How Secure Is Academic Open Source? Insights From the UC OSPO Network
summary
Builds a UC-wide GitHub dataset of ~52,000 repos (≈25,000 predicted UC-affiliated), runs OpenSSF Scorecards and dependency/CI analyses, and finds a mean Scorecards total ≈2.5 for the top 2,000-by-stars set, only 0.1% include a security policy, and 86% have a boss factor of 1. Runs static analysis (Semgrep) on the 100 most critical projects and gets >2,000 rule triggers (common ones: plaintext HTTP links, null-checks, shell injection), and proposes a reproducible OSPO-focused remediation workflow.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:05UC OSPO network overview
- 3:15Academic open source importance
- 5:22License detection and scores
- 6:05Security with OpenSSF Scorecards
- 8:17Criticality vs security scores
- 10:46Security metrics improving with criticality
- 12:32Four security metrics to prioritize
- 13:57Bus factor risks
- 16:01Static analysis findings
- 18:30Next steps for security
- 19:54Better security metrics needed
- 21:00Q&A
related talks
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
26mLooking at Open Source Security from the Community Angle
37mOpenSSF Best Practices for Everyone!
36mEstimating Security Risk Through Repository Mining
42mDeveloping a Secure, Open Future
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together