On the Shoulders of Giants: Security in FOSS
summary
Panel argues supply‑chain risk by naming concrete failures like Log4Shell, cites tooling such as SBOM generation and dependency graphs, and calls for repository metadata to automate vulnerability contact details. Describes a maintenance + bug bounty pipeline called the bug resilience program that gates bounties on posture improvements. Gives deployments: contact‑tracing stack in 54 health centres serving ~30 million people as an architecture lesson, and cites David Wheeler’s bug rate (bugs per KLOC per year) to justify ongoing funding.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 1:30Planning security conference
- 2:56Supply chain security challenges
- 4:40Log4j vulnerability impact
- 6:06Automating security communication
- 8:59Preventing security incidents
- 11:47Bug bounty program approach
- 13:31Legal barriers in reporting
- 15:40Public health infrastructure lessons
- 17:24Architecture as security issue
- 18:53Funding open source security
- 20:21Call for contributions
related talks
44mPanel Discussion: Improving the Software Supply Chain Security
50mRunning in the Shadow: Perspectives on Securing the Software Supply Chain
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
27mSecurity: The Thing That Everyone...
44mOpen Source Security: The World Needs Our Help
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
25mYour Software Supply Chain is Only as Secure as its Weakest Link