Panel Discussion: How the Business Community is Working to Make the Open Source Software Supply...
summary
Large enterprises describe concrete moves: a bank reports ~50,000 developers and an internal repo with ~500,000 open source packages, organizations find 20–30,000 components in use at any time, and one vendor commits to training 150,000 people. Work focuses on automation and measurable outputs: SBOM generation tools for common package managers, adoption of SIGSTORE and SLSA build provenance, the OpenCRE best‑practices effort, and the OpenSSF ten‑point mobilization plan to standardize tooling, compliance and developer training.
AI-written summary · about
chapters (18)
- 0:00Panel introduction
- 2:13Companies investing in OSS security
- 5:22Banks prioritize OSS security
- 7:48Wipro’s OSS security role
- 10:37Improving security education
- 14:29IBM’s security training
- 16:56DevSecOps rise and training
- 18:19Hiring for OSS supply chains
- 21:07OpenSSF collaboration goals
- 24:41End-user OSS security contributions
- 26:45SBOM compliance in enterprises
- 28:51Join OpenSSF workstreams
- 31:41Encourage developer participation
- 33:03Procurement and SBOM adoption
- 34:52OpenSSF projects overview
- 36:59OpenSSF mission consolidation
- 38:25Q&A: Sigstore and SBOM integration
- 40:57Closing thoughts and automation
related talks
45mPanel Discussion: Managing Open Source...
09mSecuring the Software Supply Chain with Open Source
42mAction and Impact Panel: How OpenSSF and Industry Improve Open Source Security
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
43mThe Burden of Knowledge: Dealing With Open Source Risks
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
31m54,000 Tales - A Data-driven Discussion of Exemplar Development and DevSecOps Practices