The Power of Dedicated Security Engineers vs. Volunteers
summary
AWS commits over $10M in 2022 and funding converts volunteers into full‑time security engineers who deliver concrete results: PyPI becomes a CVE numbering authority within three months, PyPI advisories integrate into the Open Source Vulnerability database, and phased two‑factor authentication outreach drives 80% adoption among active users by August 2024. Dedicated staff produce three to four major deliverables per year versus one for volunteers, and sustained work on SBOM and supply‑chain tooling enables deeper, long‑term risk reduction.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 1:30Volunteer security limitations
- 3:41Human cost of volunteer security
- 5:08Dedicated security engineers impact
- 8:20PyPI security improvements
- 10:47Two-factor authentication adoption
- 11:53SBOM and ecosystem work
- 12:36Enabling volunteer contributions
- 13:44Call to fund open source security
- 14:27Q&A session
related talks
16mMeet our Security Engineers
29mMaking Python safer than ever
10mUpdate from our Security Engineers
10mPyPI Supply Chain Security
55mReviewing another year of security partnership between the PSF & Alpha-Omega
20mSecurity Culture & Scaling Your Security Humans
39mBeing Powerful While Powerless: Elevating Security By Leading Without Authority
24mBeing secure by design: Engineer-led security