The Open Source Paradox: Unpacking Risk, Equity, and Acceptance
summary
Covers concrete data: CVE counts balloon (4,400% growth from 1999 to 2024) while actual exploitation stays less than 1% exploited using SISA’s KEV and Verizon DBIR; BlackDuck finds 97% of codebases include OSS and 70% of code originates in OSS. Compares Red Hat’s 4,272 vulnerabilities (2,760 kernel CVEs = 69% of product CVEs; 0 of ~200 moderates known exploited) with a proprietary vendor’s 1,397 reported CVEs, arguing open code visibility creates a transparency penalty that requires different risk treatment, not blanket patching.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:05Open vs proprietary risk
- 3:54Vulnerability growth rates
- 10:14Security reporting transparency
- 14:08Red Hat risk report
- 20:07Proprietary reporting disparities
- 23:43Risk assessment beyond lists
- 28:45Software lifecycle considerations
- 33:29Open source transparency
- 36:17Accepting open vs proprietary risk
- 40:29Vulnerability disclosure equity
- 42:39Practical risk assessments
- 46:55Low/medium bug reporting
- 51:09Business vs security updates
- 53:19Actively exploited vulnerabilities
- 55:47Compliance and risk-based approaches
related talks
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
38mApplication Security in the age of Open Source
39mOpen source security: who’s responsible?
25mOWASP Top 10 Risks for Open Source Software
14mThe State of Open Source Vulnerabilities Management in 2019
30mDevSecOps: Understanding Open Source Software risk in your applications
49mTrustworthy Open Source: The Consequences of Success
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey