Keynote: Fighting The Next War - Future Threats to OSS and Software Supply Chain...
summary
History shows protocol fixes like DNS cache poisoning fix and the Bernstein case enable cryptography, yet old bugs persist: a 2007 tarfile CVE propagates through projects and Trellix submits 61,000 automated pull requests to patch unsafe tar extraction while only ~15 projects respond. Sigstore gains traction for artifact signing but gaps remain. New risks include AI-driven spearphishing, maliciously crafted pull requests that overwhelm maintainers, identity spoofing, and regulatory pressure from the EU Cyber Resilience Act.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:41The Past
- 3:32Dan Kaminsky
- 6:27trellix
- 9:40Time
- 12:01Risk
- 13:22Identity
- 14:36Free Writers Regulation
- 16:08OSS Working Groups
- 16:55Conclusion
related talks
13mKeynote: Hacking the OSS Supply Chain
11mKeynote: Securing Open Source
13mKeynote: Hacking the OSS Supply Chain
04mKeynote: A Secure Supply Chain Vision
58mKeynote: What Got Us Here Wont Get Us There
01h 00mKeynote - Our Kryptonite: A Defendable Internet
37mStrengthening the Cybersecurity Ecosystem
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page