German National Guideline on SOSS-Lifecycle: Community Outreach
summary
A national guideline for a secure open source lifecycle proposes a tooling-agnostic baseline with tiered implementation levels (incubating vs established), insists on public processes for bug reports, coordinated vulnerability disclosure and contributions, and requires manual build instructions even when CI builds exist. A proposal for two maintainers and two approvals fails to gain support. OpenSSF scorecards, memory-safe language tradeoffs, continuous updates and procurement-based enforcement (mandatory for bought software) are discussed.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 0:42Need for open source security guideline
- 1:26Community outreach approach
- 2:06Security baseline thesis discussion
- 3:32Processes and organization thesis
- 5:21OpenSSF scorecards feedback
- 5:41Memory safe languages debate
- 6:24Guideline granularity and abstraction
- 7:07Lifecycle and updates for guideline
- 7:52International collaboration approaches
- 8:56Q&A session begins
- 9:17Enforcement and procurement focus
- 12:47Closing remarks and contact
related talks
29mTurn Down That Noise: Why the OpenSSF Security Baseline Is Good for Maintainers
37mOpenSSF Best Practices for Everyone!
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
42mDeveloping a Secure, Open Future
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
29mWe're All Consumers (And That's Dandy)
33mHow & Why Does The Work of OpenSSF Impact You
57mFrontiers in Securing the Open Source Ecosystem