It’s Not Open Source, It’s You. Where Open Source Risk Comes From
summary
Sonatype uses Maven Central telemetry to show concrete failures and remedies: 35–38% of log4j downloads remain vulnerable even after a spike to 60–68% updated versions, and 96% of vulnerable downloads already have a fix available. Analysis of over 30,000 projects finds four practices that actually reduce risk—code review, no checked-in binaries, pinned dependencies and branch protection—and a GitHub-integrated product (Sonatype Lift) shows PR-time feedback drives fixes (Facebook example: overnight reports ignored, PR integration raised fix rates to ~70%).
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:15Brian's and Stephen's background
- 5:01State of the Software Supply Chain Report
- 9:404 practices of secure teams
- 12:45What eng leaders need to know about their software supply chain
- 22:44Cybercrime is like "VC funds invested into the bad guys"
- 29:09Security issues gap between management and ICs
related talks
31mOpen Source Supply Chain Threat Landscape - A Moving Target
30mSecure Open Source Practices
25mOWASP Top 10 Risks for Open Source Software
18mSecuring Open Source in Nomura’s Software Supply Chain
37mPerception vs Reality: What Data Says About Open Source Risk Management?
48mAn Introduction to the Newest Addition to the OWASP Top 10
30mDevSecOps: Understanding Open Source Software risk in your applications
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target