Security in the Open: OSS and AWS
summary
AWS states 96% of codebases contain open source and describes concrete work: s2n (≈20k LOC, 80k tests) and libcrypto with FIPS validation; Corretto as a supported OpenJDK distribution; Firecracker (125 ms microVMs) and Bottlerocket for container hardening; Cedar as a formally verified authorization language; OCSF for security telemetry; Snapchange fuzzing for VM workloads; hybrid post‑quantum key exchange in production; $10M funding to OpenSSF and targeted rewrites to Rust for critical network parsers.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:00Synopsis
- 1:36Why is OSS important
- 6:40Secure consumption
- 10:53Work Upstream
- 11:35Workup Stream
- 15:21Openjdk
- 17:39Rust
- 20:33Kubernetes
- 24:39OSS Security
- 31:14S2N
- 38:44Formal Verification
- 42:43Snap Change
- 48:38Security Responsibilities
- 52:03Memory Safety
related talks
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
34mOpen Source at Amazon
14mand beyond: Securely managing open source on AWS
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
57mFrontiers in Securing the Open Source Ecosystem
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
23mAWS and open source: The cloud and open source are better together