We're All Consumers (And That's Dandy)
summary
OpenSSF Security Baseline lays out concrete checks and three maturity levels (level one through three) tied to real requirements: EU Cyber Resilience Act (2024) demands SBOMs and can fine up to 2.5% of gross revenue, so expect manufacturers to ask about compliance. Recommended fixes include branch protection on main, sanitizing branch names after the NX token-theft breach, blocking secrets from VCS, and documenting multi-repo subprojects. Baseline lists ~13–14 level-one items, and the working group is building interoperable tooling plus some OpenSSF helper tools.
AI-written summary · about
chapters (15)
- 0:00Open source security intro
- 1:05EU Cyber Resilience Act
- 3:15OpenSSF Security Baseline
- 4:44Why SBOMs aren't the full solution
- 6:07Costs of unhealthy projects
- 8:13Baseline project levels
- 10:26Level one requirements
- 13:17Documenting dependencies
- 15:03Level two requirements
- 15:45Managing sensitive access
- 16:29Level three requirements
- 17:12Using baseline effectively
- 18:18Responsible open source use
- 20:28Sustaining invisible infra
- 21:09Q&A
related talks
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
29mGoogle SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices
44mNext-Level DevSecOps: Secure Supply Chain Consumption Framework Q&A
42mDeveloping a Secure, Open Future
57mFrontiers in Securing the Open Source Ecosystem
44mNavigating Open Source and Open Standards for Better Cybersecurity