Keynote: All Your Base Are Belong to Us
summary
OpenSSF’s Open Source Project Security Baseline builds a machine‑readable control catalog mapped to CRA, NIS, NIST SDLC and other frameworks, shares a Gamara schema with FINOS, and publishes controls plus recommendations that feed into automated test evaluations and eventual CI gates. Projects publish a security-insights YAML in their repo; LFX shows progress (Argo appears at 100% under current checks). Integrations include OpenSSF Scorecard, best‑practices badge, CNCF assessment guides and joint assessments for evidence and audits.
AI-written summary · about
chapters (8)
- 0:00OpenSSF rallying cry
- 1:25Open source security baseline
- 3:54Outcomes and machine-readable controls
- 5:21Baseline control catalog structure
- 7:30Mapping policies to controls
- 8:55Automating evaluations with LFX
- 10:18Security insights for open source
- 12:46Getting involved and next steps
related talks
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
42mDeveloping a Secure, Open Future
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
22mKeynote: Securing the Open Source Ecosystem
29mTurn Down That Noise: Why the OpenSSF Security Baseline Is Good for Maintainers
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
40mBuilding Developer Confidence in Software Security with the DevRel Community
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together