OWASP Top 10 Risks for Open Source Software
summary
A concise set of concrete risks and mitigations: a Census2 datapoint shows 80–85% open source of some Java projects so dependency risk is pervasive; reachability matters so call‑graph reachability determines whether a CVE actually affects the product; building a vulnerability database at function granularity is a hard engineering problem; practical mitigations include version pinning and vendoring, signed digests and scanners; beware tiny npm libraries and rebundled native binaries, and expect many tooling gaps and missing metrics.
AI-written summary · about
chapters (9)
- 0:00OWASP Top 10 OS risks
- 1:24Dedicated Top 10 for open source
- 3:14Open source dependency vulnerabilities
- 9:34Compromised open source packages
- 13:03Unmaintained open source risks
- 15:31Tracking project dependencies
- 17:57Dependency size trade-offs
- 21:42Future of open source risk
- 23:30Q&A
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
37mThe State of Open Source Security
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
38mApplication Security in the age of Open Source
14mThe State of Open Source Vulnerabilities Management in 2019
39mOpen source security: who’s responsible?
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
48mAn Introduction to the Newest Addition to the OWASP Top 10