Keynote: How I learned to stop worrying and love CVEs
summary
Open source generates ~50,000 CVEs this year (~130/day) largely driven by AI, so the response is full automation: Hummingbird builds minimal distroless containers from upstream, runs SCAP scans and Testing Farm tests, uses Renovate and RPM lockfiles, and ships about 1,000 autonomous container updates per week with a goal of zero known CVEs at delivery and fixes available within 24 hours. Agent-assisted code generation is reviewed by humans, pipelines are reproducible, and a three-hour Git-to-image example shows the velocity.
AI-written summary · about
chapters (15)
- 0:00CVEs and open source security
- 3:12CVE surge and AI detection
- 7:30CVEs are now detectable
- 11:41Hummingbird and zero-CVE images
- 13:05Hummingbird automates security fixes
- 17:45Responsible AI and accountability
- 18:32Backporting and software debt
- 20:19Red Hat and IBM's $5B investment
- 22:05Automating packaging and updates
- 24:31Automated testing for rapid fixes
- 26:37Ownership of dependencies
- 28:02AI for vulnerability detection
- 29:24Rust and AI collaboration
- 30:05Stopping CVE cycle
- 31:11Q&A on Hummingbird and Renovate
related talks
14mKeynote: The Human Cost of Security in the AI Era
14mKeynote: Keep Calm and Keep Coding: How To Not Panic When Big CVEs Drop
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
16mKeynote: There Is Just One Way to Do Open Source Security: Together
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
15mKeynote
40mCloud Native Security: A New Paradigm for a New World