Securing Open Source Software - End-to-End, at Massive Scale, Together
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 14:05· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
OpenSSF lays out concrete fixes: a 10‑point plan, a critical projects program and Alpha/Omega code reviews targeting high‑impact libraries; tooling work includes Allstar GitHub app and OSS‑Fuzz and ClusterFuzz integrations plus sigstore signing and a vulnerability disclosure workflow (Vince). Data points: average project has ~180 dependencies, top 50 projects have 3.6 million dependents, typical flaw sits ~218 weeks undetected and takes ~4 weeks to patch. Roadmap shows pilots and working groups, not just concepts.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:51Anne Bertuccio
- 2:46Organization Called the Open Source Security Foundation
- 4:10Openssl
- 13:48Dev Visualization
- 22:45Takeaways
- 23:47Better Vulnerability Disclosure Practices
- 24:37The Seven Working Groups
- 24:57Best Practices for Open Source Developers
- 26:09Secure Securing Software Repositories
- 26:39Identifying Security Threats and Open Source Projects
- 27:38Call to Action
- 28:42The White House Executive Order on Cyber Security
- 31:11Memory Safety
- 34:45Code Audits
- 43:33Panel Discussion on Vulnerabilities
related talks
57mFrontiers in Securing the Open Source Ecosystem
42mDeveloping a Secure, Open Future
37mOpenSSF Best Practices for Everyone!
22mKeynote: Securing the Open Source Ecosystem
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
42mAction and Impact Panel: How OpenSSF and Industry Improve Open Source Security
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard