Preparing for Zero-Day: Vulnerability Disclosure in Open Source Software
summary
Open source maintainers get practical steps: use GitHub Security Advisory or a clear security.md to receive reports, request a CVE for coordination, and expect typical embargo windows of 30–60–90 days. Key numbers: most projects (about 84%) harbor vulnerabilities, repositories average over 150 bugs, and undiscovered faults linger over four years on average. Exploitation now shows up in roughly three days after disclosure rather than six weeks. Guidance covers encrypted vs common channels, patching options, and handling dropped zero‑day or unpatchable flaws.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:58Definitions
- 6:30What is ZeroDay
- 13:13How do projects share vulnerability information
- 16:32How do projects coordinate vulnerability disclosure
- 19:42What to expect from researchers
- 23:42CVD vs Bug Bounty
- 27:45Common Challenges
- 31:27Negotiation
- 36:57Insights
- 40:00Get involved
- 40:30Final thoughts
related talks
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
18mWhat You Need to Know and Do about Vulnerability Disclosure
39mCVE 101: The Unfolding Of A Zero Day Attack
31mA Glimpse Into OSS Vulnerability Disclosure Practices
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
48mHow to report a vulnerability: Responsible Disclosure for Developers
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
15mThink Zero Days Are Your Your Biggest Risk - Think Again