Why Building Your Ship (Application) with Raw Materials is a Bad Idea!
summary
Modern applications contain a lot of third‑party code: an average Java project pulls in 150 dependencies with about 10 releases per dependency per year (effectively tracking ~1,500 updates annually). SBOMs (CycloneDX, Maven plugin, buildpacks) and signatures are now mandatory for some government customers, and Sonatype just released espon manager to ingest and manage SBOMs. Example of the risk: roughly 33% of Log4j downloads last week still reference the worst vulnerable version, showing inventories and continuous scanning are essential.
AI-written summary · about
chapters (17)
- 0:00Jamie L Coleman Intro
- 0:55Agenda: What will I talk about today?
- 1:40HMS Victory
- 2:52Open Source is amazing!
- 3:16Benefits of FOSS
- 3:55Supply Chain Problems
- 4:35The three points of supply chain attacks
- 5:25Software Composition Analysis
- 6:17Why Security in Open-source matters!
- 8:25Legislation!
- 9:52Security Bill of Material (SBOM)
- 10:53Security Posture
- 12:05What are raw materials?
- 14:53Static Analysis Tools
- 15:44Summary
- 17:44Who wants some free Swag?
- 19:41Slides and Recordings
related talks
34mWhy Building Your Ship (Application) with Raw Materials is a Bad Idea!
37mThe Death Star and the Ultimate Vulnerability
24mDependency Track Fortifying The Supply Chain
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
54mSupply Chain Sec /w Dependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
45mPanel Discussion: Managing Open Source...
35mMachines Making Software