A Vulnerability Database Should Not Be About Vulnerabilities!
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 16:05· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Argues that a vulnerability database must be package-first and use upstream advisories as the source of truth, not noisy derived feeds; builds vulnerablecode, an open DB that aggregates OSV/GitHub/advisories, normalizes to package-url and CPE, assigns confidence-based aggregation scores, deduplicates via alias maps, and resolves version ranges by time‑traveling registries. Adds commit-level traces and YARA rules for precise detection, combines human review with ML to spot inconsistencies, and plans a Vulnerability Total service to compare databases and answer “am I actually affected?”
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:17Agenda
- 2:01State of Vulnerability Databases
- 4:40Telephone Game Problem
- 6:46Trust
- 8:52Package First
- 9:50Why vulnerable code
- 10:36Tools
- 11:36Data Source
- 13:16Aggregate Correlate
- 14:06Multilevel Refinement
- 15:53Growth Packages
- 17:08Missing Packages
- 18:12Duplicated Data
- 20:20Other Issues
- 23:15Future Plans
- 29:39Outro
related talks
15mA vulnerability database should not be about vulnerabilities!
57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
24mBuilding a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ...
01h 00mNon-Vulnerable Dependency Resolution
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source
13mManaging Vulnerabilities in Open-Source Dependencies
11mVulnerability Supply Chains
24mLessons from OSV: Vulnerability Management for Open Source