Your Application is Mostly Written by Strangers
summary
Most applications are built from other people’s code: measured examples show 98% OSS by component count and file size (one app had 268 open‑source components vs 12 in‑house), and a 2019 report puts modern apps at 85% open‑source. Real incidents include the npm event‑stream compromise (malicious flatmap‑stream stealing crypto, npm contacted ~4000 maintainers), typosquat RubyGems (malicious atlas‑client reached ~30% of downloads) and British Airways’ Modernizr injection that cost a $229M fine. Mitigations: maintain a bill‑of‑materials, use a local cache repo, automate updates (e.g. Dependabot) and enforce SLOs for CVE fixes (e.g. 2 weeks high).
AI-written summary · about
chapters (13)
- 0:00Start
- 1:33Talk Structure
- 2:36Modern Application
- 4:12Open Source Developers
- 5:25Not All Open Source Are Created Equal
- 6:55EventStream Backdoor
- 9:24strong password v.0.7 rubygem hijacked
- 14:29Maintain a Dependencies List
- 15:03Better Due Diligence
- 18:36Questions to Ask
- 20:05Update Stale Dependencies
- 21:37Example Implementation
- 24:33Summary
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
45mPanel Discussion: Managing Open Source...
13mKeynote: Hacking the OSS Supply Chain
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
49mTrustworthy Open Source: The Consequences of Success
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
38mApplication Security in the age of Open Source
24mSharks in the Water: Open Source Component Risk and Mitigation