From a Security Expert's Diary: DOs and DON'Ts When Choosing Software for your...
summary
Starts with concrete checks: verify SoC upstream drivers and device trees, match product support lifetime to distribution LTS, and prefer Yocto/OE layers that pass quality checks. Use tools to generate package lists and dependency graphs, run OpenSSF best practices badge scans, and produce an S-BOM for composition analysis to find unexpected crypto or libraries. Plan updates (firmware, bootloader, kernel, rootfs) early, avoid adding fragile personal GitHub layers, and treat secure boot as a multi-component project requiring reference implementations and external review.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:17Day 1 of the project
- 8:57Day 3 the distribution
- 13:19Day 17 adding layers
- 18:30Day 27 adding components
- 24:25Day 79 updates
- 26:23Day 97
- 30:48Conclusion
- 33:03Questions
related talks
59mGetting Started with Embedded Linux Security
44mSecuring a Yocto Built System
41mUnique Challenges Of Security Programs For Hardware/IoT Makers
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
34mYocto Project/OpenEmbedded Meets Security
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
35mOpen source security: Opportunity or oxymoron?
32mELC 2013 Security: Best Practices for Embedded Systems