Strengthen open source software supply chain security: Log4Shell to xz
summary
Open source is deeply pervasive: industry scans show 96% of codebases include OSS and 78% by volume is open source. Past crises produce concrete fixes — a million hosts patch in ~24 hours for Heartbleed, AWS builds S2N with formal verification and SMT checks (tests outnumber code 7:1), Firecracker boots VMs in ~125 ms, and a malicious xz campaign runs ~2.5 years but is caught before wide deployment. Still, troubling telemetry shows 30% downloads vulnerable this month; some projects shrink dependencies from 135 to 3.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 1:49Pervasiveness of open source
- 7:42Supply chain security examples
- 15:54Log4Shell vulnerability
- 18:21XZ backdoor discovery
- 23:25Package repository risks
- 32:17Banning open source unrealistic
- 35:49Generative AI in security
- 39:22Open source health metrics
- 44:04Developer responsibility
- 51:43Dependency management challenges
- 58:55AWS open source pillars
- 1:05:12Open source funding commitment
related talks
18mIT Security – Don’t let Open Source Software become the next menace
49mTrustworthy Open Source: The Consequences of Success
13mKeynote: Hacking the OSS Supply Chain
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
09mSecuring the Software Supply Chain with Open Source
59mSecurity in the Open: OSS and AWS
38mApplication Security in the age of Open Source
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey