Open source security: who’s responsible?
summary
Panel gives concrete numbers (88% rise in library vulnerabilities, 81% say developers are responsible, 70% of maintainers feel unconfident, 48% learn of bugs via public channels) and practical fixes: use Snyk IDE plugin, CI and CLI to catch transitive issues (78% are indirect), enable GitHub security alerts, and join coalitions like the Continuous Delivery Foundation. Examples include coordinated disclosure on eight Jenkins CVEs in 2018 and attacks that mined ~$3M from unpatched servers; enterprises manage risk by assigning time, ownership, and resources across 200 open source projects.
AI-written summary · about
chapters (10)
- 0:00Introduction and panel setup
- 1:03Open source security responsibility
- 6:42Community support in security
- 11:21Company responsibility in open source
- 14:30Security in distributed projects
- 20:16Tools for vulnerability management
- 23:48Security remediation processes
- 27:42Industry trends in security
- 30:59Prioritizing security fixes
- 36:45Closing thoughts and Q&A
related talks
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
38mApplication Security in the age of Open Source
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
14mThe State of Open Source Vulnerabilities Management in 2019
25mOWASP Top 10 Risks for Open Source Software
16mKeynote: There Is Just One Way to Do Open Source Security: Together
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
01h 01mWe're Building On Hollowed Foundations (...)