Crossing the Streams - How Downstream Can Understand Upstream Vulns
summary
Downstream gets concrete: upstream projects should publish a security policy and contact, use CVE or GitHub Advisory/OSV IDs, and offer private intake and private patch development so fixes aren’t weaponized; the ecosystem supplies tools like Allstar, Sigstore and openVEX plus scorecards, dependency graphs and automation (GitHub Actions, Dependabot, CodeQL) to surface risk. Note scale: ~16 million repos include many single‑maintainer projects while a few dozen projects hold mature security teams; guides and CNA guidance exist and an Alpha/Omega fund helps fragile projects.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 1:52Presenters overview
- 3:16Why CVD matters
- 5:03CVD for open source
- 8:36CVD challenges
- 10:22Project maturity gaps
- 12:46Why CVD is hard
- 15:34Upstream vs downstream
- 16:37Need to cross streams
- 18:03Human factors in disclosure
- 19:10OpenSSF role
- 20:37Upstream CVD practices
- 22:41Downstream contact solutions
- 24:47OpenSSF CVD guides
- 26:10Developer security practices
- 27:35Security teams importance
- 29:02Vuln identifiers and CNAs
- 31:09Private reporting mechanisms
- 32:51Downstream communication
- 33:55Call to action
- 34:37OpenSSF security tools
- 38:09Q&A: AI and open source
- 40:59Q&A: Risk assessment
- 43:27Q&A: CNAs and data
- 44:53Q&A: Maintainer support
- 48:28Q&A: Automated detection
- 50:55Q&A: CVD process
- 52:17Q&A: CNA advice
- 54:28Q&A: Abandoned projects
- 57:19Q&A: Downstream motivation
related talks
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
48mImproving the Security of a Large Open Source Project One Step...
26mUpstream Collaboration for the Win (of the CRA)!
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
49mImproving FOSS Security
39mOpen source security: who’s responsible?
46mApplication security from start to finish