Security Initiatives in Community Driven Projects: Looking Ahead with Python and Rust
summary
Python and Rust foundations describe concrete outputs: a hired security engineer (Python from the community, Rust brought externally), Python becomes a CNA and ships reproducible CPython builds plus SBOMs, Rust publishes a PK/resilient-core model, provenance tracking, automated call‑graph and typo‑squatting tools, full threat models and a six‑month technology report. Rollouts emphasize building consensus and transparent communications, 2FA for top packages triggers ~400,000 notification emails and taught the teams to slow down. Funding is multi‑year grants (e.g., five‑year Fastly support) enabling sustained work.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:01Community-driven security journeys
- 4:54Building trust and transparency
- 7:01Rolling out two-factor authentication
- 9:50Consensus building and culture shift
- 12:38Sustaining security work
- 15:27Funding and multi-year commitments
- 17:56Interorganizational collaboration
related talks
39mFireside Chat - Stewarding Rust & Python
11mLightning Talk: A Case Study in Cross-Ecosystem Security Response
28mRust for Pythonistas
29mClosing the Supply Chain Security Loop with Rust & Pyrsia
26mShipping Python Extensions in Rust Two Million Times a Day
32mRust for CPython: Making Python Safer and More Robust for Everyone
35mSecuring Python projects Supply Chain
01h 01mRust for Python Developers (english)