Assessing 3rd Party Libraries More Easily With Security Scorecards
summary
Claim: automated security scorecards let teams quantify library risk quickly. Uses OpenSSF Scorecard checks, the scorecard CLI and public viewers plus ecosystem maps (depths.dev) to pull scores; measured examples show a 3.1/10 for Newtonsoft.Json and 4.5/10 for HTML Agility Pack, a 4% overlap with enterprise dependency sets, and ~32% of apps using end‑of‑life versions; built a small aggregator called fek tool that walks transitive deps, fetches scorecards and emits HTML — it runs and surfaces per‑package weak checks.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:06Problem with third-party libraries
- 3:13Software nutrition labels
- 13:21OpenSSF Scorecards
- 26:03Live demo of Scorecards
- 33:11Scorecard effectiveness data
- 38:47Improving Scorecards
- 42:36Key takeaways
- 43:38Q&A
related talks
54mAssessing NuGet Packages more easily with Security Scorecards
59mReviewing NuGet Packages security easily using OpenSSF Scorecard
57mReviewing NuGet Packages security easily using OpenSSF Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mHow Do You Trust Your Open Source Software?
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
50mHow Do You Trust Open Source Software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories