Keynote: The Human Cost of Security in the AI Era
summary
Supply chain incidents like Trivy compromise (Mar 19), RunC container escape CVEs and Fluent Bit with five CVEs including an 8‑year bug illustrate recurring human burden: maintainers must research CVEs, patch code, and respond to low‑effort issues. A demonstrated Python scanner targets Go modules, queries OSV and NVD, runs a local LLM (Qwen 3.5) to reason about affected versions and returns a verdict in minutes so maintainers can close reports with evidence. CNCF TAG DevEx survey (~100 projects) finds security and reviewer burden as top concerns.
AI-written summary · about
chapters (8)
- 0:00Human cost of security
- 1:05Security burnout causes
- 2:52Low-effort issues and empathy
- 4:18AI-era human workflow attacks
- 6:30AI workload reduction
- 7:57Automated vulnerability demo
- 10:50CNCF maintainer support
- 12:38Sustainability as security
related talks
35mKeynote: How I learned to stop worrying and love CVEs
13mKeynote: Hacking the OSS Supply Chain
56mKeynote: AppSec: From Outsiders to Allies
17mKeynote: Fighting The Next War - Future Threats to OSS and Software Supply Chain...
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
28mCode, Dependencies and Security: Where Is the Risk
58mKeynote: What Got Us Here Wont Get Us There
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...