Drinking From The CVE Firehose: Or How To Ensure Your Open Source Product Survives
Talkat Embedded Linux Conference + OpenIoT Summit North America 2017 · on Tuesday, 2017-02-21· at 10:30· Grand Ballroom I/II·
summary
Open-source products face a relentless stream of vulnerabilities: the CVE database shows 81,785 entries and 1,822 so far this year — about 35 CVEs per day — and four common packages (Linux kernel, OpenSSL, libtiff, ffmpeg) produced 294 CVEs in 2016. Real-world timeline: WordPress pushed a silent fix Jan 26, announced Feb 1, and active exploitation spikes by Feb 3. Survive by including an automatic update mechanism, track feeds with CVE Details RSS/JSON, and scan builds with an integrated CVE check tool and OTA/OSTree/swupd update paths.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:56What is a security vulnerability
- 1:27The Venn diagram
- 2:02What are security vulnerabilities
- 5:00Is it secure
- 6:24Is it compromised
- 8:17Is it vulnerable
- 10:08WordPress vulnerability
- 13:37Traditional hacker
- 19:53Money
- 22:08Chromium Bug Bounty
- 24:23How Much Do They Pay
- 25:30What Is A CVE
- 28:01The Silent Bug Fix
- 30:07How Does This Help Me
- 30:18Include An Update Mechanism
- 33:58How To Track Vulnerabilities
- 35:26Ikey Aikido Dirty
- 36:35Attackable Surface Area
- 39:39Privilege
- 40:38Code Reviews
- 42:43Should an outside company seek outside expertise
- 45:28Are there plans to put CVE messages in kernel commits
related talks
28mEpidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
39mCVE 101: The Unfolding Of A Zero Day Attack
01h 04mSecurity Vulnerabilities in Third Party Code: FIX ALL THE THINGS!
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
41mThe Year in Open Source Security