Building an open source security... (Fletcher Heisler, Marcelo Elizeche Landó)
summary
Open source IDP Authentic reaches 1M+ installations and scales from a Django codebase to a mixed stack with a partial Go rewrite and an active Rust rewrite PR, drops Redis for Postgres to simplify self‑host installs, and ships officially via Docker Compose, Kubernetes, AWS templates and a community‑maintained DigitalOcean one‑click. The project relicenses GPL→MIT, forms a public benefit corp, accepts VC to hire a team, publishes independent pen tests and manages CVEs with a 24‑hour disclosure process.
AI-written summary · about
chapters (15)
- 0:00Introduction and speakers
- 1:03About the presenters
- 2:08What is Authentic project
- 3:57Project history and growth
- 5:42Community growth and channels
- 7:07Prioritizing community responses
- 8:52Community-driven roadmap
- 9:58Tech stack evolution
- 13:17Security transparency approach
- 15:47Licensing trade-offs
- 17:31Business model and PBC
- 20:19Sustainable funding options
- 21:00Choosing what to open source
- 22:22Conclusion and musical wrap-up
- 23:45Q&A session
related talks
44mSecurity Research with Open Source Software: Vol. Omega
10mBuilding in security for open source projects
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
44mSlaying the Dragons: A Security Professional’s Guide to...
49mTrustworthy Open Source: The Consequences of Success
17mBuilding Secure Open Source Communities From the Ground Up
59mSecurity in the Open: OSS and AWS
43mApplication Security is a Community Effort