The Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source
summary
Argues that the vulnerability model built for funded vendors collapses for OSS: 40 million component versions with most maintained by single unpaid people, 88% of components are present but not reachable, yearly CVE volume rising from ~10k to 40k drives maintainer burnout and 108 disputed records in 2024. Proposes a Federated Responsibility model using stewardship (EU Cyber Resilience Act) and ASIDP to attach supplier context and replace the Disputed tag with a Conditional status so records carry actionable enterprise risk without overloading volunteers.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:10Vendor-centric vulnerability ecosystem
- 2:38Open source scale and challenges
- 3:45CNA users group findings
- 5:08Five biases in reporting
- 8:39Severity scoring issues
- 10:03Unfunded mandates and burnout
- 11:49Enterprise versus maintainer expectations
- 12:52Disputed vulnerability trap
- 14:18Federated models to address bias
- 16:45Separation of concerns
- 17:27Replacing binary decisions
- 18:32ASIDP and contextualized records
- 20:15Responsibility in federated models
- 21:01Fix the model, not the data
- 22:29Q&A
related talks
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
11mVulnerability Supply Chains
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
24mLessons from OSV: Vulnerability Management for Open Source
13mManaging Vulnerabilities in Open-Source Dependencies
40mManaging Risk Across the Vulnerability Ecosystem