Jared's Technology Podcast Network · Jared Rimer

Remember Dan Kaminsky and the Newsletter for Dec 16, 2025

December 23, 2025·1 hr 40 min·4 clips

Remembering Dan Kaminsky and why his legacy matters for security and accessibility.

The episode starts with a production note about changing the podcast workflow so the host can work with smaller files instead of one large recording. That change is presented as a practical way to make re-recording easier and keep track of where he is in the material. He then identifies the issue as SANS News Bytes for the newsletter dated December 16th, 2025, volume 27, number 91. Before the main list begins, he mentions that an item previously advertised by SANS is being included even though the show does not normally run ads. The host also points out that the table of contents sits on page T3. The core segment turns to MITRE's annual list of the 25 most dangerous software vulnerabilities. He describes MITRE as the agency tied to the CVE numbering system, which is how vulnerabilities are tracked. The list is based on analysis of more than 39,000 CVEs. He names Cross-Site Scripting as the top item for 2025. SQL Injection and Cross-Site Request Forgery follow close behind. Missing Authorization and Out-of-Bounds issues also appear near the top. The remaining items include Code Injection, OS Command Injection, Path Traversal, Out-of-Bounds Read, and Use After Free. He notes that MITRE has also published a methodology page explaining how the list was compiled. The host then steps back from the catalog and tries to simplify it into patterns that listeners can remember. One theme is input validation, sanitization, and the danger of misplaced trust in outside data. Another is authorization and access control, especially the need to validate what access is granted and to remove it when it is no longer needed. He emphasizes that strong MFA is essentially turnkey these days, which lets developers focus on ACLs and process discipline instead. He underscores that the scale of the problem is enormous, with roughly 39,000 CVEs and almost none of them likely to be completely patched everywhere, even among the top 25. The tone stays practical and wary rather than dramatic. The closing section shifts away from the vulnerability list and back to the show's own production status. He says they are just about caught up with SANS. He expects one more episode to go into Braille before the next update. He is unsure whether SANS will release anything during Christmas week, but says they will handle it when it arrives. The episode ends with thanks to listeners and a promise to keep moving forward through the holiday break.

As heard by us

A plainspoken security rundown that turns a vulnerability list into usable habits.

This episode reads as a practical security roundup built around MITRE's 2025 list of 25 dangerous software vulnerabilities. It does a solid job of turning CVEs and CWE themes into everyday guidance, especially around validating external input, watching authorization and access…

Read the full review in PlayNext →

Why you'd press play

Want a calm walk-through of MITRE's 2025 list of dangerous vulnerabilities?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network