Measuring Security Risk: Community Engagement Is the Best Mitigation
summary
Open source risk becomes manageable by concrete steps not handwavy metrics: join mailing lists, monitor GitHub activity, follow beta releases, and look for responsiveness and funding. The talk cites a real outage that affected 12 million people and 6,600 unanswered 911 calls as a communication failure, and cites 1.1 million downloads a day on PyPI to show scale. Recommended actions escalate through mitigation levels 1–4: passive listening, opening dialogue, growing internal contributors and patching ability, and becoming a funded community partner.
AI-written summary · about
chapters (10)
- 0:00Security risk and community engagement
- 1:04Bad surprises and consequences
- 3:55Open source security relationships
- 4:38Passive listening mitigation
- 7:27Dialogue with upstream projects
- 9:37Internal community capacity
- 13:12Becoming trusted partner
- 17:49Proactive relationships before crises
- 21:00Community engagement best mitigation
- 23:57Q&A
related talks
30mMeasuring Security Risk: Community Engagement Is the Best Mitigation
44mWhy Is My Community In Danger?
27mThe OSS-ential Understanding of Community Health and Metrics
39mOpen source security: who’s responsible?
25mDefining the Limits of Risk
33mRapid-Fire Stories of Creative Solutions to InfoSec Problems
31mMobilizing the Open Source Industry in the Fight For Better Security By Default
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey