Mark Curphey and John Viega -- Chalk

Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter. OWASP founder Mark Curphey and security veteran John Viega introduce Chalk, an open-source telemetry and observability tool designed to connect repositories, builds, deployments, and production systems. They explain how better provenance can eliminate irrelevant alerts, prioritize deployed software, trace incidents back to owners and commits, and confirm that fixes actually reached production. The conversation covers small-company and enterprise use cases, lessons from Log4Shell, performance overhead, supported platforms, and Chalk’s event model. Mark and John also discuss open-source sustainability and the Software Security Project before closing with candid views on where application security gets priorities wrong.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Mark Curphey and John Viega:→ Mark Curphey on LinkedIn→ John Viega on LinkedIn→ Chalk→ Crash OverrideMentioned in this episode:→ Crash Override→ Chalk→ The Software Security Project→ Atomic Habits→ Start With Why→ OWASP ZAP→ SigstoreFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Mark Curphey and John Viega: Chalk01:46 John’s path into application security04:20 The de facto silos separating development and production07:52 Chalk as telemetry for software engineering12:12 Why startups also need production visibility15:18 Log4Shell and the challenge of finding deployed software17:08 How security teams can use Chalk23:10 Chalk’s performance impact in production25:00 Supported platforms and frameworks28:00 Events, protocols, and outbound telemetry42:18 Holding commercial users of open source accountable46:32 Controversial opinions about AppSec48:09 Industry messages, books, and closing thoughts