Measuring Security Risk: Community Engagement Is the Best Mitigation
summary
Argues that active upstream engagement beats opaque metrics and GitHub stars and gives concrete tactics: passive listening via mailing lists and GitHub activity, open dialogue at conferences and annual meetings, making sure legal allows employees to contribute and patch, joining beta and release candidate cycles as a watchdog, and forming cross‑company community partnerships. Flags to avoid include hostile mailing lists, single overwhelmed maintainers, and projects that refuse patches. Cites PyPI scale of 1.1M downloads/day, a prior half‑person support backlog solved by funded hire, and a cautionary magic number outage: 12 million people, 6,600 missed calls.
AI-written summary · about
chapters (10)
- 0:00Security risk and community engagement
- 1:04Bad surprises and consequences
- 3:55Open source security relationships
- 4:38Passive listening mitigation
- 7:27Dialogue with upstream projects
- 9:37Internal community capacity
- 13:12Becoming trusted partner
- 17:49Proactive relationships before crises
- 21:00Community engagement best mitigation
- 23:57Q&A
related talks
30mMeasuring Security Risk: Community Engagement Is the Best Mitigation
25mWhat Does it Mean to Build a Proactive Security...
44mWhy Is My Community In Danger?
25mDefining the Limits of Risk
35mThe Benefits and Pitfalls of OSS Project Metrics: Measuring Health and Risk in Open Source Communities
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
27mThe OSS-ential Understanding of Community Health and Metrics
16mKeynote: There Is Just One Way to Do Open Source Security: Together