Open Source Security: The World Needs Our Help
summary
Walks through the Codecov supply-chain hijack that altered a bash uploader, harvested credentials from at least 10,000 customer builds over about two months and stayed hidden while still uploading legitimate coverage data. Explains concrete defenses: transparency logs / sigstore, the salsa provenance framework, trusted build systems, private archives of dependencies, and tools like scorecards, deps.dev and OSV. Argues concrete funding and governance actions (OpenSSF $30M commitment, Kubernetes practices) are needed, not vague exhortations to “improve security.”
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:02Open source sustainability
- 3:08Supply chain attacks example
- 16:29Supply chain attack vectors
- 22:05SLSA framework
- 24:53OpenSSF Scorecard
- 26:38Depths.dev analysis
- 28:23OSV vulnerability management
- 30:11Open source maintenance cost
- 34:04Q&A
related talks
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
49mTrustworthy Open Source: The Consequences of Success
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
30mSecuring Open Source Supply Chains
30mSecuring the Open Source Software Supply Chain
11mKeynote: Securing Open Source
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
16mKeynote: There Is Just One Way to Do Open Source Security: Together