Securing the software supply chain together
summary
Explains concrete GitHub tools and outcomes: use dependency graph to map declared and transitive dependencies, enable security alerts to get notified of new CVEs, and accept Dependabot PRs that propose the minimum patched version. GitHub publishes an advisory database (CC BY 4.0) and reports 750,000+ Dependabot PRs (4M+ total) merged, cutting mean time to repair to ~40 days versus industry ~180–730+ days. Immediate actions: enable features for private repos, add security.md, and enforce 2FA.
AI-written summary · about
chapters (11)
- 0:00Introduction to Satellite
- 1:33Securing the supply chain
- 2:46What is a software supply chain
- 5:00Real-world supply chain attacks
- 8:27GitHub's security vision
- 11:08Developer security tools
- 14:11Automated patch management
- 17:11Maintainer best practices
- 20:28Live demo of security tools
- 24:07Security recap and resources
- 25:55Q&A and final thoughts
related talks
38mFortifying Your Codebase with GitHub
27mBuilding a Secure Open Source Project on GitHub
58mProtect your code with GitHub security features
49mProtect Your Code with GitHub Security Features
41mSecuring the World’s Open Source Software, Together
01h 02mDeveloping secure software with GitHub
24mBuilding a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ...
42mProtecting Your GitHub from Supply Chain Attacks