Security Research with Open Source Software: Vol. Omega
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 12:20· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Project targets 10,000 critical OSS repos and builds an automated pipeline: a Docker-based Omega analyzer with 20+ scanners that emits a single SARIF, a central triage portal (Django/Redis/Postgres) with JWT auth and SARIF validation, an assertion framework for policy-driven false-positive filtering, and an autofix state machine whose tests are mostly written. Team is under a year old, ran a mentorship that hired four mentees, pilots and Java-based automated PRs via OpenRewrite are underway.
AI-written summary · about
chapters (6)
- 0:00Alpha Omega project intro
- 3:53Alpha and Omega sides
- 12:01Tool chain mission
- 20:31Science fiction vision into reality
- 30:19How to contribute
- 43:53Q&A
related talks
44mSecurity Research with Open Source Software: Vol. Omega
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages
33mORT Automate compliance using Open Source & InnerSource
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
41mManaging the risk and growth of using Open Source Software