OSS Security: Lessons from 10+ Years at Apache Solr
summary
Timeline of concrete choices and outcomes: Solr adds pluggable auth added in 2015 (Kerberos, Hadoop, JWT/OAuth) instead of reusing Shiro, which increases attack surface and produces repeated CVEs; flexible features like the lib directive and DIH removed for safety accumulate vulnerabilities and are eventually deprecated; vulnerability reports skyrocket (Q1 extrapolates to reports up ~10x), triage lives on project mailing lists, fixes leak in commits before CVEs, and volunteer-driven response causes delays and burnout — practical tradeoffs and failures are exposed.
AI-written summary · about
chapters (5)
- 0:00Introduction to OSS security
- 3:39Security at Apache Software Foundation
- 6:51Challenges in open source security
- 17:49Lessons learned from Solr
- 30:40Q&A on security practices
related talks
53mPanel Discussion: Handling vulnerability reports in Apache Solr
29mThe maintainability of open source code 20 years from today
46mPower Dynamics, Rug Pulls, and Other Corporate Impacts on OSS Sustainability
44mSecurity Research with Open Source Software: Vol. Omega
17mA New Era for Open Source Security
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes
39mA Fresh Start? The Path Toward Apache Solr's v2 API
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!