Building Secure Software OpenSSF Best Practices for Everyone!
summary
A practical path to safer software: run scorecard on repos (18 heuristic checks, outputs a 1–10 score) to surface missing branch protection, CI scanning and signing; don’t treat low scores as automatic blockers but use org-wide Scorecard Action to track historic scores. Cite real attacks: the xz-utils compromise is planned two years ahead and evades CI by disabling checks. Combine signing with sigstore, convert SBOMs into graphs with Guac and follow the OpenSSF concise guides and free courses.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:49Software supply chain trust
- 5:24Rising supply chain threats
- 7:52Scorecard for security
- 12:57Trust boundaries in SDLC
- 14:41OpenSSF's security role
- 17:12OpenSSF education resources
- 19:03Call to action
related talks
37mOpenSSF Best Practices for Everyone!
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mDeveloping a Secure, Open Future
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
50mHow Do You Trust Open Source Software?
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
43mAdventures in Securing an Open Source Project: From Repo Security Zero to Hero