Driving Policy To Secure the Open Source Ecosystem
summary
Recap of concrete outcomes: Congress drafts the Securing Open Source Software Act but it stalls, CISA publishes a secure by design white paper and an open-source software roadmap and hires a team that later shrinks under layoffs, the White House orders a memory-safety report that spurs DARPA projects like TRACER/tractor and Rust tooling, OpenSSF and CISA publish package repository security guidance, a tabletop exercise proves useful during the XZ Utils compromise, and code.gov grows from the 2016 Federal Source Code Policy.
AI-written summary · about
chapters (18)
- 0:00Open source policy intro
- 1:46Government's role in security
- 3:11Federal Source Code Policy 2016
- 4:58Log4j impact on policy
- 5:41Policy circles lack expertise
- 7:02Cyber Resilience Act pushback
- 7:44Securing Open Source Software Act
- 10:33CISA implementation challenges
- 11:35White House Rust focus
- 13:00National Cyber Strategy on open source
- 14:05CISA Secure by Design roadmap
- 15:30XZ Utils compromise response
- 16:13Securing package repositories
- 17:39Open source security and AI
- 18:47Open source AI reproducibility
- 19:52Global policy efforts
- 20:33Future of open source security
- 22:21Q&A on Kubernetes and AI
related talks
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem
20m"Making Open Source Secure by Design"
29mNavigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
40mUnsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security
44mNavigating Open Source and Open Standards for Better Cybersecurity
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
22mKeynote: Securing the Open Source Ecosystem