Open-source vulnerability management? Use the source, Luke!
summary
Claims that code‑centric program analysis finds whether vulnerable code is actually contained and reachable in an application, using static call‑graph construction plus dynamic JVM instrumentation and fixed‑commit diffs. Demo shows a runtime exec payload triggered and removal of bloat; empirical result finds 10% reachable only after combined analysis. Tool is Eclipse Steady, but coverage is limited—700 vulnerabilities in Project KB—and it requires fixed commits and Docker Compose and currently targets Java.
AI-written summary · about
chapters (7)
- 0:00Open-source vulnerability management intro
- 2:01Metadata approaches fail developers
- 16:51Code vs metadata analysis
- 22:26Eclipse Steady assessments
- 30:37Live demo of Eclipse Steady
- 45:32Program analysis limits
- 48:46Q&A
related talks
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
27mFind and Track the hidden vulnerabilities inside your dependencies
49mAn overview of available opensource tools to secure your Java code
14mThe State of Open Source Vulnerabilities Management in 2019
37mThe Death Star and the Ultimate Vulnerability
13mManaging Vulnerabilities in Open-Source Dependencies
30mTopics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ...
25mOWASP Top 10 Risks for Open Source Software