The Burden of Knowledge: Dealing With Open Source Risks

on YouTube ↗43m

" summary

Organization-wide SBOMs reveal scale: 30,000 internal repos average 125 dependencies each, totalling 117,000 packages and a single top dependency appearing in 19% of projects. Automated tools used include SBOM generation (internal Swift), OpenSSF Scorecard and a bespoke red flag checker; analysis finds 9 of top 10 score <5/10 on OpenSSF. Practical options tested are risk profiling, targeted sponsorship, co‑maintaining critical packages, centralized contribution teams, developer guidance, and selective engagement.

AI-written summary · about

" chapters (7)

1. 0:00Introduction to open source risks
2. 1:42From assumptions to data
3. 9:34Problems with passive metrics
4. 15:32Scale of open source usage
5. 22:30Strategic risk management options
6. 27:45Call to action and collaboration
7. 40:49Q&A session

" related talks

• 45mPanel Discussion: Managing Open Source...Nithya A. Ruff, Rao Lakkakula, Andrew Aitken, Jeffrey Borek · Open Source Leadership Summit @ Open Source Summit North America 2023
• 41mManaging the risk and growth of using Open Source SoftwareJason Hammond · foss-north 2020
• 39mSOS: Sustainable Open SourceFloor Drees · Conf42 DevSecOps 2022
• 37mOpenSSF Best Practices for Everyone!Avishay Balter · NDC Manchester 2025
• 13mManaging Vulnerabilities in Open-Source DependenciesEva Sarafianou · SOSS Community Day Europe 2024
• 16mKeynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source SoftwareKatherine Druckman · SOSS Fusion 2024
• 42mAssessing the Risk of Open-source Components Using OpenSSF's ScorecardLaurent Simon, Naveen Srinivasan · SupplyChainSecurityCon at Open Source Summit North America 2022
• 25mDefining the Limits of RiskDaniel Izquierdo · SupplyChainSecurityCon at Open Source Summit Europe 2022