Panel Discussion: Managing Open Source...
summary
Open source now makes up 80–90% of modern applications, creating huge transitive dependency graphs — average apps went from ~70–80 packages to over 500 and many enterprises track 10–20k components or more (one client found 8,000 vs their believed 400). Supply chain attacks spike (studies cite ~700% and a 315% rise in malicious packages) so teams adopt SBOM and VEX adoption, scorecards, zero trust, inner source and automated pipeline checks to validate, prioritize and remediate real risk.
AI-written summary · about
chapters (9)
- 0:00Open source supply chain security
- 2:31Panelists' backgrounds
- 7:48Why open source security matters
- 14:49Securing open source strategies
- 22:23SBOMs role and challenges
- 30:53Supplier compliance carrots vs sticks
- 37:15Accountability and upstream improvements
- 40:50Incentivizing open source risk management
- 44:19Closing remarks
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
11mSupply Chain Cybersecurity
42mPanel Discussion: How the Business Community is Working to Make the Open Source Software Supply...
41mManaging the risk and growth of using Open Source Software
09mSecuring the Software Supply Chain with Open Source
41mManaging the Risk of Software Supply Chain Attacks
31mThe Value of OSS Management for Risk Mitigation
38mBetter, Faster, Stronger: How the Global Acceleration of OS Development Is Changing