Fresh SLSA and GUAC Starts with Knowing Your Ingredients
summary
Open source dependency graphs explode quickly: a small Java microservice demo pulls 114 direct and transitive components; Log4j hit ~70,000 projects directly and ~174,000 transitively; left-pad removal deleted 272 packages and broke builds; Equifax cleanup tops ~$1.4B and average breach cost is ~$4.45M. The proposed stack ties provenance attestations (via SLSA / salsa and Sigstore) to a searchable knowledge graph (GUAC currently moving toward 1.0, Postgres backend, SBOM diff) and automation using OSV, SBOMs, S2C2F, deps.dev and scorecard to enforce policies.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:30Version numbers in security
- 2:33Hacks and cost impacts
- 5:21Developer responsibility
- 7:08Security education gaps
- 8:12Open source dependency risks
- 9:38Dependency confusion attacks
- 11:22Left pad incident risks
- 13:46Software as Rube Goldberg
- 15:30Solutions with Michael
- 16:13Open source security sandwich
- 19:49Supply chain attack vectors
- 21:12Producer security tools
- 23:39Security depth and attestations
- 25:23Foundation tools
- 26:47Producer tools and practices
- 27:31GUAC for supply chain observability
- 30:44GUAC roadmap
- 31:50Get involved in security
- 32:59Q&A
related talks
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
44mImproving the Software Supply Chain Security
28mProduction, Consumption, and the Data: The Open Source Security Sandwich
40mWhere Is the GUAC?
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue