Lessons from OSV: Vulnerability Management for Open Source
summary
OSV started in 2021 and becomes a de facto open‑source vulnerability format used by GitHub, Canonical, Red Hat and others across 28 ecosystems; the aggregated feed now contains 300,000 advisories from a federated database model. Design focuses on actionable fields, strict ecosystem version rules, and absolute backwards compatibility. Production tooling includes osv.dev (aggregator/API) and OSV‑Scanner/library for source and container SBOM matching. Next work explores propagating intermediate VEX statements to cut false positives.
AI-written summary · about
chapters (10)
- 0:00OSV introduction
- 1:29OSV Schema principles
- 4:00OSV use cases and design
- 6:52Correctness and consistency
- 11:27Schema focus on open source
- 13:34OSV federated database
- 15:44Backwards compatibility
- 16:27Adoption with tooling
- 19:35Vulnerability management challenges
- 22:43Q&A
related talks
41mScalable Management of Vulnerabilities in Open Source
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
43mOpen Source Runs the World, Why Not Vulnerability Identifiers?
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
41mManaging the risk and growth of using Open Source Software
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...