Insecurity in Security: Maintainer Support in
summary
Concrete incidents and numbers guide decisions: Harvard Business School estimates $8.8 trillion replacement cost, Cargo averages six direct → ~60 indirect deps and dependency chains exceed 60 steps, left-pad 11 lines breaks builds, event-stream/flatmapstream Trojan exfiltrates Bitcoin, and xz social engineering and XE are multi-year, targeted infiltrations that succeed by abusing normal maintainer pressure. Tools like dependabot and OSV-Scanner create alert fatigue, funding top-20 dependencies and donating one day/month of engineer time demonstrably reduce risk.
AI-written summary · about
chapters (9)
- 0:00Maintainer support in open source
- 3:18Open source supply chains
- 8:37Supply chain risks examples
- 12:51XZ attack and social engineering
- 16:24Maintainer burnout and burdens
- 20:37Contributor pipeline leak
- 24:05Diversity and open source security
- 27:12Steps to support maintainers
- 31:12Call to action
related talks
29mUnpaid maintainers: The Security Threat No One Is Talking About (yet)
28mUnpaid Maintainers: The Security Threat No One Is Talking About (yet)
41mThe Divine and Felonious Nature of Cyber Security
14mKeynote: The Human Cost of Security in the AI Era
46mApplication security from start to finish
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
32mBuilding a secure future using DEVSECOPS practices and technologies