Mobilizing the Open Source Industry in the Fight For Better Security By Default
summary
A mobilization plan lays out 10 work streams with concrete targets: invest in memory safety for core internet daemons and audited rewrites, fund third‑party code audits for 50–200 projects a year, build a public risk profile service that aggregates scorecards and SBOMs, run pervasive vulnerability scanning like an open Project Zero, and stand up an open source security incident response team. The plan budgets roughly $150 million with about $30 million pledged so far and names Sigstore, scorecards and best practices badges as tools to scale security by default.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:20The second step towards building trust was showing that it didn't depend upon heroics or personality - Apache, Linux, Perl, all developed contribution and project acceptance processes that favored community over code.
- 7:54OpenSSF The Open Source software community was one of the first places on the Internet that demonstrated, with the right processes, you could handle contributions from anonymous and pseudonymous sources
- 12:00We need: 1 Better tools to measure the trustworthiness of code based on objective measures. 2 Processes that encourage better security practices by developers. 3 Tools and processes that encourage teamwork and shared responsibility for security. 4 Add"..by default" to all of the above.
- 24:51Better Scanning Accelerate discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance.
- 26:21Improved Supply Chains Enhance the 10 most critical OSS build systems, package managers, and distribution systems with better supply chain security tools and best practices.
related talks
22mKeynote: Securing the Open Source Ecosystem
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
44mNavigating Open Source and Open Standards for Better Cybersecurity
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
35mOpen source security: Opportunity or oxymoron?
44mOpen Source Security: The World Needs Our Help
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...