Nerding Out With Viktor

In this episode of Nerding Out with Viktor, Viktor Petersson sits down with Carl Richell, founder and CEO of System76, to unpack how a small Linux-focused hardware company grew into a full-stack open source innovator. They explore System76's journey from shipping Ubuntu laptops to designing open firmware, building a factory, and launching their own desktop environment, Cosmic. Carl shares hard-earned lessons on supply chain trust, hardware enablement, and why openness, done right, can scale. If you're into Linux, open hardware, or building products that last, this one's for you.

In this episode of Nerding Out with Viktor, host Viktor Petersson welcomes back Jon Seager, VP of Engineering at Canonical, for a candid conversation about managing remote teams. They explore how Canonical structures its fully distributed engineering org, why hybrid meetings rarely work, and how to build systems that support clarity, autonomy, and actual output. With Jon's experience scaling teams at Canonical and Viktor's 15+ years of running distributed organizations, this episode offers a clear, practical view of what makes remote teams succeed. Topics include performance frameworks, calendar ownership, documentation debt, onboarding traps, and hiring in the age of AI. This is a must-listen for engineering leaders, remote managers, and anyone serious about scaling remote teams.

In this episode of Nerding Out with Viktor, host Viktor Petersson sits down with Vlad Trifa, founder of Zimt and co-founder of EVRYTHNG, to explore why Web3, crypto, and blockchain often fail to deliver on their promises in the real world. Drawing from Vlad's extensive background in IoT, supply chain traceability, and decentralized systems, they dive into the cultural and technical challenges that make blockchain adoption difficult in enterprise environments. The conversation unpacks how tokenomics and DAOs are frequently misused, why wallet UX and self-custody are blockers to mainstream adoption, and what meaningful NFT use cases might look like beyond digital art. They also discuss why many "decentralized" solutions are just overengineered databases, and how regulation, governance, and real-world incentive alignment remain unsolved problems in Web3 development. This episode is essential listening for Web3 builders, blockchain skeptics, and anyone looking for a clear-eyed take on what it really takes to scale decentralized technologies beyond prototypes.

In this episode of Nerding Out with Viktor, host Viktor Petersson speaks with Joshua Watt of Garmin and Ross Burton of ARM to explore how the Yocto Project is evolving to meet the growing demands of software supply chain security, embedded Linux customization, and long-term product maintenance. As two long-time contributors to Yocto and OpenEmbedded, Joshua and Ross share hard-earned insights on how build-time Software Bill of Materials (SBOMs) offer deeper accuracy and compliance benefits compared to traditional post-build analysis. They dig into how the integration of SPDX 3.0 in Yocto enables better license tracking, reproducibility, and component transparency, critical features for developers building connected products in regulated industries like industrial IoT, telecom, and automotive. The conversation also covers how VEX metadata can be used to prioritize vulnerabilities in real-world environments, and why reproducible builds using BitBake's hashserver infrastructure are becoming a cornerstone of secure firmware development. As global regulatory frameworks like the EU Cyber Resilience Act (CRA) push for stricter transparency and vulnerability management, the Yocto Project's native SBOM tooling is helping teams future-proof their embedded Linux stacks. Joshua and Ross also discuss the challenges of managing multi-layer board support packages (BSPs), handling closed-source components responsibly, and navigating SBOM creation across vendors in complex system builds. This episode is a must-listen for embedded engineers, firmware architects, and product teams who want to build secure, scalable Linux-based devices while staying ahead of compliance and lifecycle management needs.

In this episode of Nerding Out with Viktor, host Viktor Petersson is joined by Kevin Henrikson, an experienced engineering leader who's worked with Zimbra, Microsoft, and Instacart, to share real startup founder lessons on how to scale engineering teams, build resilient systems, and manage growth through acquisitions. Kevin explains what founders often get wrong when scaling, why a simple weekly shipping cadence changed everything at Outlook Mobile, and how aligning around a single operational metric helped Instacart navigate massive demand during the COVID surge. We talk about how to avoid "organ rejection" during an acquisition, the shift from founder to advisor inside large companies, and what breaks first when scaling from 10 to 1500 engineers. Kevin also covers org design for distributed teams, why CTOs need to think about people and systems as much as code, and how he's using AI and automation to operate leaner, more scalable SaaS businesses. Whether you're a startup founder, CTO, or building your first technical team, this episode is packed with insights from someone who has done it at every stage.

In this episode of "Nerding Out with Viktor," host Viktor Petersson is joined by Vlad A Ionescu, founder and CEO of Earthly, to explore the realities of modern CI/CD pipelines, why developer experience remains fragmented, and how platform and security teams can work more effectively across organizations. Vlad outlines the origins of Earthly and how their open-source build automation tool enables consistent CI/CD across teams. The conversation covers GitHub Actions, the challenge of running pipelines locally, and why container-based workflows offer practical improvements in debugging and collaboration. The discussion moves to Earthly's second product, Lunar, which focuses on monitoring and enforcing engineering practices in the SDLC. Vlad explains how this enables organizations to apply policies like test coverage and vulnerability scanning, without relying solely on teams to adopt them individually. Other key topics include plugin governance, differences in developer infrastructure at large companies versus smaller teams, and the complexity of managing shared CI/CD ownership. The conversation also touches on hybrid work challenges, remote team management, and strategies for building trust and documentation in distributed teams. Toward the end, the episode explores the potential impact of AI in software development. Vlad shares why he sees AI as a tool for accelerating skilled engineers, rather than a full replacement, and highlights the risks of relying on machine-generated code without proper verification. Whether you're working on developer tooling, building remote teams, or thinking about the role of AI in engineering workflows, this episode offers a grounded and technical perspective.

In this episode of "Nerding Out with Viktor," I'm joined by Johan Christenson, founder of Cleura, to dig into one of the most critical questions facing European tech today: how do we build a sovereign cloud that can actually compete? Johan brings decades of experience in open infrastructure and a front-row seat to the evolution of cloud computing. We talk about why Europe still leans so heavily on U.S. cloud platforms, and the real-world risks that come with that dependency whether it's pricing, control, or strategic leverage. We get into the friction points that keep Europe from moving faster: outdated procurement practices, broken incentive structures, and the lack of deep technical understanding inside policymaking circles. Johan also shares what it's been like building on OpenStack from the early days, and what Cleura has learned about scaling sovereign infrastructure in a space dominated by hyperscalers. I really enjoyed diving into how cloud-native tools like Kubernetes can unlock more flexibility and how standardization could help level the playing field for smaller providers. We also touch on the limitations of regulation when enforcement is missing, and why alignment between government goals and operational behavior is long overdue. Whether you're in cloud infrastructure, policy, or just curious about how Europe can chart its own course, this one's packed with insight.

In this episode of "Nerding Out with Viktor," Warren Houghton returns to pull back the curtain on the covert world of physical penetration testing. As a seasoned security expert from Pentest Partners, Warren shares his extensive experience in breaching physical security measures, offering listeners a rare glimpse into the methodologies and techniques used by professional security testers. Viktor and Warren explore the fascinating realm of physical security assessments, from initial reconnaissance and planning to the execution of sophisticated social engineering tactics. Warren reveals how security professionals can clone access badges, bypass reception areas, and exploit human psychology to gain unauthorized access to secured facilities. Through compelling real-world examples, he demonstrates how even seemingly robust security systems can be compromised by determined adversaries who understand the vulnerabilities in both technology and human behavior. The conversation delves into the critical importance of physical security in the overall security posture of organizations, particularly those with sensitive data centers or restricted areas. Warren provides valuable insights into common weaknesses in building security, explaining how organizations can identify and address these vulnerabilities before they're exploited by malicious actors. He also discusses the ethical considerations and legal frameworks that govern physical penetration testing, emphasizing the importance of proper authorization and scope definition. Whether you're a security professional looking to enhance your organization's physical defenses, an IT manager concerned about holistic security approaches, or simply fascinated by the world of security testing, this episode offers invaluable knowledge about the realities of physical security in today's complex threat landscape. Join Viktor and Warren for this eye-opening discussion that will forever change how you view the security of physical spaces around you.

Join host Viktor Petersson as he sits down with Marc Pous of Balena to explore the ever-evolving world of IoT, from remote management and fleet updates to security legislation and software bills of materials (SBOMs). Marc reveals how Balena pioneered container-based deployments on devices like Raspberry Pi, explains why over-the-air (OTA) updates are critical for any hardware project, and offers insights into upcoming regulations such as the Cyber Resilience Act (CRA). Discover why IoT is quickly becoming "just connected products," how businesses can adapt to this new era, and why it's time to rethink everything from SD cards to DevOps workflows. Whether you're an IoT veteran or curious about the future of connected tech, this episode offers a deep dive into managing devices at scale and keeping them secure.

In this episode of Nerding Out with Viktor, host Viktor Petersson sits down with Dustin Kirkland from Chainguard for an illuminating discussion on modern supply chain security and container hardening. Drawing from his rich experience across tech giants like IBM, Red Hat, Canonical, and Google, Dustin shares invaluable insights into the evolution of container security and the critical importance of maintaining secure infrastructure. The conversation delves deep into Chainguard's innovative approach to building minimal, hardened container images directly from source code. Dustin explains their groundbreaking Zero-CVE initiative, demonstrating how continuous rolling updates and careful dependency management can dramatically reduce vulnerability exposure. Through practical examples and real-world scenarios, he illustrates the delicate balance between security, functionality, and maintainability in modern container deployments. Viktor and Dustin explore the intricate world of Software Bills of Materials (SBOMs), diving into how attestations and digital signatures through tools like Sigstore and Cosign create a robust chain of trust. The discussion illuminates the critical role these technologies play in guaranteeing software provenance and enabling rapid vulnerability patching across complex deployments. The episode also tackles the challenges of navigating stringent compliance requirements such as FedRAMP and HIPAA, with Dustin sharing practical strategies for maintaining security without sacrificing agility. The conversation extends to the nuances of open source licensing and the future landscape of infrastructure security, offering listeners valuable insights into maintaining secure, modern systems in an increasingly complex technological environment. Whether you're a security professional, container enthusiast, or technology leader, this episode provides essential knowledge about the future of supply chain security and container hardening. Don't miss this comprehensive exploration of how organizations can build and maintain secure infrastructure in today's rapidly evolving technology landscape.

In this episode of "Nerding Out with Viktor," Warren Houghton from Pentest Partners joins Viktor to explore the fascinating world of professional penetration testing. As they delve into the intricacies of "legal hacking," Warren shares invaluable insights into the methodologies, tools, and best practices that define ethical hacking in today's cybersecurity landscape. The conversation covers crucial aspects of pentesting, from obtaining proper authorization and managing scope to selecting the right tools for different scenarios. Warren explains how seemingly minor oversights, such as exposed .git directories, can lead to significant security breaches, and demonstrates why thorough documentation and proper paperwork are as critical as technical expertise in professional pentesting. Viktor and Warren explore the essential toolkit of a modern pentester, discussing tools like Burp Suite for web application testing, Nmap for network discovery, and Metasploit for exploitation. Through real-world examples and engaging stories from the field, Warren illustrates how attackers can leverage small vulnerabilities to gain broader access to networks and systems. The episode also serves as a valuable resource for aspiring cybersecurity professionals, with Warren offering guidance on certifications, practical experience, and developing the investigative mindset necessary for success in the field. The discussion concludes with a preview of physical security testing, highlighting how the principles of penetration testing extend beyond the digital realm to encompass physical security controls and access systems.

In this episode of "Nerding Out with Viktor," Kate Stewart from the Linux Foundation and Gary O'Neall, a long-time SPDX contributor, join Viktor to explore the evolution and impact of SPDX (Systems Package Data Exchange) in software transparency. The conversation traces SPDX's journey from its origins in license compliance to its current pivotal role in security and vulnerability tracking, revealing how this open standard is shaping modern software development practices. Kate and Gary provide deep technical insights into the challenges teams face when generating accurate Software Bills of Materials (SBOMs), including complex scenarios involving circular dependencies and component uncertainty. Through practical examples from their work with various organizations, they demonstrate how these real-world challenges have influenced the development of SPDX tools and specifications. The discussion delves into current initiatives for integrating SBOM generation into build systems, with specific focus on implementations in the Zephyr and Yocto projects. They also explore ongoing efforts to implement build-time SBOM generation for the Linux kernel, highlighting both the technical approach and practical benefits for development teams. Viktor, Kate, and Gary examine the growing regulatory requirements surrounding SBOMs, particularly in safety-critical systems, and how SPDX 3.0 is being designed to meet these demands while supporting modern CI/CD pipelines. The conversation illuminates the technical considerations behind maintaining compatibility with existing tools while expanding functionality for new use cases. As an open, community-driven project, SPDX continues to evolve with industry needs, offering solutions for compliance, security vulnerabilities, and supply chain transparency in modern software development workflows.

In a captivating deep dive into the world of advanced storage systems, Viktor welcomes ZFS expert and FreeBSD developer Allan Jude to explore the intricate landscape of modern filesystem architecture. This episode of Nerding Out with Viktor peels back the layers of enterprise storage solutions, offering listeners a masterclass in both theoretical foundations and practical implementations. Allan, drawing from his extensive experience in FreeBSD development and ZFS optimization, guides listeners through the sophisticated underpinnings of ZFS's copy-on-write architecture. The discussion illuminates how this fundamental design choice revolutionizes data integrity and storage management, while exploring the real-world implications for enterprise deployments. Through concrete examples and technical insights, Allan demonstrates why ZFS continues to be the go-to solution for organizations demanding unwavering data reliability. The conversation takes an exciting turn as Viktor and Allan explore FreeBSD's networking capabilities, unraveling how its architectural decisions contribute to its reputation for exceptional performance in production environments. Allan shares fascinating insider perspectives on why industry giants repeatedly choose FreeBSD for their critical infrastructure, backing these insights with compelling technical analysis and real-world case studies. Listeners will find themselves immersed in practical wisdom as Allan shares battle-tested strategies for ZFS deployment and optimization. The discussion covers everything from fine-tuning storage pools to leveraging advanced features for maximum efficiency, providing administrators and developers with actionable takeaways they can implement immediately. The episode also ventures into forward-looking territory, examining emerging trends in storage technology and operating system development. What sets this episode apart is Allan's remarkable ability to convey complex technical concepts with clarity and precision, making advanced topics accessible without sacrificing technical depth. Whether you're managing enterprise storage infrastructure, developing system-level software, or simply passionate about cutting-edge filesystem technology, this conversation offers invaluable insights into the present and future of storage solutions. Allan's expertise, combined with Viktor's engaging interview style, creates a compelling narrative that bridges theoretical knowledge with practical application in the ever-evolving landscape of enterprise storage and operating systems.

In this thrilling episode of Nerding Out with Viktor, host Viktor Petersson is joined by Ken Munro, a leading figure in cybersecurity and an expert in penetration testing. Together, they dive into the hidden world of aviation cybersecurity, shedding light on the challenges, discoveries, and unexpected vulnerabilities that exist within modern aircraft systems. With decades of experience and a passion for making aviation safer, Ken guides listeners through some of the most fascinating aspects of airplane hacking, responsible disclosures, and how his team tests aircraft security to uncover vulnerabilities. The conversation kicks off with an exploration of how Ken entered the field of aviation cybersecurity, sharing tales of hacking decommissioned planes in a scrapyard—a unique method that allowed his team to practice without endangering passengers or active fleets. Ken provides insight into his early career in the antivirus industry, his background as a general aviation pilot, and how these experiences culminated in his journey into the world of aviation security. He talks about the infamous time he hacked airplane entertainment systems and even how, with the right setups, it's possible to rickroll an entire flight! Ken and Viktor then turn their attention to one of aviation's most pressing security concerns: the electronic flight bag (EFB). EFBs, now commonly used in commercial cockpits, have replaced the hefty stacks of maps and manuals pilots once carried. Yet, while EFBs improve efficiency, Ken highlights the vulnerabilities in their design. For instance, by manipulating data within the EFB's performance calculators, attackers could mislead pilots about crucial factors like runway length or engine thrust. Ken explains the dire implications of these weaknesses and the sophisticated tactics used to secure these systems. The episode also covers GPS spoofing, a technique used by some adversaries to mislead or disrupt an aircraft's navigation system. Ken describes the complexities of GPS spoofing and jamming, explaining how such attacks can confuse onboard navigation and leave pilots relying on outdated or incorrect data until they're able to safely land. Ken's research into GPS vulnerabilities has revealed the scope of these threats, particularly in areas of high political tension. The discussion moves into the intricacies of responsible disclosure in the aviation industry, as Ken explains the delicate balance between informing manufacturers about security issues while respecting the time-consuming processes they require for safety certification. He shares examples of working with Boeing and Airbus, noting how long it can take to fix even minor vulnerabilities due to the rigorous testing needed to maintain passenger safety. Ken even praises Boeing for their commitment to addressing issues, despite the inevitable delay between discovery and patching. Viktor and Ken wrap up by discussing the industry's gradual shift towards transparency in handling disclosures and threats. They talk about the importance of collaboration between cybersecurity professionals, manufacturers, and government regulators to enhance aviation security continuously. Ken emphasizes that, while security is critical, safety remains paramount in aviation, which often means extended timelines for vulnerability patches. For anyone fascinated by cybersecurity, aviation, or the hidden challenges of keeping the skies secure, this episode of Nerding Out with Viktor is an eye-opening deep dive into a world that affects millions of passengers daily. Ken Munro's expertise, combined with Viktor's curiosity and insights, makes for a compelling and informative conversation that reveals both the resilience and the risks of modern aviation systems. Don't miss this must-listen episode on the cutting edge of cybersecurity and aviation.

In this enlightening episode of Nerding Out with Viktor, Viktor Petersson welcomes authentication expert Massi Gori to delve deep into the ever-evolving world of digital identity and security. Massi, a seasoned product manager at Canonical, brings over 17 years of experience in identity management, from foundational protocols like LDAP and Kerberos to the latest advancements in passkeys and zero-trust models. The conversation begins with a historical journey through the evolution of authentication technologies, highlighting the pivotal roles of LDAP and Kerberos, which laid the groundwork for modern identity verification. Massi reflects on the shift from SAML to OAuth and OpenID, underscoring how these standards set the stage for today's Single Sign-On (SSO) systems and federated identity management. Viktor and Massi explore the crucial distinction between authentication (verifying who you are) and authorization (determining what you can access), unraveling the often-complex concepts behind identity management. Massi emphasizes the importance of user management and identity governance, illustrating how each plays a vital role in securing enterprise environments. They also cover the rising significance of Multi-Factor Authentication (MFA) and the progression from hardware tokens to modern soft tokens, which have simplified yet bolstered the security framework for millions. The discussion transitions to FIDO2 and WebAuthn standards, a major leap toward a passwordless future. Massi shares insights into the mechanics behind these protocols and how FIDO2's architecture enhances security against adversaries-in-the-middle and other sophisticated attacks. He also addresses the role of biometrics, behavioral metrics, and device-based security as essential components of the zero-trust framework, shedding light on why continuous verification is more important than ever in the digital age. Towards the end, Viktor and Massi discuss passkeys—the new generation of passwordless authentication. Massi explains how passkeys combine the security of FIDO2 with the convenience of cloud sync, making it easier for users to recover credentials without sacrificing security. The duo addresses the trade-offs between using traditional hardware tokens like YubiKeys and the cloud-based flexibility of passkeys, giving listeners a comprehensive look at the future of authentication. This episode is a must-listen for tech enthusiasts and professionals alike, offering a thorough understanding of where digital identity is headed and what companies can do to stay ahead in securing user access.