅ Why we’ve misunderstood intuition—and how to reclaim it ✅ Practical ways to strengthen your intuitive muscle ✅ What Icelandic wisdom teaches us about inner knowing ✅ How to use intuition during uncertainty and decision-making ✅ Why trusting yourself is an act of rebellion (and power) Intuition isn’t magic—it’s a deep, internal guidance system that already exists inside you. The question is: are you listening? Connect with Hrund: Website: www.hrundgunnsteinsdottir.com TedTalk: https://www.ted.com/talks/hrund_gunnsteinsdottir_listen_to_your_intuition_it_can_help_you_navigate_the_future?utm_campaign=tedspread&utm_medium=referral&utm_source=tedcomshare Newsletter: https://hrundgunnsteinsdottir.com/blog/ LI: www.linkedin.com/in/hrundgunnsteinsdottir IG: https://www.instagram.com/hrundgunnsteinsdottir/ Book: InnSæi: Icelandic Wisdom for Turbulent Times Related Podcast Episodes: How To Breathe: Breathwork, Intuition and Flow State with Francesca Sipma | 267 VI4P - Know Who You Are (Chapter 4) Gentleness: Cultivating Compassion for Yourself and Others with Courtney Carver | 282 Share the Love: If you found this episode insightful, please share it with a friend, tag us on social media, and leave a review on your favorite podcast platform! 🔗 Subscribe & Review: Apple Podcasts | Spotify | Amazon Music Learn more about your ad choices. Visit megaphone.fm/adchoices…

about a year ago 22:43

MP3•Episode home

In this episode, Omkhar chats with Mike Hanley, Chief Security Officer and SVP of Engineering at GitHub. Prior to GitHub, Mike was the Vice President of Security at Duo Security, where he built and led the security research, development, and operations functions.

After Duo’s acquisition by Cisco for $2.35 billion in 2018, Mike led the transformation of Cisco’s cloud security framework and later served as CISO for the company. Mike also spent several years at CERT/CC as a Senior Member of the Technical Staff and security researcher focused on applied R&D programs for the US Department of Defense and the Intelligence Community.

When he’s not talking about security at GitHub, Mike can be found enjoying Ann Arbor, MI with his wife and nine kids.

01:21 Mike shares insight into transporting a family of 11
02:02 Mike’s day-to-day at GitHub
03:53 Advice on communicating supply chain risk
08:19 Transforming the “Department of No” into the “Department of Yes And…”
12:44 AI’s potential impact on secure open source software and, specifically, on software supply chains
18:02 Mike answers Omkhar’s rapid-fire questions
19:26 Advice Mike would give to aspiring security or software professionals
20:38 Mike’s call to action for listeners

Links

32 episodes

GitHub’s Mike Hanley and Transforming the “Dept. of No” Into the "Dept. of Yes, And…”

What's in the SOSS? An OpenSSF Podcast

published about a year ago

MP3•Episode home

When he’s not talking about security at GitHub, Mike can be found enjoying Ann Arbor, MI with his wife and nine kids.

01:21 Mike shares insight into transporting a family of 11
02:02 Mike’s day-to-day at GitHub
03:53 Advice on communicating supply chain risk
08:19 Transforming the “Department of No” into the “Department of Yes And…”
12:44 AI’s potential impact on secure open source software and, specifically, on software supply chains
18:02 Mike answers Omkhar’s rapid-fire questions
19:26 Advice Mike would give to aspiring security or software professionals
20:38 Mike’s call to action for listeners

Links

32 episodes

#Tech #Omkhar Arasaratnam, Open SSF #Omkhar Arasaratnam #Open SSF

All episodes

What's in the SOSS? An OpenSSF Podcast

1
Cybersecurity Framework Launch 20:45

5 days ago20:45

20:45

In this episode of What's in the SOSS, host CRob interviews Clyde Seepersad from the LF Education Department. They discuss Clyde's journey into open source, the role of LF Education in supporting the community, and the importance of cybersecurity education. They also delve into the development of the Global IT Cyber Skills Framework, emphasizing the need for continuous learning and community engagement in the tech industry. Chapters: 00:00 Introduction to Open Source and LF Education 02:59 Clyde's Journey into Open Source 05:54 The Role of LF Education in Open Source 09:00 Cybersecurity and the Global IT Cyber Skills Framework 11:59 Framework Development and Industry Collaboration 15:13 Continuous Learning and Community Engagement Episode links: Clyde’s Linkedin Linux Foundation Training Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Scaling Security: Inside the GitHub Securing Open Source Software Fund 26:48

12 days ago26:48

26:48

In this episode of What’s in the SOSS?, CRob sits down with Kevin Crosby and Xavier Rene-Corail from GitHub to unpack the GitHub Secure Open Source Fund - an innovative program that combines funding, education, and community to strengthen open source security. Learn how this unique initiative connects maintainers with training, resources, and a $10K stipend to scale security best practices. The trio also shares the origins of the fund, surprising takeaways from the first cohort, and what’s next for this rapidly growing initiative. Chapters: 00:00 – Introduction 00:58 – Meet the Guests 02:26 – Open Source Origin Stories 06:10 – The Spark Behind the SOS Fund 10:19 – What Participating in the Fund Looks Like 12:39 – Inside the Curriculum 14:50 – Unique Program Design & Outcomes 16:23 – Key Learnings from the First Cohort 19:09 – Feedback & Areas to Improve 21:50 – What’s Next for the Fund 23:00 – Rapid Fire Round 24:23 – Call to Action Episode links: Kevin Crosby LinkedIn Xavier René-Corail LinkedIn GitHub Secure Open Source Fund May is Maintainer Month with the theme of Securing Open Source Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Showing Up Fully: Meet OpenSSF’s new Community Manager, Stacey Potter 21:13

19 days ago21:13

21:13

In this special episode of What’s in the SoSS?, we welcome Stacey Potter, the new Community Manager at the Open Source Security Foundation (OpenSSF). Stacey shares her winding journey from managing operations at a vitamin company to becoming a powerful advocate and connector in the open source world. We explore her community-first mindset, her work with CNCF and Platform Engineering Day, and her passion for inclusion and authenticity. Whether you're curious about how to get started in open source or want insight into how community shapes security, this episode is for you. Chapters: 00:00 – Welcome + Introduction 01:06 – Stacey’s Origin Story in Open Source 03:10 – Discovering Community Management at Weaveworks 04:02 – Projects and Evolution Across CNCF and Beyond 05:44 – Co-Chairing Platform Engineering Day 09:06 – Being Openly Queer in Open Source 13:10 – What Stacey Hopes to Bring to OpenSSF 16:20 – Rapid Fire Round 17:36 – Final Thoughts Episode links: Stacey Potter’s LinkedIn page OpenSSF.org/events OpenSSF Community Day Japan OpenSSF Community Day North America OpenSSF Community Day India OpenSSF Community Day North America OpenSSF Community Day Europe Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Secure Software Starts with Awareness: Education & Open Source with the Council of Daves 24:46

5 weeks ago24:46

24:46

In this episode of What’s in the SOSS, host CRob is joined by the “Council of Daves” - Dr. David Wheeler of the OpenSSF and Dave Russo from Red Hat — for a deep dive into the intersection of secure software development and education. From their open source origin stories to the challenges of educating developers and managers alike, this conversation covers key initiatives like the LFD121 course, upcoming resources on the EU Cyber Resilience Act, and how AI is shifting the landscape. Whether you're a developer, manager, or just open source curious, this is your crash course in why security training matters more than ever. 📚 Episode Chapters: Intro & Meet the Council of Daves (0:16) Open Source Origin Stories (1:22) The Role of the Education SIG (4:05) Why Secure Software Education Is Critical (6:30) Inside the LFD121 Secure Development Course (8:01) Training Managers on Secure SDLC Practices (12:24) Why AI Makes Education More Important, Not Less (13:53) What’s Next in Security Education: CRA 101 and More (16:04) Rapid Fire Round: VI vs. EMACS, Tabs or Spaces & Mascots (20:20) Final Thoughts & Call to Action (22:04) Episode links: Dave Russo LinkedIn David Wheeler LinkedIn OpenSSF Free Training : LFD121: Developing Secure Software LFD125: Security for Software Development Managers LFEL1001: Understanding the EU Cyber Resilience Act (CRA) Get involved with the OpenSSF Subscribe to the OpenSSF Newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Enterprise to Open Source: Steve Fernandez’s Journey to the OpenSSF 11:25

6 weeks ago11:25

11:25

In this episode of What’s in the SOSS, we sit down with the OpenSSF’s new General Manager, Steve Fernandez — a seasoned enterprise tech leader whose resumé spans giants like L’Oréal, Coca-Cola, AIG, and Ford. Steve shares his “origin story,” what drew him into the world of open source, and how his decades of experience as a consumer of open source software are shaping his vision for the Foundation. 00:21 Welcome & Introductions 00:57 Steve’s Tech Journey 03:13 Why OpenSSF? 05:02 The Role of Security & Strategic Vision 08:17 Rapid Fire & Final Thoughts…

What's in the SOSS? An OpenSSF Podcast

1
JavaScript's Big Footprint: Robin Bender Ginn on Leading OpenJS and Open Source at Scale 17:49

7 weeks ago17:49

17:49

Robin Bender Ginn, Executive Director of the OpenJS Foundation, joins us to talk about JavaScript’s massive footprint, the challenges of sustaining critical open source projects, and the importance of security in the web ecosystem. She shares her journey, insights on community-led development, and how OpenJS is building a healthier future for the JavaScript ecosystem. Learn more and register for JSConf North America: https://events.linuxfoundation.org/jsconf-north-america/register/ Chapters: 0:00 JavaScript's Critical Web Presence 0:51 Robin Ginn Introduces OpenJS Foundation 2:01 Core Challenges Facing JavaScript Ecosystem 4:12 Managing Older Projects and Outdated Software 8:23 Solutions and Security Improvements 12:12 Individual Impact and Community Involvement 14:35 Wrap-Up and Call to Action Episode links: Robin Bender Ginn LinkedIn page OpenJS website OpenJS YouTube channel OpenJS Slack channel Learn more and register for JSConf North America Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Empowering Security: Yesenia Yser on Open Source, AI, and Personal Branding 17:18

9 weeks ago17:18

17:18

In this inspiring episode of "What's in the SOSS?", we welcome our new Co-Host, cybersecurity expert and open source advocate Yesenia Yser. Join hosts CRob and Yesenia as they delve into her compelling journey from discovering open source at Red Hat to pioneering AI security at Microsoft. Learn how Yesenia blends her passion for cybersecurity, Brazilian jiu-jitsu, and empowering communities—especially women—to shape her personal brand and advocacy efforts. Don't miss this lively conversation full of actionable insights for anyone interested in cybersecurity, open source communities, and personal growth. Episode Highlights: 00:18 – Introduction to Yesenia Yser 00:55 – Yesenia's open source origin story 03:30 – From cybersecurity professional to jiu-jitsu practitioner 05:56 – Building a personal brand in tech and beyond 09:04 – Advocating diversity in tech through the BEAR group 12:40 – Fun rapid-fire round (VI or Emacs, Coke or Pepsi, favorite open source mascot, spicy vs. mild food, and more) 13:52 – Yesenia joins as new co-host of "What's in the SOSS?" 15:39 – Advice for breaking into open source and cybersecurity Connect with Yesenia: Yesenia Yser on LinkedIn The Lioness Instincts Get Involved with the OpenSSF: Subscribe to the OpenSSF newsletter Join the OpenSSF an upcoming Community Day Watch BEAR Community Office Hours on YouTube…

What's in the SOSS? An OpenSSF Podcast

1
OpenSSF 2025 MVVSR Overview 26:56

11 weeks ago26:56

26:56

CRob is joined by Arun Gupta, Vice President and General Manager of Developer Programs at Intel and OpenSSF Governing Board Chair, and Zach Steindler, Principal Engineer at Github, a member of the OpenSSF TAC and co-chairs the OpenSSF Security Packages Repository Working Group to discuss the key lessons learned from open source security in 2024, the importance of the MVVSR (Mission, Vision, Values, Strategy, and Roadmap) framework, and the exciting initiatives planned for 2025. They highlight the growing reliance on open source, the challenges of dependency vulnerabilities, and the need for better security practices in the industry. Chapters: 03:29 Key Lessons from Open Source Security in 2024 08:29 MVSR: Mission, Vision, Strategy, and Roadmap 13:41 Importance of Strategy and Roadmap in OpenSSF 17:48 Roadmap Items for Community Collaboration 20:02 Key Resources and Courses for Developers 22:09 Exciting Opportunities Ahead for 2025 Episode links: Arun’s Linkedin Zach’s Linedkin 2024 Annual Report Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Kusari’s Michael Lieberman Talks GUAC, SLSA and Securing the Open Source Supply Chain 21:06

20 weeks ago21:06

21:06

CRob is joined by Michael Lieberman, CTO and co-founder of Kusari, about the importance of supply chain security in the open source ecosystem. They discuss Michael's journey in open source, his contributions to projects like SLSA and GUAC and the future of supply chain security. 01:56 - Michael explains how he got into open source 04:10 - The challenges of being a startup within the open source ecosystem 05:38 - Michael digs into his participation with SLSA and GUAC 09:13 - How maintainers can address SBOMs with GUAC 10:56 - Michael’s predictions for supply chain security and dependency management 14:26 - Michael answers CRob’s rapid-fire questions 15:32 - Advice for those entering the cybersecurity or open source development spaces 17:50 - Michael’s call to action Links: Michael Liberman on LinkedIn Kusari homepage GUAC homepage on OpenSSF SLSA homepage on OpenSSF Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Sovereign Tech Agency’s Tara Tarakiyee and Funding Important Open Source Projects 16:47

23 weeks ago16:47

16:47

In this episode, CRob talks to Tara Tarakiyee, FOSS technologist at the Sovereign Tech Agency, which supports the development, improvement and maintenance of open digital infrastructure. The Sovereign Tech Agency’s goal is to sustainably strengthen the open source ecosystem, focusing on security, resilience, technological diversity and the people behind the code. 01:42 - Why the Sovereign Tech Fund became the Sovereign Tech Agency 03:59 - The ways the Sovereign Tech Agency supports open source infrastructure initiatives 04:42 - The four criteria for Sovereign Tech Agency funding: prevalence, relevance, vulnerability and public interest 06:51 - Sovereign Tech Agency success stories 09:09 Plans for the Sovereign Tech Agency in 2025 11:54 – Tara answers CRob’s rapid-fire questions 13:54 - Advice to those entering open source development or security field 14:55 - Tara’s call to action for listeners Episode links: Tara Tarayikee on Linkedin Sovereign Tech Agency homepage Apply for Sovereign Tech Fund investment Get involved with the OpenSSF Subscribe to the OpenSSF newsletter Follow the OpenSSF on LinkedIn…

What's in the SOSS? An OpenSSF Podcast

1
Alpha-Omega’s Michael Winser and Catalyzing Sustainable Improvements in Open Source Security 27:15

24 weeks ago27:15

27:15

In this episode, CRob talks to Michael Winser, Technical Strategist for Alpha-Omega, an associated project of the OpenSSF that with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code – and get them fixed – to improve global software supply chain security. 01:00 - Michael shares his origin story into open source 02:09 - How Alpha-Omega came to be 03:48 Alpha-Omega’s mission is catalyzing sustainable security improvements 05:16 - The four types of investments Alpha-Omega makes to catalyze change 11:33 - Michael expands on his “clean the beach” approach to impacting open source security 16:41 - The 3F framework helps manage upstream dependencies effectively 21:13 - Michael answers CRob’s rapid-fire questions 23:06 - Michael’s advice to aspiring development and cybersecurity professionals 24:44 - Michael’s call to action for listeners Links Michael Winser on LinkedIn Alpha-Omega homepage OpenSSF on LinkedIn Subscribe to the OpenSSF newsletter Get involved with the OpenSSF community…

What's in the SOSS? An OpenSSF Podcast

1
Jack Cable of CISA and Zach Steindler of GitHub Dig Into Package Repository Security 23:44

26 weeks ago23:44

23:44

CRob discusses package repository security with two people who know a lot about the topic. Zach Steindler is a principal engineer at Github, a member of the OpenSSF TAC and co-chairs the OpenSSF Security Packages Repository Working Group. Jack Cable is a senior technical advisor at CISA. Earlier this year, Zach and Jack published a helpful guide of best practices called “Principles for Package Repository Security.” 00:48 - Jack and Zach share their backgrounds 02:59 - What package repositories are and why they’re important to open source users 04:17 - The positive impact package security has on downstream users 07:06 - Jack and Zach offer insight into the "Prinicples for Package Repository Security" document 11:18 - Future endeavors of the Securing Software Repositories Working Group 17:32 - Jack and Zach answer CRob’s rapid-fire questions 19:31 - Advice for those entering the industry 21:28 - Jack and Zach share their calls to action Episode links: Zach Steindler on LinkedIn Jack Cable on LinkedIn OpenSSF on LinkedIn Securing Package Repositories Working Group Principles for Package Repository Security document Subscribe to the OpenSSF newsletter Get involved with the OpenSSF community…

What's in the SOSS? An OpenSSF Podcast

1
Red Hat's Rodrigo Freire and the Impact of High-Profile Security Incidents 16:58

28 weeks ago16:58

16:58

In this episode, CRob talks to Rodrigo Freire, Red Hat's chief architect. They discuss high-profile incidents and vulnerability management in the open source community. Rodrigo has a distinguished track record of success and experience in several industries, especially high-performance and mission-critical environments in financial services. 01:08 - Rodrigo shares his entry into open source 02:42 - Diving into the specifics of a high-profile incident 06:22 - How security researchers coordinate a response to a high-profile incident 10:33 - The benefits of a vulnerability disclosure program 11:57 - Rodgiro answers CRob's rapid-fire questions 13:43 - Advice for anyone getting into the industry 14:26 - Rodrigo's call to action for listeners 15:53 - The importance of the security community working together Episode links: Rodrigo Freire on LinkedIn Rodrigo's blog on Red Hat's response to the XZ incident discovery Get involved with the OpenSSF community…

What's in the SOSS? An OpenSSF Podcast

1
Canonical’s Stephanie Domas and Security Insight from a Self-Described “Tinkerer” 16:58

30 weeks ago16:58

16:58

In this episode, CRob talks to Stephanie Domas, CISO at Canonical, the creators of the popular operating system Ubuntu. Having started her career with over 10 years of ethical hacking, reverse engineering and advanced vulnerability analysis, Stephanie has a deep knowledge and passion for the hacker mindset. 01:14: Stephanie shares how she got her start in security 05:41 Interesting things Stephanie has discovered since becoming more directly involved with open source 08:20 The challenge of instilling trust into those who consume open source 12:42 Stephanie answers CRob’s rapid-fire questions 14:07 Stephanie’s advice to those getting into cybersecurity 15:43 Stephanie’s call to action for listeners Episode links: Stephanie Domas on LinkedIn Canonical homepage White House’s M-22-18 memorandum CISA RSAA Secure Software Development Attestation Form NIST Secure Software Development Framework (SSDF) SP 800-218 Get involved with the OpenSSF community…

What's in the SOSS? An OpenSSF Podcast

1
Intel’s Katherine Druckman and the Impact of Developer Relations 14:23

32 weeks ago14:23