Airflow Beach Cleaning - Supply Chain Security with Community in Mind
summary
A focused supply-chain exercise uses CycloneDX SBOMs and automated scorecard checks to evaluate 719 dependencies, starting with 16 high-risk packages and a spreadsheet that auto-generates remediation actions. Results include rescuing Chroner by moving it under Pallet Echo, Google backporting patches for a transitive vulnerability, and removing a brittle stack by switching to FastAPI. The operational rule is the 3F framework — fix, fork, or forget — applied to prioritize human outreach and maintainable fixes.
AI-written summary · about
chapters (16)
- 0:00Alpha Omega intro and mission
- 1:06Alpha Omega's open source security
- 2:31XZ Utils lessons and risks
- 4:55Beach cleaning strategy
- 6:19Airflow overview and security
- 8:05Airflow security improvements
- 9:48Collaboration and dependency audits
- 11:35Human connections in supply chain
- 14:23Maintainer relationships in security
- 16:52Upstream supply economics
- 19:17Chroner project case study
- 20:42Transitive dependency fixes
- 21:25Dependency removal and FastAPI
- 22:27Airflow security insights
- 23:49Cross-organizational security problems
- 24:55Q&A
related talks
32mAirflow Beach Cleaning - Securing Supply Chain
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
23mSupply Chain Security using Free and Open Tools- 45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
21mSecuring Diverse Supply Chains Across Interconnected Systems
24mDependency Track Fortifying The Supply Chain
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects