Supply Chain Security for OpenSource Projects
summary
SolarWinds Hack shows CI compromise that injects malicious code into builds and infects an estimated 12–15k customers, so focus on concrete steps: start with static analysis early (SAST) on the laptop, treat binaries and dependencies as primary attack surface, record build metadata / SBOM or build info to trace who built what, use on‑demand scanning and IDE plugins (example: JFrog Xray and free IDE tooling), harden against typo‑squatting, dependency‑confusion and secret leakage, and consider reproducible peer‑to‑peer builds like Pyrsia for open source verification.
AI-written summary · about
chapters (29)
- 0:00Intro
- 1:25Overview
- 3:08Solomons Hell
- 6:00Supply Chain
- 14:05Application Security Testing
- 18:33Machine Good vs Bad
- 26:00Dependencies
- 27:40Compliance and Vulnerability
- 31:12Vulnerability Lifecycle
- 32:48Malicious Components
- 33:57Mass Grading
- 34:49Drawing Package
- 35:28Internal Dependencies
- 36:46Hijacking
- 37:29payloads
- 38:57Source code
- 40:00Homolog characters
- 40:44Syntax highlighting
- 41:28Biggest weapon in dependency management
- 42:49SolarWinds was a disaster
- 43:22What is an executive order
- 44:08What do you need
- 45:44Project Salsa
- 46:57Project Persia
- 48:18What to do now
- 49:25Ondemand scanning
- 50:02Additional information
- 50:52What can you do
- 51:50Questions
related talks
30mSupply Chain Security for OpenSource Projects
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
39mOpen Source Software Supply Chain Security — Why does it matter?
29mSupply Chain Security: Threats, Defenses And What You Can Do
41mHow to protect your software project from supply chain security threats
48mThe Quick Wins of DevSecOps
37mSupply Chain Attacks and the Future of Software Delivery