
The Bug we Let Live: Episode 1
Last month, governments switched off their own websites because of two hidden flaws in software that runs a huge share of the web. The flaws were a very old kind of mistake: memory unsafety, the class of bug behind roughly 70% of the most serious security flaws Microsoft and Google have found in their own code. In this first episode, host Sarina Gandy traces the bug from a 1972 government report to Aleph One’s 1996 paper “Smashing the Stack for Fun and Profit,” meets the engineers who fought it, and hears from the people who paid the price when it got loose, from hospitals locked out by WannaCry to activists targeted through their phones. In this episode: Rob Joyce, former NSA cybersecurity leader David “Dwizzzle” Weston, Microsoft Bob Lord, Chief Strategy Officer, Software Safety Institute Lauren Zabierek, Co-founder and CEO, Software Safety Institute Tarah Wheeler, cybersecurity executive and doctoral candidate, University of Oxford Pavlina Pavlova, Critical Cyber Nicole Perlroth, author of This Is How They Tell Me the World Ends Yael Grauer, formerly of Consumer Reports Adam Shostack, threat modeling expert Elias Levy (Aleph One), author of “Smashing the Stack for Fun and Profit” Crispin Cowan, creator of StackGuard Chapters: 00:00 Cold open: the websites that went dark 02:33 You already know this bug 04:19 Whose problem is this? 06:32 Seventy percent 07:26 WannaCry and the NHS 08:49 Audrey’s story 10:19 What getting hacked really means 12:00 No setting to change 13:03 What the bug actually is 14:46 What it has cost us 16:01 The 1972 warning 18:26 Smashing the Stack 19:51 Finding Aleph One 22:43 StackGuard and the 300 Spartans 24:02 Everything we tried 27:09 The bug that never left 29:19 NotPetya 31:19 AI changes the math 32:46 Whose problem is it now? The Bug We Let Live is an audio documentary from the Software Safety Institute, with generous support from Cyber Florida. Produced by Sarina Gandy. Co-produced by Rex Wilson. For more information, visit softwaresafety.org.













