Hacking the OSS Supply Chain
summary
More than 80% of enterprise apps use open source and the ecosystem already contains concrete failures: dependency confusion that netted a researcher ~$130k, typo‑squatting campaigns against Azure packages, and about 17,000 vulnerable npm packages found by one security team. Pyrsia implements a peer-to-peer network that performs builds verified across multiple companies, publishes a mutable transaction ledger for provenance, and currently supports Docker images; the claim is that downloaded artifacts match a build‑from‑source replica, preventing many supply‑chain injections.
AI-written summary · about
chapters (7)
- 0:00Why secure open source
- 1:44Supply chain risks today
- 3:30Dependency confusion attacks
- 5:18NPM vulnerabilities found
- 6:23Introducing Persia project
- 7:28How Persia works
- 9:14Project collaborators
related talks
42mHacking the OSS Supply Chain
32mHacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
51mA Community Approach to OSS Distribution
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
07mHow to Secure Your End-to-end Supply Chain
41mManaging the Risk of Software Supply Chain Attacks