Open Source Runs the World, Why Not Vulnerability Identifiers?
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 12:00· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Open-source Global Security Database (GSD) puts vulnerability identifiers and multiple feeds into a GitHub-hosted, machine-readable repo that is cve-compatible and supports OSV and custom formats via per-source namespaces. It already ingests NVD/CVE read-only data, offers request.globalsecuritydatabase.org for new IDs, uses GitHub auth and pull requests, handled an example of 1562 IDs requested from a single Linux kernel run, and works as a usable prototype with rough UI and moderation rules; contributions and automation adapters are actively needed.
AI-written summary · about
chapters (13)
- 0:00Josh Bressers
- 1:12What Is the Global Security Database
- 2:46Modern Vulnerability Identifiers
- 5:21Why Is Twitter Winning
- 5:34Why Twitter Is Winning
- 9:42Git Blame
- 13:13Formats
- 15:49Why the Csa
- 19:22Name Spaces
- 22:39Multiple Formats
- 27:53Linux Kernel
- 32:06The Known Exploitable Vulnerability Catalog
- 37:13Is There Room for Capturing some of the Nuance for Disputes
related talks
24mLessons from OSV: Vulnerability Management for Open Source
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
11mA security.txt for gits?
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
23mHitchhikers' Guide to the Vulniverse
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance