Open source security: Opportunity or oxymoron?
summary
Argues that secure open source is practical if started early, listing eight concrete steps: threat modeling, peer code review, SAST (GitHub integrates ~40–50 scanners and CodeQL), and fuzzing via OSS-Fuzz (Google runs 20k–40k nodes and often surfaces one or two real bugs after long runs). Recommends signing binaries (cites the vsftpd backdoor), publishing a clear security contact and end‑of‑life date, and using free tooling rather than buying expensive scanners.
AI-written summary · about
chapters (11)
- 0:00Secure dev in open source
- 3:16Why secure development matters for small projects
- 7:28Eight key practices for secure open source projects
- 13:11Threat modeling & secure code
- 17:30Secure code benefits startups
- 21:14Bug bounties & security investments
- 25:43Learning from large open source security efforts
- 27:13Government support for OSS security
- 29:07AI code & security risks
- 32:02Static analysis tool choices
- 34:51Q&A
related talks
37mSecuring Open Source Through Threat Modeling
38mApplication Security in the age of Open Source
40mSecurity: Why It _has_to Be Open Source
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
49mTrustworthy Open Source: The Consequences of Success
43mTime to Spell Out Open Source Software Security
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together