The Year in Open Source Security
summary
A concise inventory of concrete 2024 events: NVD stalled on Feb 12 and leaves a backlog while CVE adoption moves to JSON v5 and new CNAs (Linux kernel, curl, Wikimedia) increase load; SBOM generation accelerates and SPDX 3 released but merging varied SBOMs remains unsolved; the XZ backdoor nearly shipped (single‑maintainer supply‑chain compromise discovered pre‑release); memory‑safe push shows measurable bug reductions and GCC 14 adds static checks; the EU CRA mandates 5‑year free security updates and puts obligations on manufacturers and stewards.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:582023 security highlights
- 4:01CVE and NVD database crisis
- 14:32Programming languages trends
- 22:24Legislation in open source security
- 23:11Security funding and sustainability
- 24:36Software Bill of Materials progress
- 25:402023 major security incidents
- 29:23Key takeaways and challenges
- 30:28Q&A: CrowdStrike and Linux
- 32:59Q&A: Linux distribution fragmentation
- 34:05Q&A: CRA roles and obligations
- 35:09Q&A: XZ regression and SSH
- 36:36Q&A: Trust in open source
- 39:50Q&A: CRA enforceability
related talks
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
29mSponsored Session: Who Will Move Your Cheese ? IEC, CRA, Cyber Security
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
39mCVE 101: The Unfolding Of A Zero Day Attack
50mDrinking From The CVE Firehose: Or How To Ensure Your Open Source Product Survives