Finding LibRaska: The Open Source Library that Props up our Infrastructure
summary
Project identification relies on concrete signals: dependency graphs, SBOMs, package analysis, truck‑factor and time‑to‑fix metrics, plus seven years of audits revealing deep bugs. Work focuses on building a scoring pipeline and advisory curation — criticality scoring plus community curation — backed by a working group, Slack and biweekly meetings. Telemetry gaps and shifting dependency graphs limit accuracy, but these tools and processes are producing actionable lists and slowly moving the needle.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:37Amir Montezeri
- 1:13Julie Faroli
- 2:39Open Source Technical Leader at Cisco
- 9:21Lessons Learned
- 40:13When Is the Next Meeting of the Securing Critical Projects Working Group
related talks
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
44mSecurity Research with Open Source Software: Vol. Omega
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
31mAssessing Open Source Software Projects in the Software Supply Chain
25mDefining the Limits of Risk
19mCan I trust that package?
27mHow Do You Trust Your Open Source Software?