Breaking the Sharing Paradox: A Working Foundation and a Call for…
summary
OpenReagent presents a privacy-preserving signature format and pipeline that lets institutions share vulnerability signatures (not source code) so teams can run local scans against known findings. The LFDT labs open-source MVP (v0.2 on GitHub) extracts signatures from reports and code, matches them to targets, and reports findings; early analysis of ~262 audits found ~32% reuse of similar vulnerable patterns and some functions recurring across 8+ projects. The roadmap includes stronger preservation methods beyond simple hashes, more recipe types, and formal benchmarking.
AI-written summary · about
chapters (8)
- 0:00Sharing Paradox intro
- 3:14Defining trust
- 6:02System architecture
- 9:56Signature extraction
- 13:06Governance and regulations
- 14:30Future roadmap
- 17:40Call to action
- 18:21Q&A
related talks
30mSecuring Open Source Supply Chains
44mSecurity Research with Open Source Software: Vol. Omega- 44mSecurity Research with Open Source Software: Vol. Omega
42mDeveloping a Secure, Open Future
19mTrust, Tampering, and Transparency: What History Can Teach Us About Open Source...
18mSecuring InnerSource
24mHow to Find Secure Software in Open Source Repositories
37mSecuring Open Source Through Threat Modeling