Unpacking Open Source Security in Public Repos
summary
Armo presents data: nearly 44,000 container images from about 180 registries and ~2,000 repos reveal that raw scanner counts overstate risk — BusyBox and libgcrypt appear in tens of thousands of images yet are rarely exploitable, a protobuf finding is a scanner false positive, and an nginx image shows ~400 reported vulns but only four loaded into memory. Graduated CNCF projects show slightly fewer issues (random workload fails ~35% controls vs ~38% general). Work in progress uses cubescape plus sniffer with eBPF to improve relevancy.
AI-written summary · about
chapters (6)
- 0:00Open source security in CNCF
- 2:40Vulnerabilities in container images
- 8:23Top vulnerabilities in CNCF
- 10:30Sniffer project introduction
- 12:38Kubernetes workload misconfigurations
- 14:46Summary and future work
related talks
34mUnpacking Open Source Security in Public Repos & Registries
35mUnpacking Open Source Security in Public Repos & Registries
37mThe State of Open Source Security
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
34mWhat We Learned Dissecting the World's Most Popular Containers