Frontiers in Securing the Open Source Ecosystem
summary
OpenSSF forms in August 2020 and grows from single digits to 36 members and 250 active contributors, offering concrete tools: a free edX course, a best-practices badge (bronze–gold), a security scorecard, dependency-graph checks and partnerships like OWASP ZAP and Security Knowledge Framework. Concrete advice includes enabling 2FA, signing releases, CI/CD security, SBOMs, cloning and rebuilding external artifacts, and threat modeling (openssf.org paper). Historical shocks cited: Heartbleed’s two-maintainer crisis and Shellshock’s 25-year bug leading to millions of attacks.
AI-written summary · about
chapters (10)
- 0:00Introduction to OpenSSF
- 7:26Panel discussion begins
- 13:30Why securing open source matters
- 20:15Historical security incidents
- 26:14Threat modeling in open source
- 31:30Finding vulnerabilities in code
- 37:05Coordinated vulnerability disclosure
- 45:25Practical steps for maintainers
- 47:54Future of open source security
- 56:40Closing remarks and Q&A
related talks
42mDeveloping a Secure, Open Future
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
42mAction and Impact Panel: How OpenSSF and Industry Improve Open Source Security
40mBuilding Developer Confidence in Software Security with the DevRel Community
22mKeynote: Securing the Open Source Ecosystem
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
37mOpenSSF Best Practices for Everyone!
33mHow & Why Does The Work of OpenSSF Impact You