Trustworthy Open Source: The Consequences of Success
summary
Open source now permeates critical infrastructure with concrete scale: 2.2 trillion downloads last year, 30% single‑maintainer packages and 800,000 new projects, creating many under‑observed weakest links. Demonstrated attacks include Codecov compromised bash uploader that exfiltrated environment credentials via modified upload code (one added line in an 1800‑line script, undetected for months). Practical responses described: dependency‑inventory tool depths.dev, a Salsa supply‑chain invariants framework, and a curated “assured OSS” pilot that scans, fuzz‑tests, signs and backports fixes.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:30Open Source has Security Problems
- 8:11Trust a Package? Sometimes zero eyes
- 14:24Open Source Insights
- 17:55Two roles: Distribution vs Accountability
- 21:31Curation: Open Source with "Support"
- 22:59Curation: Adding a Layer of Accountability
- 30:52The two phases of supply-chain attacks
- 33:58Codecov Phase 1: modify Codecov's bash script
- 43:44Sustainable Trustworthy Open Source
related talks
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
38mApplication Security in the age of Open Source
39mSOS: Sustainable Open Source
13mKeynote: Hacking the OSS Supply Chain
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
44mOpen Source Security: The World Needs Our Help
35mOpen source security: Opportunity or oxymoron?