Where The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
summary
Three community engagements (Apache Airflow, Jenkins, Kubernetes) scan source trees and dependencies to find previously undetected bugs, report them responsibly, and ship fixes and PRs with exploit proofs; results include scanning ~2,000 Python projects (≈14,000 deps) to find ~350 bugs (≈150 security, 55 high severity) with ~65% fixed, Jenkins analysis finds 88 new bugs including 18 high-severity in 12 risky artifacts, and Kubernetes gaps reveal other tools miss seeded bugs; tooling centers on ICR intelligent code repair, a project clean beach data feed, and an actionable six Fs mitigation model while aiming for 72‑hour VEX reachability reports.
AI-written summary · about
chapters (14)
- 0:00Open source supply chain risks
- 1:03Software isn't truly yours
- 5:19Reactive software composition analysis
- 8:51Finding hidden vulnerabilities
- 13:10Humanizing bug reporting
- 17:27Garbage patches to clean beaches
- 20:46Clean Beach impact on Airflow
- 25:51Burden of known vulnerabilities
- 27:17Six mitigation strategies
- 39:09Evaluating new packages
- 41:37Reachability problem and alert fatigue
- 47:14Automating VEX generation
- 50:45Key takeaways and future
- 52:51Q&A
related talks
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
41mManaging the risk and growth of using Open Source Software
13mKeynote: Hacking the OSS Supply Chain
54mSupply Chain Security for OpenSource Projects
38mFinding Security Issues in Open Source
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
13mKeynote: Hacking the OSS Supply Chain