Keynote: Securing Open Source
summary
Shows evidence that open source supply chains are actively exploited: SolarWinds Orion subversion, npm’s event-stream compromise and a survey of 174 attacks that finds typo‑squatting dominant. A Helm3 audit finds 25 vulnerabilities in one package and package layers delay fixes. Concrete responses include using package managers and automated updates, adopting reproducible builds and Sigstore-style signatures, running vulnerability and negative tests, following CII best practices and the free Secure Software Development Fundamentals course, and moving toward integrity attestations (in-toto) and memory‑safe languages.
AI-written summary · about
chapters (8)
- 0:00Four key points
- 1:22Software under attack, via vulnerabilities & supply chain
- 2:28"Who's at the Helm?" (Dan Lorenc)
- 3:35Software Supply Chain Integrity Map
- 6:14There is no silver bullet!
- 8:07Some things to consider for evaluation
- 8:54OSS Developer or User? Prep for the future...
- 10:47A parting thought
related talks
13mKeynote: Hacking the OSS Supply Chain
08mKeynote: Security of the Open Source Supply Chain, a Call to Action
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
16mKeynote: There Is Just One Way to Do Open Source Security: Together
13mKeynote: Hacking the OSS Supply Chain
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
12mKeynote: A Vision for a Secure Software Supply Chain
22mKeynote: Securing the Open Source Ecosystem