Better, Faster, Stronger: How the Global Acceleration of OS Development Is Changing
summary
Global open source activity drives a 742% rise in supply‑chain attacks while roughly 90% of application code comes from OSS and 96% of vulnerable downloads are avoidable. Predictive models flag 64–65% of dependency choices as sub‑optimal, 31–33% optimal, and safety scoring reaches ~86% accuracy at predicting near‑term vulnerabilities. Recommended practices: favor packages two releases behind the cutting edge, keep small dependency trees, use Sigstore and OSSF scorecard checks, and automate SBOMs with tools like bomb doctor and the Sonatype safety rating to cut remediation time.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:28Supply Chain Security Overview
- 3:09State of Open Source in 2022
- 5:27Common Attack Vectors
- 9:05Predicting Vulnerabilities
- 12:32Dependency Hygiene
- 14:46Industry Survey Results
- 17:27Mitigating Risk Factors
- 20:15Sonotype Safety Rating
- 22:27Improving Remediation
- 25:24SBOM Doctor Tooling
- 28:31Community Security Slams
- 30:45Ecosystem Hardening Efforts
- 33:37Conclusion and Q&A
related talks
41mManaging the risk and growth of using Open Source Software
38mApplication Security in the age of Open Source
45mPanel Discussion: Managing Open Source...
09mSecuring the Software Supply Chain with Open Source
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
49mTrustworthy Open Source: The Consequences of Success
13mKeynote: Hacking the OSS Supply Chain
39mOpen Source Software Supply Chain Security — Why does it matter?