"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
summary
Alpha-Omega funds a program with OpenRefactory that uses a static analysis engine called ICR to scan at scale: ~1,000 packages/month, ~6,500 PyPI artifacts scanned, 325 bugs found (140 security, 51 high) and ~60% already fixed. A focused audit of Apache Airflow’s full transitive graph — 719 dependencies — finds 16 bugs (4 high, 5 medium, 7 low) and surfaces fixes and attestations across 55 CWEs. Emphasis is on low false positives, auto-synthesized fixes, persistent rescans and publishing attestations via Project Clean Beach.
AI-written summary · about
chapters (9)
- 0:00Software supply chain security
- 3:54Alpha Omega's mission
- 6:44Supply chain risk approach
- 11:19Proactive auditing for vulnerabilities
- 18:38Project Clean Beach
- 24:43Intelligent Code Repair
- 35:15Auditing Apache Airflow
- 41:18Human factors in security
- 44:26Future plans
related talks
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
28mAirflow Beach Cleaning - Supply Chain Security with Community in Mind
37mHow to Serve Open Source Maintainers Without Annoying Them?
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
44mSecurity Research with Open Source Software: Vol. Omega
41mManaging Audits for Critical Open Source Projects