Securing OpenVSX Theia is not an island
summary
Theia starts as a Notepad and becomes usable only with extensions, so the practical plan centers on OpenVSX as an on‑prem registry with 2,200+ plugins today, OAuth support, and the ability to mirror and air‑gap. The roadmap demands signed builds, software composition analysis, license and trade compliance checks, a vulnerability database, and scale controls to avoid denial‑of‑service from 10,000 simultaneous builds; the proposed implementation is an internal OpenVSX mirror feeding a certified archive like Artifactory with an automated validation pipeline.
AI-written summary · about
chapters (9)
- 0:00Start
- 5:20Indirect dependencies in OSS
- 6:52Who is responsible for Security?
- 8:54Why in-house marketplace
- 14:01Problem Statement (Ericsson perspective)
- 15:11Eclipse OpenVSX
- 17:56What needs to be done? (Gaps)
- 19:25What do we need to do internally
- 21:41Updated Plug-in Pipeline (MVP)
related talks
29mEclipse Open VSX, the Open VSX Registry, and Ericsson’s Perspective and Interest
16mRecent Activity, Trends, and Priorities at Open VSX
22mTheia IDE: The Why, the How and the Future
15mKeynote: Accelerating SDV Through Open-Source Based Virtualization
24mLessons from OSV: Vulnerability Management for Open Source
50mHow To Accelerate Software Defined Vehicle(SDV) With OSS
27mThe Evolution of an Open Source Project
46mOpen for AI: Secure paths to data collaboration volume and diversity