Security Research with Open Source Software: Vol. Omega
summary
Alpha Omega targets 10,000 critical open source projects and aims to end manual disclosure by automating discovery, triage and fixes. It runs the Omega analyzer (Docker with 20+ scanners) to emit a single SARIF file, pushes results into a triage portal that orchestrates private-issue creation and campaign tracking, and applies fixes via an OpenRewrite-based campaign client initially for Java. Pilot rollouts, a mentorship that hired four contributors, drafted assertion framework policies and an autofix SIG spec show working prototypes and open implementation gaps.
AI-written summary · about
chapters (6)
- 0:00Alpha Omega project intro
- 3:53Alpha and Omega sides
- 12:01Tool chain mission
- 20:31Science fiction vision into reality
- 30:19How to contribute
- 43:53Q&A
related talks
44mSecurity Research with Open Source Software: Vol. Omega
22mImproving Global Software Supply Chain Security with Alpha-Omega
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
42mAction and Impact Panel: How OpenSSF and Industry Improve Open Source Security
35mOpen source security: Opportunity or oxymoron?