Destination Linux 446: Ubuntu From The BIOS & The Quest for an Open Source Mac
Dec 16, 2025
Craig Rowland, CEO of Sandfly Security, a leader in agentless Linux protection. He walks through supply chain risks, malicious VS Code extensions, and intrusion detection strategies. The conversation also covers ravynOS’s bid to recreate a macOS-like open system and Canonical’s BIOS-based Ubuntu install news. Short, sharp, and tech-focused.
AI Snips
Chapters
Transcript
Episode notes
Restrict And Vet Third-Party Extensions
- Do restrict and audit third-party code and extensions before adding them to your environment.
- Craig Rowland warns VS Code extensions and similar add-ons can harvest tokens and become supply-chain attack vectors, so vet and limit them.
Open Source Visibility Is Not Automatic Security
- Open source availability doesn't guarantee safety because projects pull many volunteer-maintained dependencies.
- Craig notes modern projects have deep dependency trees that are impractical for manual auditing, creating trust-based risk.
Use Automated Tools To Scale Dependency Audits
- Do use automated auditing and supply-chain risk tools for large dependency graphs and open-source projects.
- Craig suggests open-source maintainers reach out to firms or free tooling to help audit dependencies since manual review is unrealistic.